From b48214feac03f96798ac229632608fc1f08bf303 Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?Fr=C3=A9d=C3=A9ric=20P=C3=A9ters?= Date: Thu, 22 Feb 2024 16:39:35 +0100 Subject: [PATCH] misc: do not decorate uploaded HTML files (#87331) --- tests/form_pages/test_file_field.py | 36 +++++++++++++++++++++++++++++ wcs/admin/data_sources.py | 2 +- wcs/admin/users.py | 2 +- wcs/admin/wscalls.py | 2 +- wcs/backoffice/management.py | 12 +++++----- wcs/backoffice/submission.py | 2 +- wcs/compat.py | 4 ++-- wcs/forms/common.py | 4 ++-- wcs/qommon/http_response.py | 1 + wcs/qommon/template.py | 2 +- 10 files changed, 52 insertions(+), 15 deletions(-) diff --git a/tests/form_pages/test_file_field.py b/tests/form_pages/test_file_field.py index 75cd0dd46..81ec055bd 100644 --- a/tests/form_pages/test_file_field.py +++ b/tests/form_pages/test_file_field.py @@ -238,6 +238,42 @@ def test_form_file_field_image_submit(pub): assert '%s' % context['body']) - elif 'raw' in (getattr(self.quixote_response, 'filter') or {}): + elif self.quixote_response.raw: # used for raw HTML snippets (for example in the test tool # results in inspect page). response = HttpResponse(context['body']) @@ -161,7 +161,7 @@ class CompatWcsPublisher(WcsPublisher): if response.status_code == 304: # clients don't like to receive content with a 304 return '' - if response.content_type != 'text/html': + if response.content_type != 'text/html' or response.raw: return output if not hasattr(response, 'filter') or not response.filter: return output diff --git a/wcs/forms/common.py b/wcs/forms/common.py index 6713c3f13..7e1c1283d 100644 --- a/wcs/forms/common.py +++ b/wcs/forms/common.py @@ -112,7 +112,7 @@ class FileDirectory(Directory): # force potential HTML upload to be used as-is (not decorated with theme) # and with minimal permissions - response.filter = {} + response.raw = True response.set_header( 'Content-Security-Policy', 'default-src \'none\'; img-src %s;' % get_request().build_absolute_uri(), @@ -1074,7 +1074,7 @@ class TempfileDirectoryMixin: # force potential HTML upload to be used as-is (not decorated with theme) # and with minimal permissions - response.filter = {} + response.raw = True response.set_header( 'Content-Security-Policy', 'default-src \'none\'; img-src %s;' % get_request().build_absolute_uri(), diff --git a/wcs/qommon/http_response.py b/wcs/qommon/http_response.py index e76f65766..3582af7cc 100644 --- a/wcs/qommon/http_response.py +++ b/wcs/qommon/http_response.py @@ -28,6 +28,7 @@ class HTTPResponse(quixote.http_response.HTTPResponse): javascript_code_parts = None css_includes = None after_jobs = None + raw = False # in case of html content, send result as is (True) or embedded in page template (False) def __init__(self, charset=None, **kwargs): quixote.http_response.HTTPResponse.__init__(self, charset=charset, **kwargs) diff --git a/wcs/qommon/template.py b/wcs/qommon/template.py index 5a0fce34b..0f92621e0 100644 --- a/wcs/qommon/template.py +++ b/wcs/qommon/template.py @@ -78,7 +78,7 @@ def error_page(error_message, error_title=None, location_hint=None): def get_decorate_vars(body, response, generate_breadcrumb=True, **kwargs): from .publisher import get_cfg - if response.content_type != 'text/html': + if response.content_type != 'text/html' or response.raw: return {'body': body} if get_request().get_header('x-popup') == 'true':