1
=== modified file 'src/webui/forms.py'
2
--- src/webui/forms.py	2018-07-19 15:46:28 +0000
3
+++ src/webui/forms.py	2020-01-27 16:55:59 +0000
4
@@ -5,7 +5,7 @@
5
5
import unicodedata
5
import unicodedata
6
6
6
7
7
from django import forms
7
from django import forms
9
8
from django.utils.html import escape, format_html
8
from django.utils.html import escape
10
9
from django.utils.translation import ugettext_lazy as _
9
from django.utils.translation import ugettext_lazy as _
11
10
10
12
11
from webservices.launchpad import (
11
from webservices.launchpad import (
13
@@ -83,7 +83,7 @@
14
83
83
15
84
84
16
85
def format_ssh_key(ssh_key):
85
def format_ssh_key(ssh_key):
18
86
    """Decide how to display 'ssh_key'.
86
    """Parse and split 'ssh_key'.
19
87
87
20
88
    SSH keys are freeform text, so users absolutely *will* try and add keys
88
    SSH keys are freeform text, so users absolutely *will* try and add keys
21
89
    that contain javascript, so we need to make sure they're escaped when
89
    that contain javascript, so we need to make sure they're escaped when
22
@@ -96,37 +96,20 @@
23
96
        # valid ssh key format. However, we need to exercise this code path
96
        # valid ssh key format. However, we need to exercise this code path
24
97
        # in tests to ensure that users malicously POST'ing bad key formats
97
        # in tests to ensure that users malicously POST'ing bad key formats
25
98
        # will get a ValidationError.
98
        # will get a ValidationError.
30
99
        # Just return the escaped data - this will never be run in production:
99
        # This should never happen in production but it returns a valid dict:
31
100
        return format_html(
100
        ssh_key_info = dict()
32
101
            '<label>Bad Key Data: <span>{key}</span></label>',
101
        ssh_key_info['ssh_key'] = ssh_key
33
102
            key=escape(ssh_key))
102
        ssh_key_info['label'] = "Invalid key"
34
103
        ssh_key_info['type'] = "Invalid key"
35
104
        ssh_key_info['text'] = escape(ssh_key)
36
105
        return ssh_key_info
37
103
    else:
106
    else:
64
104
        return format_html(
107
        ssh_key_info = dict()
65
105
            u'<div class="key-display">'
108
        ssh_key_info['ssh_key'] = escape(ssh_key)
66
106
            u'  <h4>{comment}</h4> '
109
        ssh_key_info['label'] = escape(comment)
67
107
            u'  <ul>'
110
        ssh_key_info['type'] = escape(key_type)
68
108
            u'    <li>'
111
        ssh_key_info['text'] = escape(key_text)
69
109
            u'      <dl>'
112
        return ssh_key_info
44
110
            u'        <dt>{key_type_label}</dt>'
45
111
            u'        <dd>{key_type}</dt>'
46
112
            u'      </dl>'
47
113
            u'    </li>'
48
114
            u'    <li>'
49
115
            u'      <dl>'
50
116
            u'        <dt>{key_text_label}</dt>'
51
117
            u'        <dd class="key-text">'
52
118
            u'          <a href="#">{key_text}</a>'
53
119
            u'        </dt>'
54
120
            u'      </dl>'
55
121
            u'    </li>'
56
122
            u'  </ul>'
57
123
            u'</div>',
58
124
            comment=comment,
59
125
            key_type_label=_("Type: "),
60
126
            key_type=key_type,
61
127
            key_text_label=_("Text: "),
62
128
            key_text=key_text,
63
129
        )
70
130
113
71
131
114
72
132
class DeleteSSHKeyForm(forms.Form):
115
class DeleteSSHKeyForm(forms.Form):
73
133
116
74
=== modified file 'src/webui/templates/account/ssh_keys.html'
75
--- src/webui/templates/account/ssh_keys.html	2020-01-22 12:52:26 +0000
76
+++ src/webui/templates/account/ssh_keys.html	2020-01-27 16:55:59 +0000
77
@@ -17,27 +17,27 @@
78
17
    {% if delete_key_form.fields.ssh_keys.choices %}
17
    {% if delete_key_form.fields.ssh_keys.choices %}
79
18
      <section class="delete-ssh-keys">
18
      <section class="delete-ssh-keys">
80
19
        <form action="" method="POST">
19
        <form action="" method="POST">
82
20
            <ul class="p-list--divided">
20
          <ul class="p-list--divided">
83
21
            {% csrf_token %}
21
            {% csrf_token %}
84
22
            {% for value, key_info in delete_key_form.fields.ssh_keys.choices %}
22
            {% for value, key_info in delete_key_form.fields.ssh_keys.choices %}
103
23
              <li class="p-list__item">
23
            <li class="p-list__item">
104
24
                <input id="id_ssh_keys_{{ forloop.counter0 }}" name="ssh_keys" type="checkbox" value="{{ value }}"><label for="id_ssh_keys_{{ forloop.counter0 }}">{{ key_info.label }}</label>
24
              <input id="id_ssh_keys_{{ forloop.counter0 }}" name="ssh_keys" type="checkbox" value="{{ value }}"><label for="id_ssh_keys_{{ forloop.counter0 }}">{{ key_info.label }}</label>
105
25
