From: Eric Price Date: Tue, 22 Apr 2008 05:37:50 +0000 (-0400) Subject: Avoid html injection. X-Git-Tag: sipb-xen-www/3.4~22 X-Git-Url: http://xvm.mit.edu/gitweb/invirt/packages/invirt-web.git/commitdiff_plain/7b924b8f4ec3c62b70a012f7d417beb230db8965 Avoid html injection. Cheetah is painful. svn path=/trunk/packages/sipb-xen-www/; revision=447 --- diff --git a/code/main.py b/code/main.py index de28a63..3b43859 100755 --- a/code/main.py +++ b/code/main.py @@ -11,6 +11,7 @@ import sha import simplejson import sys import time +import urllib from StringIO import StringIO def revertStandardError(): @@ -58,12 +59,15 @@ class Checkpoint: checkpoint = Checkpoint() +def jquote(string): + return "'" + string.replace('\\', '\\\\').replace("'", "\\'").replace('\n', '\\n') + "'" def helppopup(subj): """Return HTML code for a (?) link to a specified help topic""" - return ('(?)') + return ('(?)') def makeErrorPre(old, addition): if addition is None: diff --git a/code/templates/functions.tmpl b/code/templates/functions.tmpl index 0854e6f..2ae2266 100644 --- a/code/templates/functions.tmpl +++ b/code/templates/functions.tmpl @@ -1,3 +1,4 @@ +#filter WebSafe #def databaseList($lst, $default, $onchange, $name, $id, $valueattr, $descattr) #end if Boot CD: - $cdromList() + #slurp +#filter None +$cdromList()#slurp +#end filter + @@ -61,27 +65,57 @@ Info on $machine.name
- + +#filter None $errorRow('owner', $err) - +#end filter + +#filter None $errorRow('administrator', $err) +#end filter +#filter None $errorRow('contact', $err) +#end filter #if not $on +#filter None $errorRow('name', $err) +#end filter - - + + +#filter None $errorRow('memory', $err) +#end filter +#filter None $errorRow('disk', $err) +#end filter #else +#filter None $errorRow('name', $err) $errorRow('memory', $err) $errorRow('disk', $err) +#end filter #end if
Owner${helppopup("owner")}:
Owner#slurp +#filter None +$helppopup("owner")#slurp +#end filter +:
Administrator${helppopup("administrator")}:
Administrator#slurp +#filter None +$helppopup("administrator")#slurp +#end filter +:
Contact email:
Machine Name:
HVM/ParaVM$helppopup('hvm_paravm')$vmTypeList($defaults.type)HVM/ParaVM#slurp +#filter None +$helppopup('hvm_paravm')#slurp +#end filter +#slurp +#filter None +$vmTypeList($defaults.type)#slurp +#end filter +
Ram:MiB (max $max_mem)
Disk:GiB (max $max_disk)WARNING: Modifying disk size may corrupt your data.
@@ -90,15 +124,21 @@ $errorRow('disk', $err) #def body
+#filter None $infoTable() +#end filter

Commands

+#filter None $commands() +#end filter

Settings

+#filter None $modifyForm() +#end filter
#end def diff --git a/code/templates/list.tmpl b/code/templates/list.tmpl index 71f36ea..7d484f3 100644 --- a/code/templates/list.tmpl +++ b/code/templates/list.tmpl @@ -19,36 +19,65 @@ VM List +#filter None $errorRow('create', $err) +#end filter +#filter None $errorRow('name', $err) +#end filter +#filter None $errorRow('memory', $err) +#end filter +#filter None $errorRow('disk', $err) +#end filter - - + + +#filter None $errorRow('vmtype', $err) +#end filter - - + - + $errorRow('cdrom', $err) @@ -57,7 +86,9 @@ $errorRow('cdrom', $err) +#filter None $errorRow('owner', $err) +#end filter
Name
Memory MiB ($max_memory max)
Disk GiB (${"%0.1f" % ($max_disk-0.05)} max)
HVM/ParaVM$helppopup('hvm_paravm')$vmTypeList($defaults.type)HVM/ParaVM#slurp +#filter None +$helppopup('hvm_paravm')#slurp +#end filter + +#filter None +$vmTypeList($defaults.type) +#end filter +
Autoinstall$helppopup('autoinstall')$autoList($defaults.cdrom, "document.getElementById('cd_or_auto_auto').checked = true;document.getElementById('cdromlist').value = ''") + Autoinstall#slurp +#filter None +$helppopup('autoinstall')#slurp +#end filter + +#filter None +$autoList($defaults.cdrom, "document.getElementById('cd_or_auto_auto').checked = true;document.getElementById('cdromlist').value = ''") (experimental; 1-2 minutes, and you have a machine; root pw is 'password'.) +#end filter
Boot CD$cdromList($defaults.cdrom, "document.getElementById('cd_or_auto_cd').checked = true;document.getElementById('autoinstalllist').value = ''") +#filter None +$cdromList($defaults.cdrom, "document.getElementById('cd_or_auto_cd').checked = true;document.getElementById('autoinstalllist').value = ''") +#end filter +
Owner
@@ -85,7 +116,9 @@ $machine.uptime#slurp #if $has_vnc[$machine] == True Console#slurp #else if $has_vnc[$machine] != 'Off' +#filter None $has_vnc[$machine] +#end filter #end if @@ -106,15 +139,25 @@ $has_vnc[$machine] Name Memory - Owner$helppopup('owner') - Administrator$helppopup('administrator') + Owner#slurp +#filter None +$helppopup('owner')#slurp +#end filter + + Administrator#slurp +#filter None +$helppopup('administrator')#slurp +#end filter + IP Uptime VNC #for $machine in $machines: + #filter None $machineRow($machine) + #end filter #end for #end def @@ -127,7 +170,11 @@ $has_vnc[$machine] #end if

refresh

+ #filter None $machineList($machines) + #end filter
+#filter None $createForm() +#end filter #end def diff --git a/code/templates/skeleton.tmpl b/code/templates/skeleton.tmpl index e68c819..d7855fb 100644 --- a/code/templates/skeleton.tmpl +++ b/code/templates/skeleton.tmpl @@ -59,7 +59,6 @@ function helppopup(name){
  • Help
    • #end if -
    #if $varExists('result') $result @@ -69,7 +68,9 @@ $result #if not $varExists('simple') or not $simple

    $title — SIPB Virtual Servers

    #end if +#filter None $body +#end filter #if not $varExists('simple') or not $simple
    Questions? Contact sipb-xen@mit.edu.