8000 fix: Fallback page names were not escaped (#8113) by fsbraun · Pull Request #8114 · django-cms/django-cms · GitHub
[go: up one dir, main page]
Skip to content

fix: Fallback page names were not escaped (#8113) #8114

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom
Merged
merged 1 commit into from
Jan 22, 2025
Merged

fix: Fallback page names were not escaped (#8113) #8114

merged 1 commit into from
Jan 22, 2025

Conversation

fsbraun
Copy link
Member
@fsbraun fsbraun commented Jan 22, 2025 •
edited by sourcery-ai bot
Loading

Description

Backports #8113

Related resources

Checklist

  • I have opened this pull request against develop-4
  • I have added or modified the tests when changing logic
  • I have followed the conventional commits guidelines to add meaningful information into the changelog
  • I have read the contribution guidelines and I have joined the channel #pr-reviews on our Discord Server to find a “pr review buddy” who is going to review my pull request.

Summary by Sourcery

Bug Fixes:

  • Fix an issue where fallback page names were not escaped in the admin, which could lead to XSS vulnerabilities.

@sourcery-ai Sourcery AI
Copy link
Contributor
sourcery-ai bot commented Jan 22, 2025 •
edited
Loading

Reviewer's Guide by Sourcery

This pull request addresses an issue where fallback page names were not being escaped, which could lead to potential security vulnerabilities or display issues. The fix ensures that fallback titles are properly escaped before being displayed.

Flow diagram for page title resolution with escaping

graph TD
    A[Start] --> B{Has title?}
    B -->|No| C{Has page_title?}
    C -->|No| D{Has menu_title?}
    D -->|No| E[Get slug]
    E -->|No slug| F[Use 'Empty']
    E -->|Has slug| G[Use slug]
    B -->|Yes| H[Use title]
    C -->|Yes| H
    D -->|Yes| H
    G --> I{Is fallback language?}
    H --> I
    F --> I
    I -->|Yes| J[Escape title & add language indicator]
    I -->|No| K[Use title as is]
    J --> L[Return result]
    K --> L
Loading

File-Level Changes

Change Details Files
Escaping fallback page titles
  • Modified the get_page_display_name function to escape the title when it's a fallback.
  • Added a fallback to 'Empty' if the slug is empty.
 cms/templatetags/cms_admin.py
Tips and commands

Interacting with Sourcery

  • Trigger a new review: Comment @sourcery-ai review on the pull request.
  • Continue discussions: Reply directly to Sourcery's review comments.
  • Generate a GitHub issue from a review comment: Ask Sourcery to create an
    issue from a review comment by replying to it.
  • Generate a pull request title: Write @sourcery-ai anywhere in the pull
    request title to generate a title at any time.
  • Generate a pull request summary: Write @sourcery-ai summary anywhere in
    the pull request body to generate a PR summary at any time. You can also use
    this command to specify where the summary should be inserted.

Customizing Your Experience

Access your dashboard to:

  • Enable or disable review features such as the Sourcery-generated pull request
    summary, the reviewer's guide, and others.
  • Change the review language.
  • Add, remove or edit custom review instructions.
  • Adjust other review settings.

Getting Help

@fsbraun fsbraun requested a review from vinitkumar January 22, 2025 09:13
sourcery-ai[bot]
sourcery-ai bot reviewed Jan 22, 2025
View reviewed changes
Copy link
Contributor
@sourcery-ai sourcery-ai bot left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Hey @fsbraun - I've reviewed your changes - here's some feedback:

Overall Comments:

  • Please add tests to verify the escaping behavior to prevent future regressions of this security fix.
Here's what I looked at during the review
  • 🟢 General issues: all looks good
  • 🟢 Security: all looks good
  • 🟢 Testing: all looks good
  • 🟢 Complexity: all looks good
  • 🟢 Documentation: all looks good
Sourcery is free for open source - if you like our reviews please consider sharing them ✨
Help me be more useful! Please click 👍 or 👎 on each comment and I'll use the feedback to improve your reviews.

@fsbraun fsbraun merged commit 0590424 into django-cms:release/4.1.x Jan 22, 2025
93 of 94 checks passed
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Reviewers

@sourcery-ai sourcery-ai[bot] sourcery-ai[bot] left review comments

@vinitkumar vinitkumar Awaiting requested review from vinitkumar

Assignees
No one assigned
Labels
None yet
Projects
None yet
Milestone
No milestone
Development

Successfully merging this pull request may close these issues.
1 participant
@fsbraun
0