                <aside class="p-accordion" role="tablist" aria-multiselect="true">
25
              <aside class="p-accordion" role="tablist" aria-multiselect="true">
106
26
                  <ul class="p-accordion__list" style="margin-bottom: 0;">
26
                <ul class="p-accordion__list" style="margin-bottom: 0;">
107
27
                    <li class="p-accordion__group">
27
                  <li class="p-accordion__group">
108
28
                      <button type="button" class="p-accordion__tab" id="tab{{ forloop.counter0 }}" role="tab" aria-controls="#tab{{ forloop.counter0 }}-section" aria-expanded="false">{% trans "Key details" %}</button>
28
                    <button type="button" class="p-accordion__tab" id="tab{{ forloop.counter0 }}" role="tab" aria-controls="#tab{{ forloop.counter0 }}-section" aria-expanded="false">{% trans "Key details" %}</button>
109
29
                      <section class="p-accordion__panel" id="tab{{ forloop.counter0 }}-section" role="tabpanel" aria-hidden="true" aria-labelledby="tab{{ forloop.counter0 }}-section">
29
                    <section class="p-accordion__panel" id="tab{{ forloop.counter0 }}-section" role="tabpanel" aria-hidden="true" aria-labelledby="tab{{ forloop.counter0 }}-section">
110
30
                        <dl>
30
                      <dl>
111
31
                          <dt>Type</dt>
31
                        <dt>Type</dt>
112
32
                          <dd>{{ key_info.type }}</dd>
32
                        <dd>{{ key_info.type }}</dd>
113
33
                          <dt>Text</dt>
33
                        <dt>Text</dt>
114
34
                          <dd><code>{{ key_info.text }}</code></dd>
34
                        <dd><code>{{ key_info.text }}</code></dd>
115
35
                        </dl>
35
                      </dl>
116
36
                      </section>
36
                    </section>
117
37
                    </li>
37
                  </li>
118
38
                  </ul>
38
                </ul>
119
39
                </aside>
39
              </aside>
120
40
              </li>
40
            </li>
121
41
            {% endfor %}
41
            {% endfor %}
122
42
          </ul>
42
          </ul>
123
43
          <input class="p-button--negative" type="submit" name="delete_keys" value="{% trans "Delete selected keys" %}"/>
43
          <input class="p-button--negative" type="submit" name="delete_keys" value="{% trans "Delete selected keys" %}"/>
124
44
44
125
=== modified file 'src/webui/tests/test_forms.py'
126
--- src/webui/tests/test_forms.py	2018-07-19 16:05:43 +0000
127
+++ src/webui/tests/test_forms.py	2020-01-27 16:55:59 +0000
128
@@ -250,7 +250,19 @@
129
250
        self.assertNotIn(bad_content, formatted_key)
250
        self.assertNotIn(bad_content, formatted_key)
130
251
        self.assertIn(
251
        self.assertIn(
131
252
            '&lt;script&gt;window.alert(&quot;boo!&quot;);&lt;/script&gt;',
252
            '&lt;script&gt;window.alert(&quot;boo!&quot;);&lt;/script&gt;',
133
253
            formatted_key
253
            formatted_key['text']
134
254
        )
135
255
        self.assertIn(
136
256
            '&lt;script&gt;window.alert(&quot;boo!&quot;);&lt;/script&gt;',
137
257
            formatted_key['label']
138
258
        )
139
259
        self.assertIn(
140
260
            '&lt;script&gt;window.alert(&quot;boo!&quot;);&lt;/script&gt;',
141
261
            formatted_key['type']
142
262
        )
143
263
        self.assertIn(
144
264
            '&lt;script&gt;window.alert(&quot;boo!&quot;);&lt;/script&gt;',
145
265
            formatted_key['ssh_key']
146
254
        )
266
        )
147
255
267
148
256
    def test_unicode(self):
268
    def test_unicode(self):
149
@@ -258,7 +270,13 @@
150
258
        # previously this would raise UnicodeDecodeError. Now it works as
270
        # previously this would raise UnicodeDecodeError. Now it works as
151
259
        # expected.
271
        # expected.
152
260
        formatted_key = format_ssh_key(keytext)
272
        formatted_key = format_ssh_key(keytext)
154
261
        self.assertIn('¿ʇuǝɯɯoɔ', formatted_key)
273
        self.assertIn('¿ʇuǝɯɯoɔ', formatted_key['label'])
155
274
156
275
    def test_invalid_keys(self):
157
276
        invalid_key_text = "INVALID"
158
277
        formatted_key = format_ssh_key(invalid_key_text)
159
278
        self.assertIn(invalid_key_text, formatted_key['ssh_key'])
160
279
        self.assertIn('Invalid key', formatted_key['label'])
161
262
280
162
263
281
163
264
class DeleteSSHKeyFormTestCase(SSOBaseTestCase):
282
class DeleteSSHKeyFormTestCase(SSOBaseTestCase):
Reviewer	Date Requested	Status
Daniel Manrique (community)		Approve on 2020-01-30
Anthony Dillon (community)		Approve on 2020-01-27
Maximiliano Bertacchini	2020-01-22	Approve on 2020-01-27
Review via email: mp+377940@code.launchpad.net