Remove |safe from openrc.template
Review I56ec047da467b721bd1b57d2c97d05717e83f468 added |safe to
the TEMPLATE_NAME variable in order to allow special characters for
tenant names but it turned out to be a security issue as explained in
one of the comments.
This reverts commit 3a9b0da489
It's still an issue to discuss as referenced in bug 1100042
Change-Id: I919a56ac799e3358bf3d56af3c6083814e97c98d
This commit is contained in:
@@ -1,39 +0,0 @@
|
||||
# vim: tabstop=4 shiftwidth=4 softtabstop=4
|
||||
|
||||
# Copyright (c) 2012 OpenStack, LLC.
|
||||
# All Rights Reserved.
|
||||
#
|
||||
# Licensed under the Apache License, Version 2.0 (the "License"); you may
|
||||
# not use this file except in compliance with the License. You may obtain
|
||||
# a copy of the License at
|
||||
#
|
||||
# http://www.apache.org/licenses/LICENSE-2.0
|
||||
#
|
||||
# Unless required by applicable law or agreed to in writing, software
|
||||
# distributed under the License is distributed on an "AS IS" BASIS, WITHOUT
|
||||
# WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. See the
|
||||
# License for the specific language governing permissions and limitations
|
||||
# under the License.
|
||||
|
||||
from os import path
|
||||
from openstack_dashboard.test import helpers as test
|
||||
from django.template.loader import render_to_string
|
||||
|
||||
|
||||
class FakeUser(object):
|
||||
username = "Super S"
|
||||
|
||||
|
||||
class TemplateRenderTest(test.TestCase):
|
||||
""" Tests for templates render """
|
||||
|
||||
def test_openrc_html_escape(self):
|
||||
context = {
|
||||
"user": FakeUser(),
|
||||
"tenant_id": "some-cool-id",
|
||||
"auth_url": "http://tests.com",
|
||||
"tenant_name": "ENG Perf R&D"}
|
||||
out = render_to_string('settings/project/openrc.sh.template', context)
|
||||
|
||||
self.assertFalse("&" in out)
|
||||
self.assertTrue("ENG Perf R&D" in out)
|
||||
Reference in New Issue
Block a user