[python-django-horizon/el6-icehouse] Updated patches from el6-icehouse-patches
Matthias Runge
mrunge at fedoraproject.org
Thu Jul 24 08:48:19 UTC 2014
commit 7c002393f4a8ded540eb49376a0537962a40013c
Author: Matthias Runge <mrunge at redhat.com>
Date: Thu Jul 24 09:38:46 2014 +0200
Updated patches from el6-icehouse-patches
...-Fix-issues-with-importing-the-Login-form.patch | 38 +++++
...e-Cross-Site-Scripting-XSS-vulnerabilitie.patch | 161 ++++++++++++++++++++
python-django-horizon.spec | 5 +-
3 files changed, 202 insertions(+), 2 deletions(-)
---
diff --git a/0013-Fix-issues-with-importing-the-Login-form.patch b/0013-Fix-issues-with-importing-the-Login-form.patch
new file mode 100644
index 0000000..4128253
--- /dev/null
+++ b/0013-Fix-issues-with-importing-the-Login-form.patch
@@ -0,0 +1,38 @@
+From 6fd590bb165db3728661b1d139a61342fa41e23c Mon Sep 17 00:00:00 2001
+From: Julie Pichon <jpichon at redhat.com>
+Date: Thu, 19 Jun 2014 17:13:29 +0100
+Subject: [PATCH] Fix issues with importing the Login form
+
+The Login form lives in openstack_auth.forms and should be directly
+imported from that file.
+
+Change-Id: I42808530024bebb01604adbf4828769812856bf3
+Closes-Bug: #1332149
+(cherry picked from commit 345ccc9d503e6e55fe46d7813958c0081cc1cffe)
+(cherry picked from commit 765e6d3c81925c5ed6f6a944eb15e25c6751819f)
+---
+ openstack_dashboard/views.py | 4 ++--
+ 1 file changed, 2 insertions(+), 2 deletions(-)
+
+diff --git a/openstack_dashboard/views.py b/openstack_dashboard/views.py
+index 15d94bd..8a630e9 100644
+--- a/openstack_dashboard/views.py
++++ b/openstack_dashboard/views.py
+@@ -19,7 +19,7 @@ from django.views.decorators import vary
+
+ import horizon
+
+-from openstack_auth import views
++from openstack_auth import forms
+
+
+ def get_user_home(user):
+@@ -32,7 +32,7 @@ def get_user_home(user):
+ def splash(request):
+ if request.user.is_authenticated():
+ return shortcuts.redirect(horizon.get_user_home(request.user))
+- form = views.Login(request)
++ form = forms.Login(request)
+ request.session.clear()
+ request.session.set_test_cookie()
+ return shortcuts.render(request, 'splash.html', {'form': form})
diff --git a/0014-Fix-multiple-Cross-Site-Scripting-XSS-vulnerabilitie.patch b/0014-Fix-multiple-Cross-Site-Scripting-XSS-vulnerabilitie.patch
new file mode 100644
index 0000000..a8cfdc7
--- /dev/null
+++ b/0014-Fix-multiple-Cross-Site-Scripting-XSS-vulnerabilitie.patch
@@ -0,0 +1,161 @@
+From 6378f80938362964a8a0454f4ae16c8642005dbd Mon Sep 17 00:00:00 2001
+From: Julie Pichon <jpichon at redhat.com>
+Date: Thu, 22 May 2014 16:45:03 +0100
+Subject: [PATCH] Fix multiple Cross-Site Scripting (XSS) vulnerabilities.
+
+ * Ensure user emails are properly escaped
+
+User emails in the Users and Groups panel are being passed through the
+urlize filter to transform them into clickable links. However, urlize
+expects input to be already escaped and safe. We should make sure to
+escape the strings first as email addresses are not validated and can
+contain any type of string.
+
+Closes-Bug: #1320235
+
+ * Ensure network names are properly escaped in the Launch Instance menu
+
+Closes-Bug: #1322197
+
+ * Escape the URLs generated for the Horizon tables
+
+When generating the Horizon tables, there was an assumption that only
+the anchor text needed to be escaped. However some URLs are generated
+based on user-provided data and should be escaped as well. Also escape
+the link attributes for good measure.
