[checkmk-commits] Check_MK Git: check_mk: FIX: Escaping html entities when displaying comment fields

Module: check_mk Branch: master Commit: 34ac703f9d5fa68a52c497fae0185b1244dfdeff URL: http://git.mathias-kettner.de/git/?p=check_mk.git;a=commit;h=34ac703f9d5fa6… Author: Lars Michelsen &lt;lm(a)mathias-kettner.de&gt; Date: Wed Apr 3 09:53:41 2013 +0200 FIX: Escaping html entities when displaying comment fields --- ChangeLog | 1 + web/plugins/views/painters.py | 6 +++--- 2 files changed, 4 insertions(+), 3 deletions(-) diff --git a/ChangeLog b/ChangeLog index 3dacbce..b2736d1 100644 --- a/ChangeLog +++ b/ChangeLog @@ -104,6 +104,7 @@ * Add $SERVICEOUTPUT$ and $HOSTOUTPUT$ to allowed macros for custom notes * FIX: Writing one clean message to webserver error_log when write fails + * FIX: Escaping html entities when displaying comment fields Notifications: * FIX: fix event type for recoveries diff --git a/web/plugins/views/painters.py b/web/plugins/views/painters.py index afa2242..08368f0 100644 --- a/web/plugins/views/painters.py +++ b/web/plugins/views/painters.py @@ -686,7 +686,7 @@ multisite_painters["check_manpage"] = { def paint_comments(prefix, row): comments = row[ prefix + "comments_with_info"] - text = ", ".join(["<i>%s</i>: %s" % (a,c) for (id,a,c) in comments ]) + text = ", ".join(["<i>%s</i>: %s" % (a, htmllib.attrencode(c)) for (id, a, c) in comments ]) return "", text multisite_painters["svc_comments"] = { @@ -1402,7 +1402,7 @@ multisite_painters["comment_author"] = { multisite_painters["comment_comment"] = { "title" : _("Comment text"), "columns" : ["comment_comment"], - "paint" : lambda row: (None, row["comment_comment"]), + "paint" : lambda row: (None, htmllib.attrencode(row["comment_comment"])), } multisite_painters["comment_what"] = { @@ -1481,7 +1481,7 @@ multisite_painters["downtime_comment"] = { "title" : _("Downtime comment"), "short" : _("Comment"), "columns" : ["downtime_comment"], - "paint" : lambda row: (None, row["downtime_comment"]), + "paint" : lambda row: (None, htmllib.attrencode(row["downtime_comment"])), } multisite_painters["downtime_fixed"] = {