[Zope-Checkins] CVS: Zope/lib/python/OFS - ObjectManager.py:1.156 PropertyManager.py:1.45 PropertySheets.py:1.85 Uninstalled.py:1.14
Martijn Pieters
mj@zope.com
Thu, 1 Aug 2002 12:01:10 -0400
Update of /cvs-repository/Zope/lib/python/OFS
In directory cvs.zope.org:/tmp/cvs-serv9325/lib/python/OFS
Modified Files:
ObjectManager.py PropertyManager.py PropertySheets.py
Uninstalled.py
Log Message:
Big change
- Make DTML automatically html quote data indirectly taken from REQUEST
which contain a '<'. Make sure (almost) all string operation preserve the
taint on this data.
- Fix exceptions that use REQUEST data; quote the data.
- Don't let form and cookie values mask the REQUEST computed values such as
URL0 and BASE1.
=== Zope/lib/python/OFS/ObjectManager.py 1.155 => 1.156 ===
from AccessControl import getSecurityManager
from zLOG import LOG, ERROR
import sys,fnmatch,copy
+from cgi import escape
+from types import StringType, UnicodeType
import XMLExportImport
customImporters={
@@ -51,11 +53,12 @@
# check_valid_id() will be called again later with allow_dup
# set to false before the object is added.
- if not id or (type(id) != type('')):
+ if not id or not isinstance(id, StringType):
+ if isinstance(id, UnicodeType): id = escape(id)
raise BadRequestException, ('Empty or invalid id specified', id)
if bad_id(id) is not None:
raise BadRequestException, (
- 'The id "%s" contains characters illegal in URLs.' % id)
+ 'The id "%s" contains characters illegal in URLs.' % escape(id))
if id[0]=='_': raise BadRequestException, (
'The id "%s" is invalid - it begins with an underscore.' % id)
if id[:3]=='aq_': raise BadRequestException, (
@@ -434,13 +437,13 @@
for n in ids:
if n in p:
return MessageDialog(title='Not Deletable',
- message='<EM>%s</EM> cannot be deleted.' % n,
+ message='<EM>%s</EM> cannot be deleted.' % escape(n),
action ='./manage_main',)
while ids:
id=ids[-1]
v=self._getOb(id, self)
if v is self:
- raise 'BadRequest', '%s does not exist' % ids[-1]
+ raise 'BadRequest', '%s does not exist' % escape(ids[-1])
self._delObject(id)
del ids[-1]
if REQUEST is not None:
@@ -511,7 +514,7 @@
"""Import an object from a file"""
dirname, file=os.path.split(file)
if dirname:
- raise BadRequestException, 'Invalid file name %s' % file
+ raise BadRequestException, 'Invalid file name %s' % escape(file)
instance_home = INSTANCE_HOME
zope_home = ZOPE_HOME
@@ -521,7 +524,7 @@
if os.path.exists(filepath):
break
else:
- raise BadRequestException, 'File does not exist: %s' % file
+ raise BadRequestException, 'File does not exist: %s' % escape(file)
self._importObjectFromFile(filepath, verify=not not REQUEST,
set_owner=set_owner)
=== Zope/lib/python/OFS/PropertyManager.py 1.44 => 1.45 ===
from Globals import DTMLFile, MessageDialog
from Acquisition import Implicit, aq_base
from Globals import Persistent
+from cgi import escape
@@ -121,7 +122,7 @@
def valid_property_id(self, id):
if not id or id[:1]=='_' or (id[:3]=='aq_') \
- or (' ' in id) or hasattr(aq_base(self), id):
+ or (' ' in id) or hasattr(aq_base(self), id) or escape(id) != id:
return 0
return 1
@@ -188,7 +189,7 @@
# the value to the type of the existing property.
self._wrapperCheck(value)
if not self.hasProperty(id):
- raise 'Bad Request', 'The property %s does not exist' % id
+ raise 'Bad Request', 'The property %s does not exist' % escape(id)
if type(value)==type(''):
proptype=self.getPropertyType(id) or 'string'
if type_converters.has_key(proptype):
@@ -197,7 +198,7 @@
def _delProperty(self, id):
if not self.hasProperty(id):
- raise ValueError, 'The property %s does not exist' % id
+ raise ValueError, 'The property %s does not exist' % escape(id)
delattr(self,id)
self._properties=tuple(filter(lambda i, n=id: i['id'] != n,
self._properties))
@@ -281,7 +282,7 @@
for name, value in props.items():
if self.hasProperty(name):
if not 'w' in propdict[name].get('mode', 'wd'):
- raise 'BadRequest', '%s cannot be changed' % name
+ raise 'BadRequest', '%s cannot be changed' % escape(name)
self._updateProperty(name, value)
if REQUEST:
message="Saved changes."
