mirror/netbox-community-netbox
1
0
Fork 0
mirror of https://github.com/netbox-community/netbox.git synced 2024-05-10 07:54:54 +00:00
Code Activity

Closes #1061: Escape all messages by default (complements #1062)

Browse Source
This commit is contained in:
Jeremy Stretch
2017-04-10 10:54:35 -04:00
parent 3b48a270fc
commit cf5be85dad
2 changed files with 4 additions and 3 deletions
Download Patch File Download Diff File Expand all files Collapse all files

2
netbox/templates/_base.html
View File

@ -273,7 +273,7 @@
<button type="button" class="close" data-dismiss="alert" aria-label="Close"> <button type="button" class="close" data-dismiss="alert" aria-label="Close">
<span aria-hidden="true">&times;</span> <span aria-hidden="true">&times;</span>
</button> </button>
{{ message|safe }} {{ message }}
</div> </div>
{% endfor %} {% endfor %}
{% block content %}{% endblock %} {% block content %}{% endblock %}

5
netbox/utilities/views.py
View File

@ -14,6 +14,7 @@ from django.shortcuts import get_object_or_404, redirect, render
from django.template import TemplateSyntaxError from django.template import TemplateSyntaxError
from django.utils.html import escape from django.utils.html import escape
from django.utils.http import is_safe_url from django.utils.http import is_safe_url
from django.utils.safestring import mark_safe
from django.views.generic import View from django.views.generic import View
from extras.forms import CustomFieldForm from extras.forms import CustomFieldForm
@ -198,7 +199,7 @@ class ObjectEditView(View):
msg = u'{} <a href="{}">{}</a>'.format(msg, obj.get_absolute_url(), escape(obj)) msg = u'{} <a href="{}">{}</a>'.format(msg, obj.get_absolute_url(), escape(obj))
else: else:
msg = u'{} {}'.format(msg, escape(obj)) msg = u'{} {}'.format(msg, escape(obj))
messages.success(request, msg) messages.success(request, mark_safe(msg))
if obj_created: if obj_created:
UserAction.objects.log_create(request.user, obj, msg) UserAction.objects.log_create(request.user, obj, msg)
else: else:
@ -267,7 +268,7 @@ class ObjectDeleteView(View):
handle_protectederror(obj, request, e) handle_protectederror(obj, request, e)
return redirect(obj.get_absolute_url()) return redirect(obj.get_absolute_url())
msg = u'Deleted {} {}'.format(self.model._meta.verbose_name, escape(obj)) msg = u'Deleted {} {}'.format(self.model._meta.verbose_name, obj)
messages.success(request, msg) messages.success(request, msg)
UserAction.objects.log_delete(request.user, obj, msg) UserAction.objects.log_delete(request.user, obj, msg)