[Python-modules-commits] [python-django] 07/10: CVE-2016-6186: Fixed XSS in admin's add/change related popup.

[Luke Faraone]

This is an automated email from the git hooks/post-receive script.

lfaraone pushed a commit to branch debian/jessie
in repository python-django.

commit 5f8334ebb78f1f7d704385a75652622dd5675557
Author: Tim Graham <timograham at gmail.com>
Date:   Thu Jul 21 04:33:15 2016 +0200

    CVE-2016-6186: Fixed XSS in admin's add/change related popup.
    
    
    Origin: upstream, https://github.com/django/django/commit/8462b3fa9c0a59221a8b5583025c3a9fff637d85
    Forwarded: not-needed
    Reviewed-by: Luke Faraone <lfaraone at debian.org>
    Last-Update: 2016-07-16
    Applied-Upstream: 1.8.14
---
 django/views/debug.py       | 4 ++--
 tests/admin_views/admin.py  | 3 ++-
 tests/admin_views/models.py | 4 ++++
 3 files changed, 8 insertions(+), 3 deletions(-)

diff --git a/django/views/debug.py b/django/views/debug.py
index 13992e9..7d8ea05 100644
--- a/django/views/debug.py
+++ b/django/views/debug.py
@@ -637,13 +637,13 @@ TECHNICAL_500_TEMPLATE = """
       var s = link.getElementsByTagName('span')[0];
       var uarr = String.fromCharCode(0x25b6);
       var darr = String.fromCharCode(0x25bc);
-      s.innerHTML = s.innerHTML == uarr ? darr : uarr;
+      s.textContent = s.textContent == uarr ? darr : uarr;
       return false;
     }
     function switchPastebinFriendly(link) {
       s1 = "Switch to copy-and-paste view";
       s2 = "Switch back to interactive view";
-      link.innerHTML = link.innerHTML == s1 ? s2: s1;
+      link.textContent = link.textContent.trim() == s1 ? s2: s1;
       toggle('browserTraceback', 'pastebinTraceback');
       return false;
     }
diff --git a/tests/admin_views/admin.py b/tests/admin_views/admin.py
index 15c1384..36187af 100644
--- a/tests/admin_views/admin.py
+++ b/tests/admin_views/admin.py
@@ -83,7 +83,8 @@ class ChapterXtra1Admin(admin.ModelAdmin):
 
 class ArticleAdmin(admin.ModelAdmin):
     list_display = ('content', 'date', callable_year, 'model_year',
-                    'modeladmin_year', 'model_year_reversed')
+                    'modeladmin_year', 'model_year_reversed', 'section')
+    list_editable = ('section',)
     list_filter = ('date', 'section')
     view_on_site = False
     fieldsets = (
diff --git a/tests/admin_views/models.py b/tests/admin_views/models.py
index f41b4de..79dd56c 100644
--- a/tests/admin_views/models.py
+++ b/tests/admin_views/models.py
@@ -15,6 +15,7 @@ from django.db import models
 from django.utils.encoding import python_2_unicode_compatible
 
 
+ at python_2_unicode_compatible
 class Section(models.Model):
     """
     A simple section that links to articles, to test linking to related items
@@ -22,6 +23,9 @@ class Section(models.Model):
     """
     name = models.CharField(max_length=100)
 
+    def __str__(self):
+        return self.name
+
     @property
     def name_property(self):
         """

-- 
Alioth's /usr/local/bin/git-commit-notice on /srv/git.debian.org/git/python-modules/packages/python-django.git