@@ -324,7 +325,7 @@
for id in ids:
if not hasattr(aq_base(self), id):
raise 'BadRequest', (
- 'The property <em>%s</em> does not exist' % id)
+ 'The property <em>%s</em> does not exist' % escape(id))
if (not 'd' in propdict[id].get('mode', 'wd')) or (id in nd):
return MessageDialog(
title ='Cannot delete %s' % id,
=== Zope/lib/python/OFS/PropertySheets.py 1.84 => 1.85 ===
from Traversable import Traversable
from Acquisition import aq_base
from AccessControl import getSecurityManager
+from cgi import escape
class View(App.Management.Tabs, Base):
"""A view of an object, typically used for management purposes
@@ -141,7 +142,7 @@
def valid_property_id(self, id):
if not id or id[:1]=='_' or (id[:3]=='aq_') \
- or (' ' in id):
+ or (' ' in id) or escape(id) != id:
return 0
return 1
@@ -180,7 +181,7 @@
# systems.
self._wrapperCheck(value)
if not self.valid_property_id(id):
- raise 'Bad Request', 'Invalid property id, %s.' % id
+ raise 'Bad Request', 'Invalid property id, %s.' % escape(id)
if not self.property_extensible_schema__():
raise 'Bad Request', (
@@ -190,7 +191,8 @@
if hasattr(aq_base(self),id):
if not (id=='title' and not self.__dict__.has_key(id)):
raise 'Bad Request', (
- 'Invalid property id, <em>%s</em>. It is in use.' % id)
+ 'Invalid property id, <em>%s</em>. It is in use.' %
+ escape(id))
if meta is None: meta={}
prop={'id':id, 'type':type, 'meta':meta}
pself._properties=pself._properties+(prop,)
@@ -211,10 +213,10 @@
# it will used to _replace_ the properties meta data.
self._wrapperCheck(value)
if not self.hasProperty(id):
- raise 'Bad Request', 'The property %s does not exist.' % id
+ raise 'Bad Request', 'The property %s does not exist.' % escape(id)
propinfo=self.propertyInfo(id)
if not 'w' in propinfo.get('mode', 'wd'):
- raise 'Bad Request', '%s cannot be changed.' % id
+ raise 'Bad Request', '%s cannot be changed.' % escape(id)
if type(value)==type(''):
proptype=propinfo.get('type', 'string')
if type_converters.has_key(proptype):
@@ -232,13 +234,13 @@
# Delete the property with the given id. If a property with the
# given id does not exist, a ValueError is raised.
if not self.hasProperty(id):
- raise 'Bad Request', 'The property %s does not exist.' % id
+ raise 'Bad Request', 'The property %s does not exist.' % escape(id)
vself=self.v_self()
if hasattr(vself, '_reserved_names'):
nd=vself._reserved_names
else: nd=()
if (not 'd' in self.propertyInfo(id).get('mode', 'wd')) or (id in nd):
- raise 'Bad Request', '%s cannot be deleted.' % id
+ raise 'Bad Request', '%s cannot be deleted.' % escape(id)
delattr(vself, id)
pself=self.p_self()
pself._properties=tuple(filter(lambda i, n=id: i['id'] != n,
@@ -262,7 +264,7 @@
# Return a mapping containing property meta-data
for p in self._propertyMap():
if p['id']==id: return p
- raise ValueError, 'The property %s does not exist.' % id
+ raise ValueError, 'The property %s does not exist.' % escape(id)
def _propertyMap(self):
# Return a tuple of mappings, giving meta-data for properties.
@@ -418,7 +420,7 @@
for name, value in props.items():
if self.hasProperty(name):
if not 'w' in propdict[name].get('mode', 'wd'):
- raise 'BadRequest', '%s cannot be changed' % name
+ raise 'BadRequest', '%s cannot be changed' % escape(name)
self._updateProperty(name, value)
if REQUEST is not None:
return MessageDialog(
@@ -487,13 +489,13 @@
return getattr(self, method)()
def _setProperty(self, id, value, type='string', meta=None):
- raise ValueError, '%s cannot be set.' % id
+ raise ValueError, '%s cannot be set.' % escape(id)
def _updateProperty(self, id, value):
- raise ValueError, '%s cannot be updated.' % id
+ raise ValueError, '%s cannot be updated.' % escape(id)
def _delProperty(self, id):
- raise ValueError, '%s cannot be deleted.' % id
+ raise ValueError, '%s cannot be deleted.' % escape(id)
def _propertyMap(self):
# Only use getlastmodified if returns a value
=== Zope/lib/python/OFS/Uninstalled.py 1.13 => 1.14 ===
import Persistence
from thread import allocate_lock
from zLOG import LOG, WARNING
+from cgi import escape
broken_klasses={}
broken_klasses_lock = allocate_lock()
@@ -42,7 +43,7 @@
def __getattr__(self, name):
if name[:3]=='_p_':
return BrokenClass.inheritedAttribute('__getattr__')(self, name)
- raise AttributeError, name
+ raise AttributeError, escape(name)
manage=manage_main=Globals.DTMLFile('dtml/brokenEdit',globals())
manage_workspace=manage