Fixes OSQA 455. Multiple cross site scripting(XSS) vulnerabilities.

git-svn-id: http://svn.osqa.net/svnroot/osqa/trunk@599 0cfe37f9-358a-4d5e-be75-b63607b5c754

diff --git a/forum/registry.py b/forum/registry.py
index 95aea18da0b21e9353016ae9b59be50578608c01..ff5a1157941eea91d21b19f5822fd89329bf6921 100644 (file)
--- a/forum/registry.py
+++ b/forum/registry.py
@@ -3,6 +3,7 @@ from django.utils.translation import ugettext as _
 from django.core.urlresolvers import reverse
 from django.template.defaultfilters import slugify
 from forum.templatetags.extra_tags import get_score_badge
+from forum.utils.html import cleanup_urls
 from forum import settings
 
 
@@ -38,7 +39,7 @@ class SupportLink(ui.Link):
 ui.register(ui.FOOTER_LINKS,
             ui.Link(
                     text=_('contact'),
-                    url=lambda u, c: settings.CONTACT_URL and settings.CONTACT_URL or "%s?next=%s" % (reverse('feedback'), c['request'].path),
+                    url=lambda u, c: settings.CONTACT_URL and settings.CONTACT_URL or "%s?next=%s" % (reverse('feedback'), cleanup_urls( c['request'].path)),
                     weight=400),
             SupportLink(_('support'), settings.SUPPORT_URL, attrs={'target': '_blank'}, weight=300),
             ui.Link(_('privacy'), ui.Url('privacy'), weight=200),

diff --git a/forum/urls.py b/forum/urls.py
index d1715df75cf7767a1279ef666292f078a4e57419..30fd5aca2f7dd1c74ff9e81b99d86156c2c9856a 100644 (file)
--- a/forum/urls.py
+++ b/forum/urls.py
@@ -144,7 +144,7 @@ urlpatterns += patterns('',
                             name='user_recent'),
                         url(r'^%s(?P<id>\d+)/(?P<slug>.*)/$' % _('users/'), app.users.user_profile, name='user_profile'),
                         url(r'^%s$' % _('badges/'), app.meta.badges, name='badges'),
-                        url(r'^%s(?P<id>\d+)/(?P<slug>.*)$' % _('badges/'), app.meta.badge, name='badge'),
+                        url(r'^%s(?P<id>\d+)/(?P<slug>[\w-]+)/?$' % _('badges/'), app.meta.badge, name='badge'),
                         # (r'^admin/doc/' % _('admin/doc'), include('django.contrib.admindocs.urls')),
 
                         url(r'^%s$' % _('upload/'), app.writers.upload, name='upload'),

diff --git a/forum/utils/html.py b/forum/utils/html.py
index 86a4ef9119cf417f876d1ceb25c7c04460640ba7..cab52a4252ecd666dc5c9e06958a5f0300cde9bc 100644 (file)
--- a/forum/utils/html.py
+++ b/forum/utils/html.py
@@ -1,6 +1,7 @@
 """Utilities for working with HTML."""
 import html5lib
 from html5lib import sanitizer, serializer, tokenizer, treebuilders, treewalkers
+from django.utils.html import strip_tags
 from forum.utils.html2text import HTML2Text
 from django.template import mark_safe
 from forum import settings
@@ -48,6 +49,9 @@ def sanitize_html(html):
     output_generator = s.serialize(stream)
     return u''.join(output_generator)
 
+def cleanup_urls(url):
+    return strip_tags(url)
+
 
 def html2text(s, ignore_tags=(), indent_width=4, page_width=80):
     ignore_tags = [t.lower() for t in ignore_tags]