dinislage/web2py
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

remove XSS attack in installing plugin, thanks Nerendra Bhati

Browse Source
This commit is contained in:
mdipierro
2016-05-04 09:21:20 -05:00
parent 1e74c332d0
commit 51c3b633fe
1 changed files with 3 additions and 0 deletions
Download Patch File Download Diff File Expand all files Collapse all files
applications/admin/controllers/default.py
+3
View File
@@ -1954,6 +1954,9 @@ def install_plugin():
plugin = request.vars.plugin plugin = request.vars.plugin
if not (source and app): if not (source and app):
raise HTTP(500, T("Invalid request")) raise HTTP(500, T("Invalid request"))
# make sure no XSS attacks in source
if not source.lower().split('://')[0] in ('http','https'):
raise HTTP(500, T("Invalid request"))
form = SQLFORM.factory() form = SQLFORM.factory()
result = None result = None
if form.process().accepted: if form.process().accepted: