1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
|
From 5f8334ebb78f1f7d704385a75652622dd5675557 Mon Sep 17 00:00:00 2001
From: Tim Graham <timograham@gmail.com>
Date: Thu, 21 Jul 2016 04:33:15 +0200
Subject: CVE-2016-6186: Fixed XSS in admin's add/change related popup.
Origin: upstream, https://github.com/django/django/commit/8462b3fa9c0a59221a8b5583025c3a9fff637d85
Forwarded: not-needed
Reviewed-by: Luke Faraone <lfaraone@debian.org>
Last-Update: 2016-07-16
Applied-Upstream: 1.8.14
---
django/views/debug.py | 4 ++--
tests/admin_views/admin.py | 3 ++-
tests/admin_views/models.py | 4 ++++
3 files changed, 8 insertions(+), 3 deletions(-)
diff --git a/django/views/debug.py b/django/views/debug.py
index 13992e9..7d8ea05 100644
--- a/django/views/debug.py
+++ b/django/views/debug.py
@@ -637,13 +637,13 @@ TECHNICAL_500_TEMPLATE = """
var s = link.getElementsByTagName('span')[0];
var uarr = String.fromCharCode(0x25b6);
var darr = String.fromCharCode(0x25bc);
- s.innerHTML = s.innerHTML == uarr ? darr : uarr;
+ s.textContent = s.textContent == uarr ? darr : uarr;
return false;
}
function switchPastebinFriendly(link) {
s1 = "Switch to copy-and-paste view";
s2 = "Switch back to interactive view";
- link.innerHTML = link.innerHTML == s1 ? s2: s1;
+ link.textContent = link.textContent.trim() == s1 ? s2: s1;
toggle('browserTraceback', 'pastebinTraceback');
return false;
}
diff --git a/tests/admin_views/admin.py b/tests/admin_views/admin.py
index 15c1384..36187af 100644
--- a/tests/admin_views/admin.py
+++ b/tests/admin_views/admin.py
@@ -83,7 +83,8 @@ class ChapterXtra1Admin(admin.ModelAdmin):
class ArticleAdmin(admin.ModelAdmin):
list_display = ('content', 'date', callable_year, 'model_year',
- 'modeladmin_year', 'model_year_reversed')
+ 'modeladmin_year', 'model_year_reversed', 'section')
+ list_editable = ('section',)
list_filter = ('date', 'section')
view_on_site = False
fieldsets = (
diff --git a/tests/admin_views/models.py b/tests/admin_views/models.py
index f41b4de..79dd56c 100644
--- a/tests/admin_views/models.py
+++ b/tests/admin_views/models.py
@@ -15,6 +15,7 @@ from django.db import models
from django.utils.encoding import python_2_unicode_compatible
+@python_2_unicode_compatible
class Section(models.Model):
"""
A simple section that links to articles, to test linking to related items
@@ -22,6 +23,9 @@ class Section(models.Model):
"""
name = models.CharField(max_length=100)
+ def __str__(self):
+ return self.name
+
@property
def name_property(self):
"""
|
