Avoid html injection.

[invirt/packages/invirt-web.git] / code / templates / info.tmpl

diff --git a/code/templates/info.tmpl b/code/templates/info.tmpl
index fa815ca..91a2c3b 100644 (file)
--- a/code/templates/info.tmpl
+++ b/code/templates/info.tmpl
@@ -40,7 +40,11 @@ Info on $machine.name
        <td><input type="submit" class="button" name="action" value="Power on"/></td>
        #end if
       <td>Boot CD:</td>
-      <td>$cdromList()</td>
+      <td>#slurp
+#filter None
+$cdromList()#slurp
+#end filter
+</td>
   </tr>
     <tr>
       <td><input type="submit" class="button" name="action" value="Delete VM" onclick="return confirm('Are you sure that you want to delete this VM?');"/></td>
@@ -61,27 +65,57 @@ Info on $machine.name
 <form action="modify" method="POST">
   <input type="hidden" name="machine_id" value="$defaults.machine_id"/>
   <table>
-    <tr><td>Owner${helppopup("owner")}:</td><td><input type="text" name="owner", value="$defaults.owner"/></td></tr>
+    <tr><td>Owner#slurp
+#filter None
+$helppopup("owner")#slurp
+#end filter
+:</td><td><input type="text" name="owner", value="$defaults.owner"/></td></tr>
+#filter None
 $errorRow('owner', $err)
-    <tr><td>Administrator${helppopup("administrator")}:</td><td><input type="text" name="administrator", value="$defaults.administrator"/></td></tr>
+#end filter
+    <tr><td>Administrator#slurp
+#filter None
+$helppopup("administrator")#slurp
+#end filter
+:</td><td><input type="text" name="administrator", value="$defaults.administrator"/></td></tr>
+#filter None
 $errorRow('administrator', $err)
+#end filter
     <tr><td>Contact email:</td><td><input type="text" name="contact" value="$defaults.contact"/></td></tr>
+#filter None
 $errorRow('contact', $err)
+#end filter
 #if not $on
     <tr><td>Machine Name:</td><td><input type="text" name="name" value="$defaults.name"/></td></tr>
+#filter None
 $errorRow('name', $err)
+#end filter
     <tr>
-      <td>HVM/ParaVM$helppopup('hvm_paravm')</td>
-      <td>$vmTypeList($defaults.type)</td>
+      <td>HVM/ParaVM#slurp
+#filter None
+$helppopup('hvm_paravm')#slurp
+#end filter
+</td>
+      <td>#slurp
+#filter None
+$vmTypeList($defaults.type)#slurp
+#end filter
+</td>
     </tr>
     <tr><td>Ram:</td><td><input type="text" size=3 name="memory" value="$defaults.memory"/>MiB (max $max_mem)</td></tr>
+#filter None
 $errorRow('memory', $err)
+#end filter
     <tr><td>Disk:</td><td><input type="text" size=3 name="disk" value="$defaults.disk"/>GiB (max $max_disk)</td><td>WARNING: Modifying disk size may corrupt your data.</td></tr>
+#filter None
 $errorRow('disk', $err)
+#end filter
 #else
+#filter None
 $errorRow('name', $err)
 $errorRow('memory', $err)
 $errorRow('disk', $err)
+#end filter
 #end if
     <tr><td><input type="submit" class="button" name="action" value="Change"/></td></tr>
   </table>
@@ -90,15 +124,21 @@ $errorRow('disk', $err)
 
 #def body
 <div id="info">
+#filter None
   $infoTable()
+#end filter
 </div>
 
 <h2>Commands</h2>
 <div id="commands">
+#filter None
   $commands()
+#end filter
 </div>
 <h2>Settings</h2>
 <div id="modify">
+#filter None
   $modifyForm()
+#end filter
 </div>
 #end def