horizon/openstack_dashboard
Julie Pichon de4466d88b Fix multiple Cross-Site Scripting (XSS) vulnerabilities.
* Ensure user emails are properly escaped

User emails in the Users and Groups panel are being passed through the
urlize filter to transform them into clickable links. However, urlize
expects input to be already escaped and safe. We should make sure to
escape the strings first as email addresses are not validated and can
contain any type of string.

Closes-Bug: #1320235

 * Ensure network names are properly escaped in the Launch Instance menu

Closes-Bug: #1322197

 * Escape the URLs generated for the Horizon tables

When generating the Horizon tables, there was an assumption that only
the anchor text needed to be escaped. However some URLs are generated
based on user-provided data and should be escaped as well.

 * Use 'reverse' to generate the Resource URLs in the stacks tables

Closes-Bug: #1308727

Change-Id: Ic8a92e69f66c2d265a802f350e30f091181aa42e
2014-07-08 13:45:48 +01:00
..
api Merge "Adding support for volume backups" 2014-07-08 08:17:08 +00:00
conf Adding support for volume backups 2014-07-04 03:07:53 -07:00
dashboards Fix multiple Cross-Site Scripting (XSS) vulnerabilities. 2014-07-08 13:45:48 +01:00
enabled Plugin-based panel group configuration 2014-03-29 01:05:03 +09:00
local Adding support for volume backups 2014-07-04 03:07:53 -07:00
locale Imported Translations from Transifex 2014-07-08 06:07:48 +00:00
openstack Synced jsonutils from oslo-incubator 2014-05-27 12:25:45 +02:00
static Long container names no longer break the page 2014-07-03 20:51:52 -06:00
templates Use SCSS instead of LESS 2014-07-02 10:13:26 +02:00
test Merge "Adding support for volume backups" 2014-07-08 08:17:08 +00:00
usage Raise NotImplementedError instead of NotImplemented 2014-07-04 13:13:43 +02:00
utils Allow panel plugins to use ADD_EXCEPTIONS and UPDATE_HORIZON_CONFIG 2014-07-01 10:44:15 -06:00
wsgi Updated the django.wsgi file for devstack. 2012-02-29 01:37:37 -08:00
__init__.py Unifies the project packaging into one set of modules. 2012-02-29 00:20:13 -08:00
context_processors.py Remove extraneous vim configuration comments 2014-05-06 15:30:10 +08:00
exceptions.py Adding sahara client api code 2014-06-11 12:48:48 -04:00
hooks.py Remove extraneous vim configuration comments 2014-05-06 15:30:10 +08:00
policy.py Remove extraneous vim configuration comments 2014-05-06 15:30:10 +08:00
settings.py Merge "Unbundle jquery from horizon using xstatic" 2014-07-04 18:40:44 +00:00
urls.py Remove extraneous vim configuration comments 2014-05-06 15:30:10 +08:00
views.py Fix issues with importing the Login form 2014-06-19 17:36:17 +01:00