Răsfoiți Sursa

HUE-6212 [oozie] Prevent XSS injection in coordinator cron frequency field

krish 8 ani în urmă
părinte
comite
d86ee1eed5

+ 4 - 5
apps/oozie/src/oozie/static/oozie/js/coordinator.js

@@ -38,11 +38,12 @@ function initCoordinator(coordinator_json, i18n) {
       })
       .jqCronGetInstance();
 
-  var coordViewModel = function() {
+  var coordViewModel = function(coordinator_json) {
     var self = this;
 
+    self.cronFrequency = ko.observable(typeof coordinator_json.frequency != "undefined" && coordinator_json.frequency != null ? coordinator_json.frequency : '');
     self.isSaveVisible = ko.observable(false);
-    self.isAdvancedCron = ko.observable(false);
+    self.isAdvancedCron = ko.observable(typeof coordinator_json.isAdvancedCron != "undefined" && coordinator_json.isAdvancedCron != null ? coordinator_json.isAdvancedCron : false);
     self.isAdvancedCron.subscribe(function(value) {
       if (value) {
         coordCron.disable();
@@ -52,9 +53,7 @@ function initCoordinator(coordinator_json, i18n) {
     });
   };
 
-  window.coordViewModel = new coordViewModel();
-  window.coordViewModel.isAdvancedCron(coordinator_json.isAdvancedCron);
-  $('#coord-frequency').val(coordinator_json.frequency),
+  window.coordViewModel = new coordViewModel(coordinator_json);
 
   ko.applyBindings(window.coordViewModel, document.getElementById('step2'));
 }

+ 1 - 1
apps/oozie/src/oozie/templates/editor/coordinator_utils.mako

@@ -27,7 +27,7 @@
       <div class="row-fluid">
         <div class="span9">
           <a data-bind="visible: isAdvancedCron" href="http://www.quartz-scheduler.org/documentation/quartz-2.x/tutorials/crontrigger.html" class="pull-right" target="_blank">&nbsp;<i class="fa fa-question-circle" title="${ _('Check syntax ?') }"></i></a>
-          <input data-bind="visible: isAdvancedCron" id="coord-frequency" name="cron_frequency" class="pull-right"/>
+          <input data-bind="textInput: cronFrequency, visible: isAdvancedCron, tagsNotAllowed" id="coord-frequency" name="cron_frequency" class="pull-right"/>
           <span data-bind="visible: isAdvancedCron" class="pull-right" style="padding-right:20px">
             ${ _('Crontab') }
           </span>&nbsp;

+ 1 - 1
apps/oozie/src/oozie/templates/editor2/common_scheduler.inc.mako

@@ -79,7 +79,7 @@ from django.utils.translation import ugettext as _
                 <div class="control-group" data-bind="visible: coordinator.properties.cron_advanced">
                   <label class="control-label">${ _('Crontab') }</label>
                   <div class="controls">
-                    <input id="coord-frequency" type="text" data-bind="value: coordinator.properties.cron_frequency, enable: $root.isEditing, attachViewModelToElementData" name="cron_frequency"/>
+                    <input id="coord-frequency" type="text" data-bind="textInput: coordinator.properties.cron_frequency, enable: $root.isEditing, attachViewModelToElementData, tagsNotAllowed" name="cron_frequency"/>
                     <span class="help-inline">
                       <a data-bind="visible: coordinator.properties.cron_advanced" href="http://www.quartz-scheduler.org/documentation/quartz-2.x/tutorials/crontrigger.html" target="_blank">
                       <i class="fa fa-question-circle" title="${ _('Check syntax ?') }"></i></a>