Changeset 447 for trunk/packages/sipb-xen-www/code/templates/info.tmpl

Timestamp:

Apr 22, 2008, 1:37:50 AM (17 years ago)

Author:

ecprice

Message:

Avoid html injection.

Cheetah is painful.

File:

• trunk/packages/sipb-xen-www/code/templates/info.tmpl (modified) (3 diffs)

trunk/packages/sipb-xen-www/code/templates/info.tmpl

@@ -41 +41 @@
         #end if
       <td>Boot CD:</td>
-      <td>$cdromList()</td>
+      <td>#slurp
+#filter None
+$cdromList()#slurp
+#end filter
+</td>
   </tr>
     <tr>
@@ -62 +66 @@
   <input type="hidden" name="machine_id" value="$defaults.machine_id"/>
   <table>
-    <tr><td>Owner${helppopup("owner")}:</td><td><input type="text" name="owner", value="$defaults.owner"/></td></tr>
+    <tr><td>Owner#slurp
+#filter None
+$helppopup("owner")#slurp
+#end filter
+:</td><td><input type="text" name="owner", value="$defaults.owner"/></td></tr>
+#filter None
 $errorRow('owner', $err)
-    <tr><td>Administrator${helppopup("administrator")}:</td><td><input type="text" name="administrator", value="$defaults.administrator"/></td></tr>
+#end filter
+    <tr><td>Administrator#slurp
+#filter None
+$helppopup("administrator")#slurp
+#end filter
+:</td><td><input type="text" name="administrator", value="$defaults.administrator"/></td></tr>
+#filter None
 $errorRow('administrator', $err)
+#end filter
     <tr><td>Contact email:</td><td><input type="text" name="contact" value="$defaults.contact"/></td></tr>
+#filter None
 $errorRow('contact', $err)
+#end filter
 #if not $on
     <tr><td>Machine Name:</td><td><input type="text" name="name" value="$defaults.name"/></td></tr>
+#filter None
 $errorRow('name', $err)
+#end filter
     <tr>
-      <td>HVM/ParaVM$helppopup('hvm_paravm')</td>
-      <td>$vmTypeList($defaults.type)</td>
+      <td>HVM/ParaVM#slurp
+#filter None
+$helppopup('hvm_paravm')#slurp
+#end filter
+</td>
+      <td>#slurp
+#filter None
+$vmTypeList($defaults.type)#slurp
+#end filter
+</td>
     </tr>
     <tr><td>Ram:</td><td><input type="text" size=3 name="memory" value="$defaults.memory"/>MiB (max $max_mem)</td></tr>
+#filter None
 $errorRow('memory', $err)
+#end filter
     <tr><td>Disk:</td><td><input type="text" size=3 name="disk" value="$defaults.disk"/>GiB (max $max_disk)</td><td>WARNING: Modifying disk size may corrupt your data.</td></tr>
+#filter None
 $errorRow('disk', $err)
+#end filter
 #else
+#filter None
 $errorRow('name', $err)
 $errorRow('memory', $err)
 $errorRow('disk', $err)
+#end filter
 #end if
     <tr><td><input type="submit" class="button" name="action" value="Change"/></td></tr>
@@ -91 +125 @@
 #def body
 <div id="info">
+#filter None
   $infoTable()
+#end filter
 </div>
 
 <h2>Commands</h2>
 <div id="commands">
+#filter None
   $commands()
+#end filter
 </div>
 <h2>Settings</h2>
 <div id="modify">
+#filter None
   $modifyForm()
+#end filter
 </div>
 #end def