prepare 0.12.17

barseghyanartur · Feb 14, 2018 · 566f160 · 566f160
1 parent c9c728a
commit 566f160
Show file tree

Hide file tree

Showing 6 changed files with 25 additions and 12 deletions.
diff --git a/CHANGELOG.rst b/CHANGELOG.rst
@@ -17,8 +17,9 @@ are used for versioning (schema follows below):
 
 0.12.17
 --------
-yyyy-mm-dd (not released yet)
+2018-02-14
 
+- Security fixes in db_store plugin.
 - Minor fixes and cleanups.
 - If CKEditor is installed, use it (rich text) for success page message.
 

diff --git a/docs/changelog.rst b/docs/changelog.rst
@@ -17,8 +17,9 @@ are used for versioning (schema follows below):
 
 0.12.17
 --------
-yyyy-mm-dd (not released yet)
+2018-02-14
 
+- Security fixes in db_store plugin.
 - Minor fixes and cleanups.
 - If CKEditor is installed, use it (rich text) for success page message.
 

diff --git a/examples/requirements/common.txt b/examples/requirements/common.txt
@@ -3,6 +3,7 @@
 
 alabaster==0.7.6
 Babel==2.1.1
+bleach==2.1.2
 decorator==4.0.4
 docopt==0.4.0
 docutils==0.12

diff --git a/setup.py b/setup.py
@@ -4,7 +4,7 @@
 from distutils.version import LooseVersion
 from setuptools import setup, find_packages
 
-version = '0.12.16'
+version = '0.12.17'
 
 # ***************************************************************************
 # ************************** Python version *********************************
@@ -233,6 +233,7 @@
     if DJANGO_1_5 or DJANGO_1_6 or DJANGO_1_7:
         install_requires = [
             # 'django-autoslug==1.7.1',
+            'bleach',
             'django-autoslug-iplweb',
             # 'django-formtools>=1.0',
             'django-nine>=0.1.13',
@@ -248,6 +249,7 @@
     elif DJANGO_1_8:
         install_requires = [
             # 'django-autoslug==1.7.1',
+            'bleach',
             'django-autoslug-iplweb',
             'django-formtools>=1.0',
             'django-nine>=0.1.13',
@@ -262,6 +264,7 @@
     elif DJANGO_1_9:
         install_requires = [
             # 'django-autoslug==1.9.3',
+            'bleach',
             'django-autoslug-iplweb',
             'django-formtools>=1.0',
             'django-nine>=0.1.13',
@@ -276,6 +279,7 @@
     elif DJANGO_1_10:
         install_requires = [
             # 'django-autoslug==1.9.3',
+            'bleach',
             'django-autoslug-iplweb',
             'django-formtools>=1.0',
             'django-nine>=0.1.13',
@@ -290,6 +294,7 @@
     elif DJANGO_1_11:
         install_requires = [
             # 'django-autoslug==1.9.3',
+            'bleach',
             'django-autoslug-iplweb',
             'django-formtools>=2.0',
             'django-nine>=0.1.13',
@@ -308,6 +313,7 @@
     elif DJANGO_2_0:
         install_requires = [
             # 'django-autoslug==1.9.3',
+            'bleach',
             'django-autoslug-iplweb',
             'django-formtools>=2.0',
             'django-nine>=0.1.13',
@@ -327,6 +333,7 @@
 # Fall back to the latest dependencies
 if not install_requires:
     install_requires = [
+        'bleach',
         'django-autoslug>=1.9.3',
         'django-formtools>=1.0',
         'django-nine>=0.1.13',

diff --git a/src/fobi/__init__.py b/src/fobi/__init__.py
@@ -1,5 +1,5 @@
 __title__ = 'django-fobi'
-__version__ = '0.12.16'
+__version__ = '0.12.17'
 __author__ = 'Artur Barseghyan <[email protected]>'
 __copyright__ = '2014-2018 Artur Barseghyan'
 __license__ = 'GPL 2.0/LGPL 2.1'

diff --git a/src/fobi/contrib/plugins/form_handlers/db_store/models.py b/src/fobi/contrib/plugins/form_handlers/db_store/models.py
@@ -1,5 +1,5 @@
+import bleach
 import simplejson as json
-
 from six import python_2_unicode_compatible, string_types
 
 from django.conf import settings
@@ -60,13 +60,16 @@ def formatted_saved_data(self):
             headers = json.loads(self.form_data_headers)
             data = json.loads(self.saved_data)
             for key, value in data.items():
-                if isinstance(value, string_types) and \
-                        (value.startswith(settings.MEDIA_URL) or
-                         value.startswith('http://') or
-                         value.startswith('https://')):
-                    data[key] = '<a href="{value}">{value}</a>'.format(
-                        value=value
-                    )
+
+                if isinstance(value, string_types):
+                    value = bleach.clean(value, strip=True)
+                    if (value.startswith(settings.MEDIA_URL) or
+                            value.startswith('http://') or
+                            value.startswith('https://')):
+                        value = '<a href="{value}">{value}</a>'.format(
+                            value=value
+                        )
+                    data[key] = value
 
             return two_dicts_to_string(headers, data)
         except (ValueError, json.decoder.JSONDecodeError) as err: