[Zope-Checkins] CVS: Zope/lib/python/Products/Sessions/dtml - manageIdManager.dtml:1.8

Florent Guillaume fg@nuxeo.com
Sun, 22 Dec 2002 12:54:34 -0500


Update of /cvs-repository/Zope/lib/python/Products/Sessions/dtml
In directory cvs.zope.org:/tmp/cvs-serv14380/lib/python/Products/Sessions/dtml

Modified Files:
	manageIdManager.dtml 
Log Message:
Merged efge-death-to-dtml-var-branch into HEAD:

Removed most <dtml-var> to replace them with &dtml-foo;.
This corrects a number of potential XSS holes, and simplifies
auditability of the remaining legitimate <dtml-var>.


=== Zope/lib/python/Products/Sessions/dtml/manageIdManager.dtml 1.7 => 1.8 ===
--- Zope/lib/python/Products/Sessions/dtml/manageIdManager.dtml:1.7	Mon Aug 19 15:50:17 2002
+++ Zope/lib/python/Products/Sessions/dtml/manageIdManager.dtml	Sun Dec 22 12:54:03 2002
@@ -89,7 +89,7 @@
   </TD>
   <TD ALIGN="LEFT" VALIGN="TOP">
     <INPUT TYPE="TEXT" NAME="cookiepath" SIZE="20"
-     value="<dtml-var getCookiePath html_quote>">
+     value="&dtml-getCookiePath;">
   </TD>
 </TR>
 <TR>
@@ -105,7 +105,7 @@
   </TD>
   <TD ALIGN="LEFT" VALIGN="TOP">
     <INPUT TYPE="TEXT" NAME="cookiedomain" SIZE="20"
-     value="<dtml-var getCookieDomain html_quote>">
+     value="&dtml-getCookieDomain;">
   </TD>
 </TR>
 <TR>
@@ -120,7 +120,7 @@
   </TD>
   <TD ALIGN="LEFT" VALIGN="TOP">
     <INPUT TYPE="TEXT" NAME="cookielifedays:int" SIZE="20"
-     value="<dtml-var getCookieLifeDays html_quote>">
+     value="&dtml-getCookieLifeDays;">
   </TD>
 </TR>
 <TR>