diff --git a/app/config.py b/app/config.py
index 8c2ae807..e9944247 100644
--- a/app/config.py
+++ b/app/config.py
@@ -5,7 +5,7 @@ import http.cookies
import funct
import sql
from jinja2 import Environment, FileSystemLoader
-env = Environment(loader=FileSystemLoader('templates/'))
+env = Environment(loader=FileSystemLoader('templates/'), autoescape=True)
template = env.get_template('config.html')
print('Content-type: text/html\n')
diff --git a/app/funct.py b/app/funct.py
index 79c972bb..336c1544 100644
--- a/app/funct.py
+++ b/app/funct.py
@@ -137,7 +137,7 @@ def page_for_admin(**kwargs):
give_level = 1
give_level = kwargs.get("level")
- if not is_admin(level = give_level):
+ if not is_admin(level=give_level):
print('
How did you get here?! O_o You do not have need permissions')
print('')
import sys
diff --git a/app/options.py b/app/options.py
index 79932952..87ca0e94 100644
--- a/app/options.py
+++ b/app/options.py
@@ -295,7 +295,7 @@ if form.getvalue('servaction') is not None:
if act == "showCompareConfigs":
import glob
from jinja2 import Environment, FileSystemLoader
- env = Environment(loader=FileSystemLoader('templates/ajax'))
+ env = Environment(loader=FileSystemLoader('templates/ajax'), autoescape=True)
template = env.get_template('/show_compare_configs.html')
left = form.getvalue('left')
right = form.getvalue('right')
@@ -309,7 +309,7 @@ if serv is not None and form.getvalue('right') is not None:
right = form.getvalue('right')
hap_configs_dir = funct.get_config_var('configs', 'haproxy_save_configs_dir')
cmd='diff -ub %s%s %s%s' % (hap_configs_dir, left, hap_configs_dir, right)
- env = Environment(loader=FileSystemLoader('templates/ajax'),extensions=['jinja2.ext.loopcontrols', "jinja2.ext.do"])
+ env = Environment(loader=FileSystemLoader('templates/ajax'), autoescape=True, extensions=['jinja2.ext.loopcontrols', "jinja2.ext.do"])
template = env.get_template('compare.html')
output, stderr = funct.subprocess_execute(cmd)
@@ -329,11 +329,13 @@ if serv is not None and act == "configShow":
try:
conf = open(cfg, "r")
+ #conf = conf.read()
+ #conf = funct.escape_html(conf)
except IOError:
print('
Can\'t read import config file
')
from jinja2 import Environment, FileSystemLoader
- env = Environment(loader=FileSystemLoader('templates/ajax'),extensions=['jinja2.ext.loopcontrols'])
+ env = Environment(loader=FileSystemLoader('templates/ajax'), autoescape=True, extensions=['jinja2.ext.loopcontrols'])
template = env.get_template('config_show.html')
template = template.render(conf=conf, view=form.getvalue('view'), serv=serv, configver=form.getvalue('configver'), role=funct.is_admin(level=2))
diff --git a/app/templates/base.html b/app/templates/base.html
index a11c42db..ab5fdb30 100644
--- a/app/templates/base.html
+++ b/app/templates/base.html
@@ -115,7 +115,7 @@