diff --git a/app/config.py b/app/config.py index 8c2ae807..e9944247 100644 --- a/app/config.py +++ b/app/config.py @@ -5,7 +5,7 @@ import http.cookies import funct import sql from jinja2 import Environment, FileSystemLoader -env = Environment(loader=FileSystemLoader('templates/')) +env = Environment(loader=FileSystemLoader('templates/'), autoescape=True) template = env.get_template('config.html') print('Content-type: text/html\n') diff --git a/app/funct.py b/app/funct.py index 79c972bb..336c1544 100644 --- a/app/funct.py +++ b/app/funct.py @@ -137,7 +137,7 @@ def page_for_admin(**kwargs): give_level = 1 give_level = kwargs.get("level") - if not is_admin(level = give_level): + if not is_admin(level=give_level): print('

How did you get here?! O_o You do not have need permissions') print('') import sys diff --git a/app/options.py b/app/options.py index 79932952..87ca0e94 100644 --- a/app/options.py +++ b/app/options.py @@ -295,7 +295,7 @@ if form.getvalue('servaction') is not None: if act == "showCompareConfigs": import glob from jinja2 import Environment, FileSystemLoader - env = Environment(loader=FileSystemLoader('templates/ajax')) + env = Environment(loader=FileSystemLoader('templates/ajax'), autoescape=True) template = env.get_template('/show_compare_configs.html') left = form.getvalue('left') right = form.getvalue('right') @@ -309,7 +309,7 @@ if serv is not None and form.getvalue('right') is not None: right = form.getvalue('right') hap_configs_dir = funct.get_config_var('configs', 'haproxy_save_configs_dir') cmd='diff -ub %s%s %s%s' % (hap_configs_dir, left, hap_configs_dir, right) - env = Environment(loader=FileSystemLoader('templates/ajax'),extensions=['jinja2.ext.loopcontrols', "jinja2.ext.do"]) + env = Environment(loader=FileSystemLoader('templates/ajax'), autoescape=True, extensions=['jinja2.ext.loopcontrols', "jinja2.ext.do"]) template = env.get_template('compare.html') output, stderr = funct.subprocess_execute(cmd) @@ -329,11 +329,13 @@ if serv is not None and act == "configShow": try: conf = open(cfg, "r") + #conf = conf.read() + #conf = funct.escape_html(conf) except IOError: print('
Can\'t read import config file
') from jinja2 import Environment, FileSystemLoader - env = Environment(loader=FileSystemLoader('templates/ajax'),extensions=['jinja2.ext.loopcontrols']) + env = Environment(loader=FileSystemLoader('templates/ajax'), autoescape=True, extensions=['jinja2.ext.loopcontrols']) template = env.get_template('config_show.html') template = template.render(conf=conf, view=form.getvalue('view'), serv=serv, configver=form.getvalue('configver'), role=funct.is_admin(level=2)) diff --git a/app/templates/base.html b/app/templates/base.html index a11c42db..ab5fdb30 100644 --- a/app/templates/base.html +++ b/app/templates/base.html @@ -115,7 +115,7 @@