From d03bf6fe4e9bf5b07de62c1a271c4b41a7d3d158 Mon Sep 17 00:00:00 2001 From: Tim Graham Date: Wed, 6 Jul 2016 15:41:06 -0400 Subject: [1.9.x] Fixed XSS in admin's add/change related popup. This is a security fix. --- django/contrib/admin/static/admin/js/admin/RelatedObjectLookups.js | 2 +- django/views/debug.py | 4 ++-- 2 files changed, 3 insertions(+), 3 deletions(-) (limited to 'django') diff --git a/django/contrib/admin/static/admin/js/admin/RelatedObjectLookups.js b/django/contrib/admin/static/admin/js/admin/RelatedObjectLookups.js index 4ac9baa8ee..76cc952239 100644 --- a/django/contrib/admin/static/admin/js/admin/RelatedObjectLookups.js +++ b/django/contrib/admin/static/admin/js/admin/RelatedObjectLookups.js @@ -120,7 +120,7 @@ var selects = django.jQuery(selectsSelector); selects.find('option').each(function() { if (this.value === objId) { - this.innerHTML = newRepr; + this.textContent = newRepr; this.value = newId; } }); diff --git a/django/views/debug.py b/django/views/debug.py index 7cff3eface..2629d345eb 100644 --- a/django/views/debug.py +++ b/django/views/debug.py @@ -631,13 +631,13 @@ TECHNICAL_500_TEMPLATE = (""" var s = link.getElementsByTagName('span')[0]; var uarr = String.fromCharCode(0x25b6); var darr = String.fromCharCode(0x25bc); - s.innerHTML = s.innerHTML == uarr ? darr : uarr; + s.textContent = s.textContent == uarr ? darr : uarr; return false; } function switchPastebinFriendly(link) { s1 = "Switch to copy-and-paste view"; s2 = "Switch back to interactive view"; - link.innerHTML = link.innerHTML.trim() == s1 ? s2: s1; + link.textContent = link.textContent.trim() == s1 ? s2: s1; toggle('browserTraceback', 'pastebinTraceback'); return false; } -- cgit v1.3