horizon/horizon
Julie Pichon c844bd6928 Fix multiple Cross-Site Scripting (XSS) vulnerabilities
* Ensure user emails are properly escaped

User emails in the Users and Groups panel are being passed through the
urlize filter to transform them into clickable links. However, urlize
expects input to be already escaped and safe. We should make sure to
escape the strings first as email addresses are not validated and can
contain any type of string.

Closes-Bug: #1320235

 * Ensure network names are properly escaped in the Launch Instance menu

Closes-Bug: #1322197

 * Escape the URLs generated for the Horizon tables

When generating the Horizon tables, there was an assumption that only
the anchor text needed to be escaped. However some URLs are generated
based on user-provided data and should be escaped as well. Also escape
the link attributes for good measure.

 * Use 'reverse' to generate the Resource URLs in the stacks tables

Closes-Bug: #1308727

Conflicts:
	horizon/tables/base.py
	openstack_dashboard/dashboards/admin/users/tables.py

Change-Id: Ic8a92e69f66c2d265a802f350e30f091181aa42e
2014-07-08 16:04:01 +01:00
..
browsers PEP8 E126 has been resolved 2013-09-17 20:48:09 +09:00
conf divides "import" statement in a url.py 2013-09-17 15:50:04 +09:00
forms Implement required field indicator 2013-09-03 10:47:02 -06:00
locale Import translations for Havana 2013.2.2 udpate 2014-02-03 03:58:19 +09:00
management PEP8 E121 has been resolved 2013-09-05 14:38:58 +08:00
static Fix multiple Cross-Site Scripting (XSS) vulnerabilities 2014-07-08 16:04:01 +01:00
tables Fix multiple Cross-Site Scripting (XSS) vulnerabilities 2014-07-08 16:04:01 +01:00
tabs Enable H302 check 2013-08-22 17:39:09 +04:00
templates Introduces escaping in Horizon/Orchestration 2014-04-09 00:13:11 +09:00
templatetags show limit summary in GB 2013-09-23 13:18:45 +02:00
test Fix inappropriate logouts on load-balanced Horizon 2014-01-30 10:30:06 +11:00
utils Logging user out after self password change 2013-11-27 11:22:16 +01:00
workflows Bad workflow-steps check: has_required_fields 2014-01-22 10:15:51 +01:00
__init__.py Enable H302 check 2013-08-22 17:39:09 +04:00
base.py Enable H302 check 2013-08-22 17:39:09 +04:00
context_processors.py Unifies Horizon conf. 2012-11-20 14:29:05 -08:00
decorators.py Enable H302 check 2013-08-22 17:39:09 +04:00
exceptions.py Enable H302 check 2013-08-22 17:39:09 +04:00
loaders.py Enable H302 check 2013-08-22 17:39:09 +04:00
messages.py Enable H302 check 2013-08-22 17:39:09 +04:00
middleware.py Fix inappropriate logouts on load-balanced Horizon 2014-01-30 10:30:06 +11:00
models.py Unifies the project packaging into one set of modules. 2012-02-29 00:20:13 -08:00
site_urls.py Enable H302 check 2013-08-22 17:39:09 +04:00
version.py Replace OpenStack LLC with OpenStack Foundation 2013-09-20 04:19:42 +08:00
views.py Enable H201: do not write "except:" 2013-08-13 17:21:32 +10:00