Errata patch for CVE-2015-3988

https://review.openstack.org/183659

git fetch https://review.openstack.org/openstack/horizon refs/changes/59/183659/1 && git format-patch -1 --stdout FETCH_HEAD

Fixed upstream and in a future release.

----

From: Brant Knudson <[email protected]>

Date: Fri, 15 May 2015 19:21:31 +0000 (-0500)

Subject: Sanitation of metadata passed from Django

X-Git-Url: https://review.openstack.org/gitweb?p=openstack%2Fhorizon.git;a=commitdiff_plain;h=6c944b5013acb0dce7cf3d8717e58f7f2427be07

Sanitation of metadata passed from Django

We need to escape HTML in metadata passed from Django, which

can lead to security issues. Refer to the bug for more details.

Conflicts:

 horizon/templates/horizon/common/_modal_form_update_metadata.html

The conflict was that there are extra spaces in the line.

Co-Authored-By: Szymon Wroblewski <[email protected]>

Change-Id: I4821eacb0bb274befab7995f3a8f87c82d3997f5

Closes-bug: #1449260

(cherry picked from commit 81e1fa13177c8e259c90183409696305f55cdd75)

(cherry picked from commit e7f3e0880f4e311c768c413e43317674cb234515)

---

diff --git a/horizon/templates/horizon/common/_modal_form_update_metadata.html b/horizon/templates/horizon/common/_modal_form_update_metadata.html

index 6021393..e6b1810 100644

--- a/horizon/templates/horizon/common/_modal_form_update_metadata.html

+++ b/horizon/templates/horizon/common/_modal_form_update_metadata.html

@@ -224,8 +224,8 @@

     </div>

   </div>

   <script type="text/javascript">

-    var existing_metadata = {{existing_metadata|safe}};

-    var available_metadata = {{available_metadata|safe}};

+    var existing_metadata = JSON.parse('{{existing_metadata|escapejs}}');

+    var available_metadata = JSON.parse('{{available_metadata|escapejs}}');

   </script>

 {% endblock %}