瀏覽代碼

HUE-6212 [oozie] Prevent XSS injection from packets

This is a follow up for 'd86ee1eed54b33d1338184b15a05cf8ba37b6182'
which prevented entering tags from UI. Current fix handles the
case where the network packet is modifed to have tags.
krish 8 年之前
父節點
當前提交
8f8ecd1
共有 1 個文件被更改,包括 2 次插入1 次删除
  1. 2 1
      apps/oozie/src/oozie/views/editor.py

+ 2 - 1
apps/oozie/src/oozie/views/editor.py

@@ -26,6 +26,7 @@ from django.forms.formsets import formset_factory
 from django.forms.models import inlineformset_factory
 from django.http import HttpResponse
 from django.shortcuts import redirect
+from django.template.defaultfilters import strip_tags
 from django.utils.functional import curry
 from django.utils.http import http_date
 from django.utils.translation import ugettext as _, activate as activate_translation
@@ -502,7 +503,7 @@ def edit_coordinator(request, coordinator):
       new_data_output_formset.save()
       coordinator.sla = json.loads(request.POST.get('sla'))
       if enable_cron_scheduling:
-        coordinator.cron_frequency = {'frequency': request.POST.get('cron_frequency'), 'isAdvancedCron': request.POST.get('isAdvancedCron') == 'on'}
+        coordinator.cron_frequency = {'frequency': strip_tags(request.POST.get('cron_frequency')), 'isAdvancedCron': request.POST.get('isAdvancedCron') == 'on'}
       coordinator.save()
 
       request.info(_('Coordinator saved.'))