openstack/horizon
Code Issues Proposed changes

Escape the description param from heat template

Browse Source 
The heat template allows user to define custom parameters,
the fields are then converted to input fields. The description
param maps to the help_text attribute of the field.

Since the value comes from the user, the value must be escaped
before rendering.

Co-Authored-By: Lin Hua Cheng <os.lcheng@gmail.com>
Change-Id: I79d540a8363b2507c4bccdc0cc38e283962919d2
Closes-bug: #1453074
This commit is contained in:
lin-hua-cheng 2015-06-01 17:55:00 -07:00 committed by Lin Hua Cheng
parent 44e56fe624
commit 28d8f49786
1 changed files with 2 additions and 1 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

3
openstack_dashboard/dashboards/project/stacks/forms.py
View File

@ -13,6 +13,7 @@
import json
import logging
from django.utils import html
from django.utils.translation import ugettext_lazy as _
from django.views.decorators.debug import sensitive_variables # noqa
@ -310,7 +311,7 @@ class CreateStackForm(forms.SelfHandlingForm):
field_args = {
'initial': param.get('Default', None),
'label': param.get('Label', param_key),
'help_text': param.get('Description', ''),
'help_text': html.escape(param.get('Description', '')),
'required': param.get('Default', None) is None
}