extern/django-helpdesk
1
0
Fork 1
mirror of https://github.com/django-helpdesk/django-helpdesk.git synced 2025-01-19 04:19:54 +01:00
Code Issues Packages Projects Releases Wiki Activity

#72: Prevent django template tags from being executed in followup comments

Browse Source
This commit is contained in:
Garret Wassermann 2017-04-16 03:24:39 -04:00
parent bb59de037d
commit 01e87f2cb8
1 changed files with 6 additions and 4 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

10
helpdesk/views/staff.py
View File

@ -406,12 +406,14 @@ def update_ticket(request, ticket_id, public=False):
# comment.
context = safe_template_context(ticket)
# this line sometimes creates problems if code is sent as a comment.
# if comment contains some django code, like "why does {% if bla %} crash",
# then the following line will give us a crash, since django expects {% if %}
# to be closed with an {% endif %} tag.
from django.template import engines
template_func = engines['django'].from_string
# this prevents system from trying to render any template tags
# broken into two stages to prevent changes from first replace being themselves
# changed by the second replace due to conflicting syntax
comment = comment.replace('{%','X-HELPDESK-COMMENT-VERBATIM').replace('%}','X-HELPDESK-COMMENT-ENDVERBATIM')
comment = comment.replace('X-HELPDESK-COMMENT-VERBATIM','{% verbatim %}{%').replace('X-HELPDESK-COMMENT-ENDVERBATIM','%}{% endverbatim %}')
# render the neutralized template
comment = template_func(comment).render(context)
if owner is -1 and ticket.assigned_to: