Merge pull request #195 from dementrock/master
Minor bug fix. Properly handles script tags where there are spaces before closing brace. Code is also more elegant than original. Note that this is not a security bug, as the fix indicated.
This commit is contained in:
@@ -80,7 +80,8 @@ class SequenceModule(XModule):
|
||||
# Split </script> tags -- browsers handle this as end
|
||||
# of script, even if it occurs mid-string. Do this after json.dumps()ing
|
||||
# so that we can be sure of the quotations being used
|
||||
params = {'items': json.dumps(contents).replace('</script>', '<"+"/script>'),
|
||||
import re
|
||||
params = {'items': re.sub(r'</(script)', r'\u003c/\1', json.dumps(contents), flags=re.IGNORECASE),
|
||||
'element_id': self.location.html_id(),
|
||||
'item_id': self.id,
|
||||
'position': self.position,
|
||||
|
||||
Reference in New Issue
Block a user