Andal.LND/edx-platform
6
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

Merge pull request #19519 from edx/ri/EDUCATOR-3849-certificate-support-reflected-xss

Browse Source 
Clean XSS in Certificates Support URL
This commit is contained in:
Rabia Iftikhar
2018-12-31 14:10:43 +05:00
committed by GitHub
parent a340fc96d5 e9b2b7f8a7
commit 6cf5b2f744
1 changed files with 2 additions and 1 deletions
Download Patch File Download Diff File Expand all files Collapse all files

3
lms/djangoapps/certificates/views/support.py
View File

@@ -4,6 +4,7 @@ Certificate end-points used by the student support UI.
See lms/djangoapps/support for more details.
"""
import bleach
import logging
import urllib
from functools import wraps
@@ -80,7 +81,7 @@ def search_certificates(request):
]
"""
user_filter = urllib.unquote(urllib.quote_plus(request.GET.get("user", "")))
user_filter = bleach.clean(urllib.unquote(urllib.quote_plus(request.GET.get("user", ""))))
if not user_filter:
msg = _("user is not given.")
return HttpResponseBadRequest(msg)