+
+ * Use 'reverse' to generate the Resource URLs in the stacks tables
+
+Closes-Bug: #1308727
+
+Change-Id: Ic8a92e69f66c2d265a802f350e30f091181aa42e
+(cherry picked from commit 32a7b713468161282f2ea01d5e2faff980d924cd)
+---
+ horizon/static/horizon/js/horizon.instances.js | 9 ++++++++-
+ horizon/tables/base.py | 4 +++-
+ openstack_dashboard/dashboards/admin/groups/tables.py | 3 ++-
+ openstack_dashboard/dashboards/admin/users/tables.py | 4 +++-
+ openstack_dashboard/dashboards/project/stacks/tables.py | 9 +++++++--
+ openstack_dashboard/dashboards/project/stacks/tabs.py | 6 ++++++
+ 6 files changed, 29 insertions(+), 6 deletions(-)
+
+diff --git a/horizon/static/horizon/js/horizon.instances.js b/horizon/static/horizon/js/horizon.instances.js
+index e8e9353..d4ef8a0 100644
+--- a/horizon/static/horizon/js/horizon.instances.js
++++ b/horizon/static/horizon/js/horizon.instances.js
+@@ -51,8 +51,15 @@ horizon.instances = {
+ $(this.get_network_element("")).each(function(){
+ var $this = $(this);
+ var $input = $this.children("input");
++ var name = $this.text().replace(/^\s+/,"")
++ .replace(/&/g, '&')
++ .replace(/</g, '<')
++ .replace(/>/g, '>')
++ .replace(/"/g, '"')
++ .replace(/'/g, ''')
++ .replace(/\//g, '/');
+ var network_property = {
+- name:$this.text().replace(/^\s+/,""),
++ name:name,
+ id:$input.attr("id"),
+ value:$input.attr("value")
+ };
+diff --git a/horizon/tables/base.py b/horizon/tables/base.py
+index 10aaa98..4aceb81 100644
+--- a/horizon/tables/base.py
++++ b/horizon/tables/base.py
+@@ -676,7 +676,9 @@ class Cell(html.HTMLElement):
+ link_classes = ' '.join(self.column.link_classes)
+ # Escape the data inside while allowing our HTML to render
+ data = mark_safe('<a href="%s" class="%s">%s</a>' %
+- (self.url, link_classes, escape(unicode(data))))
++ (escape(self.url),
++ escape(link_classes),
++ escape(unicode(data))))
+ return data
+
+ @property
+diff --git a/openstack_dashboard/dashboards/admin/groups/tables.py b/openstack_dashboard/dashboards/admin/groups/tables.py
+index 1f32da2..286c22b 100644
+--- a/openstack_dashboard/dashboards/admin/groups/tables.py
++++ b/openstack_dashboard/dashboards/admin/groups/tables.py
+@@ -161,7 +161,8 @@ class AddMembersLink(tables.LinkAction):
+ class UsersTable(tables.DataTable):
+ name = tables.Column('name', verbose_name=_('User Name'))
+ email = tables.Column('email', verbose_name=_('Email'),
+- filters=[defaultfilters.urlize])
++ filters=[defaultfilters.escape,
++ defaultfilters.urlize])
+ id = tables.Column('id', verbose_name=_('User ID'))
+ enabled = tables.Column('enabled', verbose_name=_('Enabled'),
+ status=True,
+diff --git a/openstack_dashboard/dashboards/admin/users/tables.py b/openstack_dashboard/dashboards/admin/users/tables.py
+index b2032c4..9c6dc04 100644
+--- a/openstack_dashboard/dashboards/admin/users/tables.py
++++ b/openstack_dashboard/dashboards/admin/users/tables.py
+@@ -131,7 +131,9 @@ class UsersTable(tables.DataTable):
+ email = tables.Column('email', verbose_name=_('Email'),
+ filters=(lambda v: defaultfilters
+ .default_if_none(v, ""),
+- defaultfilters.urlize))
++ defaultfilters.escape,
++ defaultfilters.urlize)
++ )
+ # Default tenant is not returned from Keystone currently.
