github/plexpy
1
0
Fork 0
mirror of https://github.com/Tautulli/Tautulli.git synced 2025-08-19 12:59:42 -07:00
Code Issues Projects Releases Packages Wiki Activity Actions 1

Fix potential XSS in search

Browse source
This commit is contained in:
JonnyWong16 2018-05-02 10:26:05 -07:00
commit 4fb4410552
3 changed files with 7 additions and 5 deletions
Download patch file Download diff file Expand all files Collapse all files

8
data/interfaces/default/search.html
View file

@ -28,15 +28,17 @@
<%def name="javascriptIncludes()"> <%def name="javascriptIncludes()">
<script> <script>
var query_string = "${query.replace('"','\\"').replace('/','\\/') | n}";
$('#search_button').removeClass('btn-inactive'); $('#search_button').removeClass('btn-inactive');
$('#query').val("${query.replace('"','\\"') | n}").css({ right: '0', width: '250px' }).addClass('active'); $('#query').val(query_string).css({ right: '0', width: '250px' }).addClass('active');
$.ajax({ $.ajax({
url: 'get_search_results_children', url: 'get_search_results_children',
type: "GET", type: "POST",
async: true, async: true,
data: { data: {
query: "${query.replace('"','\\"') | n}", query: query_string,
limit: 30 limit: 30
}, },
complete: function (xhr, status) { complete: function (xhr, status) {

2
data/interfaces/default/update_metadata.html
View file

@ -188,7 +188,7 @@ DOCUMENTATION :: END
}, },
complete: function (xhr, status) { complete: function (xhr, status) {
$('#search-results-list').html(xhr.responseText); $('#search-results-list').html(xhr.responseText);
$('#update_query_title').html(query_string) $('#update_query_title').text(query_string)
} }
}); });
} }

2
plexpy/pmsconnect.py
View file

@ -2544,7 +2544,7 @@ class PmsConnect(object):
metadata = self.get_metadata_details(rating_key=rating_key) metadata = self.get_metadata_details(rating_key=rating_key)
search_results_list[metadata['media_type']].append(metadata) search_results_list[metadata['media_type']].append(metadata)
output = {'results_count': sum(len(s) for s in search_results_list.items()), output = {'results_count': sum(len(s) for s in search_results_list.values()),
'results_list': search_results_list 'results_list': search_results_list
} }