external/aurweb
0
0
Fork 0
mirror of https://gitlab.archlinux.org/archlinux/aurweb.git synced 2025-02-03 10:43:03 +01:00
Code Issues Projects Releases Packages Wiki Activity Actions

fix: Restrict context var override on the package page

Browse source 
Users can (accidentally) override context vars with query params.
This may lead to issues when rendering templates (e.g. "comments=").

Signed-off-by: moson <moson@archlinux.org>
This commit is contained in:
moson 2023-10-19 18:40:37 +02:00
parent 40c1d3e8ee
commit 933654fcbb
No known key found for this signature in database
GPG key ID: 4A4760AB4EE15296
2 changed files with 3 additions and 12 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

12
aurweb/pkgbase/util.py
View file

@ -11,17 +11,7 @@ from aurweb.models.package_comment import PackageComment
from aurweb.models.package_request import PENDING_ID, PackageRequest
from aurweb.models.package_vote import PackageVote
from aurweb.scripts import notify
from aurweb.templates import (
make_context as _make_context,
make_variable_context as _make_variable_context,
)
async def make_variable_context(
request: Request, pkgbase: PackageBase
) -> dict[str, Any]:
ctx = await _make_variable_context(request, pkgbase.Name)
return make_context(request, pkgbase, ctx)
from aurweb.templates import make_context as _make_context
def make_context(

3
aurweb/routers/packages.py
View file

@ -167,7 +167,8 @@ async def package(
rels_data["r"].append(rel)
# Add our base information.
context = await pkgbaseutil.make_variable_context(request, pkgbase)
context = pkgbaseutil.make_context(request, pkgbase)
context["q"] = dict(request.query_params)
context.update({"all_deps": all_deps, "all_reqs": all_reqs})