Changeset 13235


Ignore:
Timestamp:
28 Aug 2015, 07:49:07 (9 years ago)
Author:
Henrik Bettermann
Message:

Forbid style and script elements.

Location:
main/waeup.kofa/trunk/src/waeup/kofa
Files:
4 edited

Legend:

Unmodified
Added
Removed
  • main/waeup.kofa/trunk/src/waeup/kofa/applicants/browser_templates/applicantscontainermanagepage.pt

    r13217 r13235  
    9090    <tal:showNoApplicants condition="not: view/showApplicants">
    9191      <p i18n:translate="note_acmp">
    92           There are more than 5000 application records in this container.
     92          There are more than 1000 application records in this container.
    9393          In order to prevent from downloading big amounts of data, the
    9494          Applicants tab has been disabled. Please use the
  • main/waeup.kofa/trunk/src/waeup/kofa/applicants/interfaces.py

    r13218 r13235  
    2929from waeup.kofa.schema import TextLineChoice, FormattedDate
    3030from waeup.kofa.interfaces import (
    31     IKofaObject, validate_email,
     31    IKofaObject, validate_email, validate_html,
    3232    SimpleKofaVocabulary)
    3333from waeup.kofa.interfaces import MessageFactory as _
     
    177177        title = _(u'Human readable description in HTML format'),
    178178        required = False,
     179        constraint=validate_html,
    179180        default = u'''This text can been seen by anonymous users.
    180181Here we put multi-lingual general information about the application procedure.
     
    243244        title = _(u'Human readable description in HTML format'),
    244245        required = False,
     246        constraint=validate_html,
    245247        default = u'''This text can been seen by anonymous users.
    246248Here we put multi-lingual information about the study courses provided, the application procedure and deadlines.
     
    277279        title = _(u'Human readable notice on application slip in HTML format'),
    278280        required = False,
    279         )
    280 
     281        constraint=validate_html,
     282        )
    281283
    282284    hidden= schema.Bool(
  • main/waeup.kofa/trunk/src/waeup/kofa/documents/interfaces.py

    r13167 r13235  
    1919from zope import schema
    2020from waeup.kofa.interfaces import (
    21     IKofaObject, validate_id,
     21    IKofaObject, validate_id, validate_html,
    2222    ContextualDictSourceFactoryBase)
    2323from waeup.kofa.interfaces import MessageFactory as _
     
    8282        title = _(u'Multilingual content in HTML format'),
    8383        required = False,
     84        constraint=validate_html,
    8485        )
    8586
  • main/waeup.kofa/trunk/src/waeup/kofa/interfaces.py

    r13211 r13235  
    179179    return True
    180180
     181# Define a validation method for HTML fields
     182class NotHTMLValue(schema.ValidationError):
     183    __doc__ = u"Style or script elements not allowed"
     184
     185def validate_html(value):
     186    if '<style' in value or '<script' in value:
     187        raise NotHTMLValue(value)
     188    return True
     189
    181190# Define a validation method for international phone numbers
    182191class InvalidPhoneNumber(schema.ValidationError):
     
    650659        required = False,
    651660        default = default_html_frontpage,
     661        constraint=validate_html,
    652662        )
    653663
Note: See TracChangeset for help on using the changeset viewer.