mirrors/django
1
0
Fork 0
mirror of https://github.com/django/django.git synced 2025-10-24 06:06:09 +00:00
Code Issues 32 Releases Wiki Activity

Fixed XSS in admin's add/change related popup.

Browse Source 
This is a security fix.
This commit is contained in:
Tim Graham
2016-07-06 15:41:06 -04:00
parent 767849b765
commit 93c538694e
5 changed files with 31 additions and 9 deletions
Download Patch File Download Diff File Expand all files Collapse all files

4
tests/admin_views/tests.py
View File

@@ -4475,11 +4475,11 @@ class SeleniumTests(AdminSeleniumTestCase):
self.wait_for_text('#content h1', 'Change section')
name_input = self.selenium.find_element_by_id('id_name')
name_input.clear()
name_input.send_keys('edited section')
name_input.send_keys('<i>edited section</i>')
self.selenium.find_element_by_xpath('//input[@value="Save"]').click()
self.selenium.switch_to.window(self.selenium.window_handles[0])
select = Select(self.selenium.find_element_by_id('id_form-0-section'))
self.assertEqual(select.first_selected_option.text, 'edited section')
self.assertEqual(select.first_selected_option.text, '<i>edited section</i>')
# Add popup
self.selenium.find_element_by_id('add_id_form-0-section').click()