Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Properly escape selected facets in search.html #643

Merged
merged 2 commits into from
Aug 20, 2020

Conversation

jeancochrane
Copy link
Contributor

Overview

This PR updates search/search.html to retrieve selected facets from a <script> element produced by json_script.

Checklist

  • PR has a descriptive enough title to be useful in changelogs

Notes

I've pinned django-councilmatic to my feature branch for the purposes of testing datamade/django-councilmatic#271. Before pulling this in, I'll adjust requirements.txt to reset the version of django-councilmatic to the version we deploy to fix datamade/django-councilmatic#270.

Testing Instructions

Connects datamade/django-councilmatic#270.

Copy link
Collaborator

@hancush hancush left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Great catch. Thanks, @jeancochrane!

@hancush
Copy link
Collaborator

hancush commented Aug 20, 2020

Rebuilt and replicated testing! This is good to go. I'll go ahead and merge / deploy. Thank you again, @jeancochrane. ❤

@hancush hancush merged commit d84f9e6 into master Aug 20, 2020
@hancush hancush deleted the hotfix/jfc/escape-selected-facets branch August 27, 2020 20:47
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
None yet
Projects
None yet
Development

Successfully merging this pull request may close these issues.

XSS Vulnerability when using filter options
2 participants