Changeset 13805 for main/waeup.ikoba/trunk/src/waeup

Timestamp:

6 Apr 2016, 08:51:19 (9 years ago)

Author:

Henrik Bettermann

Message:

Forbid style and script elements in html fields.

See r13235.

Location:

main/waeup.ikoba/trunk/src/waeup/ikoba

Files:

• documents/interfaces.py (modified) (2 diffs)
• interfaces.py (modified) (2 diffs)

main/waeup.ikoba/trunk/src/waeup/ikoba/documents/interfaces.py

@@ -19 +19 @@
 from zope import schema
 from waeup.ikoba.interfaces import (
-    IIkobaObject, validate_id,
+    IIkobaObject, validate_id, validate_html,
     ContextualDictSourceFactoryBase)
 from waeup.ikoba.interfaces import MessageFactory as _
@@ -98 +98 @@
         title = _(u'Multilingual content in HTML format'),
         required = False,
+        constraint=validate_html,
         )
 

main/waeup.ikoba/trunk/src/waeup/ikoba/interfaces.py

@@ -142 +142 @@
     return True
 
+# Define a validation method for HTML fields
+class NotHTMLValue(schema.ValidationError):
+    __doc__ = u"Style or script elements not allowed"
+
+def validate_html(value):
+    if '<style' in value or '<script' in value:
+        raise NotHTMLValue(value)
+    return True
+
+
 # Define a validation method for international phone numbers
 class InvalidPhoneNumber(schema.ValidationError):
@@ -585 +595 @@
         required = False,
         default = default_html_frontpage,
+        constraint=validate_html,
         )