浏览代码

HUE-2743 [search] Escape HTML in the jHueNotify messages

Added escape for the second to N messages too
Enrico Berti 10 年之前
父节点
当前提交
416358f

+ 2 - 1
desktop/core/src/desktop/static/desktop/js/jquery.notify.js

@@ -48,6 +48,8 @@
     var _this = this;
     var MARGIN = 10;
 
+    _this.options.message = $("<span>").html(_this.options.message).text(); // escape HTML messages
+
     if (_this.options.level == TYPES.ERROR && $(".jHueNotify.alert-error").length > 0) {
       $(".jHueNotify.alert-error").find(".message").html("<i class='fa fa-exclamation-triangle'></i> <strong>" + _this.options.message + "</strong>");
     }
@@ -64,7 +66,6 @@
         el.css("top", $(".jHueNotify").last().position().top + $(".jHueNotify").last().outerHeight() + MARGIN - $(window).scrollTop());
       }
 
-      _this.options.message = $("<span>").html(_this.options.message).text();
 
       if (_this.options.level == TYPES.ERROR) {
         el.addClass("alert-error");

+ 1 - 1
desktop/core/src/desktop/templates/login.mako

@@ -190,7 +190,7 @@ ${ commonheader("Welcome to Hue", "login", user, "50px") | n,unicode }
     <div class="login-content center">
       <div id="logo"></div>
 
-      <form method="POST" action="${action}" class="well login-content">
+      <form method="POST" action="${action}" class="well">
         ${ csrf_token(request) | n,unicode }
         %if first_login_ever:
           <h3>${_('Create your Hue account')}</h3>