remove XSS attack in installing plugin, thanks Nerendra Bhati

2016-05-04 09:21:20 -05:00
parent 1e74c332d0
commit 51c3b633fe
1 changed files with 3 additions and 0 deletions
--- a/applications/admin/controllers/default.py
+++ b/applications/admin/controllers/default.py
@@ -1954,6 +1954,9 @@ def install_plugin():
    plugin = request.vars.plugin
    if not (source and app):
        raise HTTP(500, T("Invalid request"))
+    # make sure no XSS attacks in source
+    if not source.lower().split('://')[0] in ('http','https'):
+        raise HTTP(500, T("Invalid request"))
    form = SQLFORM.factory()
    result = None
    if form.process().accepted: