[oozie] Prevent XSS injection from packets
This is a follow up for 'd86ee1eed54b33d1338184b15a05cf8ba37b6182'
which prevented entering tags from UI. Current fix handles the
case where the network packet is modifed to have tags.
@@ -26,6 +26,7 @@ from django.forms.formsets import formset_factory
from django.forms.models import inlineformset_factory
from django.http import HttpResponse
from django.shortcuts import redirect
+from django.template.defaultfilters import strip_tags
from django.utils.functional import curry
from django.utils.http import http_date
from django.utils.translation import ugettext as _, activate as activate_translation
@@ -502,7 +503,7 @@ def edit_coordinator(request, coordinator):
new_data_output_formset.save()
coordinator.sla = json.loads(request.POST.get('sla'))
if enable_cron_scheduling:
- coordinator.cron_frequency = {'frequency': request.POST.get('cron_frequency'), 'isAdvancedCron': request.POST.get('isAdvancedCron') == 'on'}
+ coordinator.cron_frequency = {'frequency': strip_tags(request.POST.get('cron_frequency')), 'isAdvancedCron': request.POST.get('isAdvancedCron') == 'on'}
coordinator.save()
request.info(_('Coordinator saved.'))
