4 ms·
Fixed. Let me know if we missed anything. I wish we could use Django's autoescape filter but App Engine's SDK ships with just 0.96 by default. We can only upg
by dannyr 16y ago
Fixed. Let me know if we missed anything.
I wish we could use Django's autoescape filter but App Engine's SDK ships with just 0.96 by default.
We can only upgrade to a later version of Django in Prod and not locally.
- Xk 16y agoUsernames aren't sanitized yet. (As is visible with the '<asdf' in the 'foobar' link above.) EG: http://profile.io/xss2 http://profile.io/xss2
- qeorge 16y agoAlso, you missed the login form (both in the header and on http://profile.io/login http://profile.io/login). Its echoing the username directly, e.g., "Username <script>alert(1)</script> was not found"
- StavrosK 16y agoYou really need to use Django-nonrel, it's at 1.3b and awesome. I use it for http://www.yourpane.com http://www.yourpane.com and it works fantastically well.