From f7a1c245cdb78a300cf56432b73e547f51ce573d Mon Sep 17 00:00:00 2001 From: Mark Sapiro Date: Fri, 18 Feb 2011 17:33:50 -0800 Subject: An XSS vulnerability, CVE-2011-0707, has been fixed. --- Mailman/Cgi/confirm.py | 6 +++--- 1 file changed, 3 insertions(+), 3 deletions(-) (limited to 'Mailman/Cgi') diff --git a/Mailman/Cgi/confirm.py b/Mailman/Cgi/confirm.py index 6ad0ffae..607f1784 100644 --- a/Mailman/Cgi/confirm.py +++ b/Mailman/Cgi/confirm.py @@ -471,7 +471,7 @@ def unsubscription_prompt(mlist, doc, cookie, addr): if fullname is None: fullname = _('Not available') else: - fullname = Utils.uncanonstr(fullname, lang) + fullname = Utils.websafe(Utils.uncanonstr(fullname, lang)) table.AddRow([_("""Your confirmation is required in order to complete the unsubscription request from the mailing list %(listname)s. You are currently subscribed with @@ -573,7 +573,7 @@ def addrchange_prompt(mlist, doc, cookie, oldaddr, newaddr, globally): if fullname is None: fullname = _('Not available') else: - fullname = Utils.uncanonstr(fullname, lang) + fullname = Utils.websafe(Utils.uncanonstr(fullname, lang)) if globally: globallys = _('globally') else: @@ -815,7 +815,7 @@ def reenable_prompt(mlist, doc, cookie, list, member): if username is None: username = _('not available') else: - username = Utils.uncanonstr(username, lang) + username = Utils.websafe(Utils.uncanonstr(username, lang)) table.AddRow([_("""Your membership in the %(realname)s mailing list is currently disabled due to excessive bounces. Your confirmation is -- cgit v1.2.3