horizon/openstack_dashboard/dashboards/admin/groups
Julie Pichon 32a7b71346 Fix multiple Cross-Site Scripting (XSS) vulnerabilities.
* Ensure user emails are properly escaped

User emails in the Users and Groups panel are being passed through the
urlize filter to transform them into clickable links. However, urlize
expects input to be already escaped and safe. We should make sure to
escape the strings first as email addresses are not validated and can
contain any type of string.

Closes-Bug: #1320235

 * Ensure network names are properly escaped in the Launch Instance menu

Closes-Bug: #1322197

 * Escape the URLs generated for the Horizon tables

When generating the Horizon tables, there was an assumption that only
the anchor text needed to be escaped. However some URLs are generated
based on user-provided data and should be escaped as well. Also escape
the link attributes for good measure.

 * Use 'reverse' to generate the Resource URLs in the stacks tables

Closes-Bug: #1308727

Change-Id: Ic8a92e69f66c2d265a802f350e30f091181aa42e
2014-07-08 13:08:15 +01:00
..
templates/groups Adding the ability to set/use domain context 2013-07-10 09:00:09 -06:00
__init__.py Group CRUD and Management in Admin Dashboard. 2013-05-27 21:45:41 -07:00
constants.py Gate on H102 Apache 2.0 license header not found for pep8 2013-11-19 13:55:04 -05:00
forms.py Remove #noqa from most common imports and add them to import_exceptions 2014-01-07 12:26:35 +01:00
panel.py Remove #noqa from most common imports and add them to import_exceptions 2014-01-07 12:26:35 +01:00
tables.py Fix multiple Cross-Site Scripting (XSS) vulnerabilities. 2014-07-08 13:08:15 +01:00
tests.py Remove #noqa from most common imports and add them to import_exceptions 2014-01-07 12:26:35 +01:00
urls.py Fix django.conf.urls.defaults imports 2013-11-04 17:10:57 +11:00
views.py Remove #noqa from most common imports and add them to import_exceptions 2014-01-07 12:26:35 +01:00