+ #default_tenant = tables.Column('default_tenant',
+ # verbose_name=_('Default Project'))
+diff --git a/openstack_dashboard/dashboards/project/stacks/tables.py b/openstack_dashboard/dashboards/project/stacks/tables.py
+index e5f829a..1174746 100644
+--- a/openstack_dashboard/dashboards/project/stacks/tables.py
++++ b/openstack_dashboard/dashboards/project/stacks/tables.py
+@@ -114,11 +114,16 @@ class StacksTable(tables.DataTable):
+ ChangeStackTemplate)
+
+
++def get_resource_url(obj):
++ return urlresolvers.reverse('horizon:project:stacks:resource',
++ args=(obj.stack_id, obj.resource_name))
++
++
+ class EventsTable(tables.DataTable):
+
+ logical_resource = tables.Column('resource_name',
+ verbose_name=_("Stack Resource"),
+- link=lambda d: d.resource_name,)
++ link=get_resource_url)
+ physical_resource = tables.Column('physical_resource_id',
+ verbose_name=_("Resource"),
+ link=mappings.resource_to_url)
+@@ -163,7 +168,7 @@ class ResourcesTable(tables.DataTable):
+
+ logical_resource = tables.Column('resource_name',
+ verbose_name=_("Stack Resource"),
+- link=lambda d: d.resource_name)
++ link=get_resource_url)
+ physical_resource = tables.Column('physical_resource_id',
+ verbose_name=_("Resource"),
+ link=mappings.resource_to_url)
+diff --git a/openstack_dashboard/dashboards/project/stacks/tabs.py b/openstack_dashboard/dashboards/project/stacks/tabs.py
+index c68464a..976541a 100644
+--- a/openstack_dashboard/dashboards/project/stacks/tabs.py
++++ b/openstack_dashboard/dashboards/project/stacks/tabs.py
+@@ -79,6 +79,9 @@ class StackEventsTab(tabs.Tab):
+ stack_identifier = '%s/%s' % (stack.stack_name, stack.id)
+ events = api.heat.events_list(self.request, stack_identifier)
+ LOG.debug('got events %s' % events)
++ # The stack id is needed to generate the resource URL.
++ for event in events:
++ event.stack_id = stack.id
+ except Exception:
+ events = []
+ messages.error(request, _(
+@@ -99,6 +102,9 @@ class StackResourcesTab(tabs.Tab):
+ stack_identifier = '%s/%s' % (stack.stack_name, stack.id)
+ resources = api.heat.resources_list(self.request, stack_identifier)
+ LOG.debug('got resources %s' % resources)
++ # The stack id is needed to generate the resource URL.
++ for r in resources:
++ r.stack_id = stack.id
+ except Exception:
+ resources = []
+ messages.error(request, _(
diff --git a/python-django-horizon.spec b/python-django-horizon.spec
index 09fc669..0e7ea40 100644
--- a/python-django-horizon.spec
+++ b/python-django-horizon.spec
@@ -2,7 +2,7 @@
Name: python-django-horizon
Version: 2014.1.1
-Release: 3%{?dist}
+Release: 4%{?dist}
Summary: Django application for talking to Openstack
Group: Development/Libraries
@@ -35,7 +35,8 @@ Patch0009: 0009-fix-flake8-issues.patch
Patch0010: 0010-remove-runtime-dep-to-python-pbr.patch
Patch0011: 0011-Add-Change-password-link-to-the-RCUE-theme.patch
Patch0012: 0012-Re-enable-offline-compression.patch
-
+Patch0013: 0013-Fix-issues-with-importing-the-Login-form.patch
+Patch0014: 0014-Fix-multiple-Cross-Site-Scripting-XSS-vulnerabilitie.patch
BuildArch: noarch
More information about the scm-commits
mailing list