darkhelm/notifications-admin
1
0
Fork 0
mirror of https://github.com/GSA/notifications-admin.git synced 2026-08-05 14:11:41 -04:00
Code Issues Packages Projects Releases Wiki Activity

fix one more place where senders weren't sanitised

Browse Source 
make sure everything is using the `nl2br` formatter that properly wraps
it in markdown to keep everything sanitised nicely. Also write a couple
of tests
This commit is contained in:
Leo Hemsted
2020-01-22 16:13:25 +00:00
parent 945701c607
commit f3fa6a67e1
6 changed files with 41 additions and 8 deletions
Download Patch File Download Diff File Expand all files Collapse all files

3
app/main/views/send.py
View File

@@ -31,6 +31,7 @@ from xlrd.xldate import XLDateError
from app import (
current_service,
job_api_client,
nl2br,
notification_api_client,
service_api_client,
)
@@ -272,7 +273,7 @@ def get_sender_context(sender_details, template_type):
if context['default_id'] == context.get('receives_text_message', None):
context['default_and_receives'] = context['default_id']
context['value_and_label'] = [(sender['id'], sender[sender_format]) for sender in sender_details]
context['value_and_label'] = [(sender['id'], nl2br(sender[sender_format])) for sender in sender_details]
return context

5
app/main/views/templates.py
View File

@@ -4,14 +4,13 @@ from functools import partial
from dateutil.parser import parse
from flask import abort, flash, redirect, render_template, request, url_for
from flask_login import current_user
from markupsafe import Markup
from notifications_python_client.errors import HTTPError
from notifications_utils import LETTER_MAX_PAGE_COUNT
from notifications_utils.formatters import nl2br
from notifications_utils.pdf import is_letter_too_long
from app import (
current_service,
nl2br,
service_api_client,
template_folder_api_client,
template_statistics_client,
@@ -844,7 +843,7 @@ def get_template_sender_form_dict(service_id, template):
if not service_senders:
context['no_senders'] = True
context['value_and_label'] = [(sender['id'], Markup(nl2br(sender[sender_format]))) for sender in service_senders]
context['value_and_label'] = [(sender['id'], nl2br(sender[sender_format])) for sender in service_senders]
context['value_and_label'].insert(0, ('', 'Blank')) # Add blank option to start of list
context['current_choice'] = template['service_letter_contact'] if template['service_letter_contact'] else ''

2
app/templates/views/service-settings.html
View File

@@ -136,7 +136,7 @@
{% call settings_row(if_has_permission='sms') %}
{{ text_field('Text message senders') }}
{% call field(status='default' if current_service.default_sms_sender == "None" else '') %}
{{ current_service.default_sms_sender | string | nl2br if current_service.default_sms_sender else 'None'}}
{{ current_service.default_sms_sender | nl2br if current_service.default_sms_sender else 'None'}}
{% if current_service.count_sms_senders > 1 %}
<div class="hint">
{{ '…and %d more' | format(current_service.count_sms_senders - 1) }}