Avoid html injection.

[invirt/packages/invirt-web.git] / code / main.py

diff --git a/code/main.py b/code/main.py
index 3fe04d5..3b43859 100755 (executable)
--- a/code/main.py
+++ b/code/main.py
@@ -11,6 +11,7 @@ import sha
 import simplejson
 import sys
 import time
+import urllib
 from StringIO import StringIO
 
 def revertStandardError():
@@ -39,6 +40,7 @@ from Cheetah.Template import Template
 import sipb_xen_database
 from sipb_xen_database import Machine, CDROM, ctx, connect, MachineAccess, Type, Autoinstall
 import validation
+import cache_acls
 from webcommon import InvalidInput, CodeError, g
 import controls
 
@@ -57,12 +59,15 @@ class Checkpoint:
 
 checkpoint = Checkpoint()
 
+def jquote(string):
+    return "'" + string.replace('\\', '\\\\').replace("'", "\\'").replace('\n', '\\n') + "'"
 
 def helppopup(subj):
     """Return HTML code for a (?) link to a specified help topic"""
-    return ('<span class="helplink"><a href="help?subject=' + subj +
-            '&amp;simple=true" target="_blank" ' +
-            'onclick="return helppopup(\'' + subj + '\')">(?)</a></span>')
+    return ('<span class="helplink"><a href="help?' +
+            cgi.escape(urllib.urlencode(dict(subject=subj, simple='true')))
+            +'" target="_blank" ' +
+            'onclick="return helppopup(' + cgi.escape(jquote(subj)) + ')">(?)</a></span>')
 
 def makeErrorPre(old, addition):
     if addition is None:
@@ -394,16 +399,21 @@ def modifyDict(user, fields):
                 disk.size = disksize
                 ctx.current.save(disk)
 
-        if owner is not None:
+        update_acl = False
+        if owner is not None and owner != machine.owner:
             machine.owner = owner
+            update_acl = True
         if name is not None:
             machine.name = name
-        if admin is not None:
+        if admin is not None and admin != machine.administrator:
             machine.administrator = admin
+            update_acl = True
         if contact is not None:
             machine.contact = contact
 
         ctx.current.save(machine)
+        if update_acl:
+            cache_acls.refreshMachine(machine)
         transaction.commit()
     except:
         transaction.rollback()