From 5c3ebcfa29c45ebf67b5a205db002de0729cc9fa Mon Sep 17 00:00:00 2001 From: 2000-Trek Date: Wed, 21 Jun 2023 22:30:35 +0200 Subject: [PATCH] fixed splite injektion --- main.py | 7 ++++--- 1 file changed, 4 insertions(+), 3 deletions(-) diff --git a/main.py b/main.py index e84489d..d9676bb 100644 --- a/main.py +++ b/main.py @@ -9,6 +9,7 @@ import sys import uuid import json import urllib.parse +from markupsafe import escape db_path = 'mate.db' conn = sqlite3.connect(db_path, check_same_thread=False) @@ -35,7 +36,7 @@ def exit_handler(): #website @app.route("/") def index(): - return 'user and tag list

The creator of this website accepts no liability for any linguistic or technical errors!



Doumentation' + return 'user anfrom markupsafe import escaped tag list

The creator of this website accepts no liability for any linguistic or technical errors!



Doumentation' @app.route("/list") def list(): @@ -44,7 +45,7 @@ def list(): text = "" for i in users: username = urllib.parse.quote_plus(i[1]) - text = text + f'

{username}: {i[2]}

Change balance:



' + text = text + f'

{escape(i[1])}: {i[2]}

Change balance:



' return ''' @@ -78,7 +79,7 @@ def user_info(): var socket = io(); """ + 'socket.on("update", function(){ window.location="http://matekasse.server.c3h/list/user?user=' + username + '"});' + f""" -

{user[1]} : {user[2]}

+

{escape(user[1])} : {user[2]}

Change balance: