- galaxy-commits - lists.galaxyproject.org

commit/galaxy-central: jmchilton: Bug fix for collections 2dc383c.
by commits-noreply＠bitbucket.org 11 Dec '14

11 Dec '14

1 new commit in galaxy-central: https://bitbucket.org/galaxy/galaxy-central/commits/42b5f213c92d/ Changeset: 42b5f213c92d User: jmchilton Date: 2014-12-11 19:44:18+00:00 Summary: Bug fix for collections 2dc383c. Affected #: 1 file diff -r 72143d1079be191695e7ce2171926e891795bd7a -r 42b5f213c92d395feb1f6d4d2ee691abeb134c42 lib/galaxy/tools/parameters/basic.py --- a/lib/galaxy/tools/parameters/basic.py +++ b/lib/galaxy/tools/parameters/basic.py @@ -2171,7 +2171,7 @@ def _history_query( self, trans ): dataset_collection_type_descriptions = trans.app.dataset_collections_service.collection_type_descriptions - return history_query.HistoryQuery.from_parameter_elem( self.elem, dataset_collection_type_descriptions ) + return history_query.HistoryQuery.from_parameter( self, dataset_collection_type_descriptions ) def get_html_field( self, trans=None, value=None, other_values={} ): # dropped refresh values, may be needed.. Repository URL: https://bitbucket.org/galaxy/galaxy-central/ -- This is a commit notification from bitbucket.org. You are receiving this because you have the service enabled, addressing the recipient of this email.

1 0

commit/galaxy-central: 3 new changesets
by commits-noreply＠bitbucket.org 11 Dec '14

11 Dec '14

3 new commits in galaxy-central: https://bitbucket.org/galaxy/galaxy-central/commits/daa0c69e8378/ Changeset: daa0c69e8378 Branch: next-stable User: davebgx Date: 2014-12-11 19:19:44+00:00 Summary: Merge stable changes to next-stable. Affected #: 67 files diff -r bce30adc75e94c99fc8fd53f3dee75a26b6c8e86 -r daa0c69e837855af94d2255999e732f1fec87550 .hgtags --- a/.hgtags +++ b/.hgtags @@ -20,4 +20,4 @@ ca45b78adb4152fc6e7395514d46eba6b7d0b838 release_2014.08.11 548ab24667d6206780237bd807f7d857a484c461 latest_2014.08.11 2092948937ac30ef82f71463a235c66d34987088 release_2014.10.06 -782cf1a1f6b56f8a9c0b3e5e9ffd29fd93b16ce3 latest_2014.10.06 +212e1d5e9be5a9a1e12c834bd545de504753c9fe latest_2014.10.06 diff -r bce30adc75e94c99fc8fd53f3dee75a26b6c8e86 -r daa0c69e837855af94d2255999e732f1fec87550 lib/galaxy/web/base/controllers/admin.py --- a/lib/galaxy/web/base/controllers/admin.py +++ b/lib/galaxy/web/base/controllers/admin.py @@ -7,6 +7,7 @@ from galaxy.web.form_builder import CheckboxField from string import punctuation as PUNCTUATION import galaxy.queue_worker +from markupsafe import escape from tool_shed.util import shed_util_common as suc @@ -28,7 +29,7 @@ @web.expose @web.require_admin def index( self, trans, **kwd ): - message = kwd.get( 'message', '' ) + message = escape( kwd.get( 'message', '' ) ) status = kwd.get( 'status', 'done' ) if trans.webapp.name == 'galaxy': installed_repositories = trans.install_model.context.query( trans.install_model.ToolShedRepository ).first() @@ -46,7 +47,7 @@ @web.expose @web.require_admin def center( self, trans, **kwd ): - message = kwd.get( 'message', '' ) + message = escape( kwd.get( 'message', '' ) ) status = kwd.get( 'status', 'done' ) if trans.webapp.name == 'galaxy': return trans.fill_template( '/webapps/galaxy/admin/center.mako', diff -r bce30adc75e94c99fc8fd53f3dee75a26b6c8e86 -r daa0c69e837855af94d2255999e732f1fec87550 lib/galaxy/webapps/demo_sequencer/controllers/common.py --- a/lib/galaxy/webapps/demo_sequencer/controllers/common.py +++ b/lib/galaxy/webapps/demo_sequencer/controllers/common.py @@ -4,6 +4,7 @@ import time, socket, urllib, urllib2, base64, copy from galaxy.util.json import * from urllib import quote_plus, unquote_plus +from markupsafe import escape import logging log = logging.getLogger( __name__ ) @@ -16,7 +17,7 @@ titles = util.listify( titles ) JobId = util.restore_text( kwd.get( 'JobId', '' ) ) sample_id = util.restore_text( kwd.get( 'sample_id', '' ) ) - message = util.restore_text( kwd.get( 'message', '' ) ) + message = escape( util.restore_text( kwd.get( 'message', '' ) ) ) status = kwd.get( 'status', 'done' ) redirect_delay = trans.app.sequencer_actions_registry.redirect_delay sequencer_redirects = copy.deepcopy( trans.app.sequencer_actions_registry.sequencer_redirects ) @@ -144,7 +145,7 @@ titles = util.restore_text( kwd.get( 'titles', '' ) ) JobId = util.restore_text( kwd.get( 'JobId', '' ) ) sample_id = util.restore_text( kwd.get( 'sample_id', '' ) ) - message = util.restore_text( kwd.get( 'message', '' ) ) + message = escape( util.restore_text( kwd.get( 'message', '' ) ) ) status = kwd.get( 'status', 'done' ) url, http_method, request_params, response_type = request_tup url = unquote_plus( url ) diff -r bce30adc75e94c99fc8fd53f3dee75a26b6c8e86 -r daa0c69e837855af94d2255999e732f1fec87550 lib/galaxy/webapps/galaxy/controllers/admin.py --- a/lib/galaxy/webapps/galaxy/controllers/admin.py +++ b/lib/galaxy/webapps/galaxy/controllers/admin.py @@ -17,6 +17,7 @@ from galaxy.web.params import QuotaParamParser from tool_shed.util import common_util from tool_shed.util import encoding_util +from markupsafe import escape log = logging.getLogger( __name__ ) @@ -838,7 +839,7 @@ @web.expose @web.require_admin def review_tool_migration_stages( self, trans, **kwd ): - message = galaxy.util.restore_text( kwd.get( 'message', '' ) ) + message = escape( galaxy.util.restore_text( kwd.get( 'message', '' ) ) ) status = galaxy.util.restore_text( kwd.get( 'status', 'done' ) ) migration_stages_dict = odict() migration_modules = [] @@ -870,13 +871,13 @@ @web.expose @web.require_admin def view_datatypes_registry( self, trans, **kwd ): - message = galaxy.util.restore_text( kwd.get( 'message', '' ) ) + message = escape( galaxy.util.restore_text( kwd.get( 'message', '' ) ) ) status = galaxy.util.restore_text( kwd.get( 'status', 'done' ) ) return trans.fill_template( 'admin/view_datatypes_registry.mako', message=message, status=status ) @web.expose @web.require_admin def view_tool_data_tables( self, trans, **kwd ): - message = galaxy.util.restore_text( kwd.get( 'message', '' ) ) + message = escape( galaxy.util.restore_text( kwd.get( 'message', '' ) ) ) status = galaxy.util.restore_text( kwd.get( 'status', 'done' ) ) return trans.fill_template( 'admin/view_data_tables_registry.mako', message=message, status=status ) diff -r bce30adc75e94c99fc8fd53f3dee75a26b6c8e86 -r daa0c69e837855af94d2255999e732f1fec87550 lib/galaxy/webapps/galaxy/controllers/admin_toolshed.py --- a/lib/galaxy/webapps/galaxy/controllers/admin_toolshed.py +++ b/lib/galaxy/webapps/galaxy/controllers/admin_toolshed.py @@ -8,6 +8,7 @@ from galaxy.web.form_builder import CheckboxField from galaxy.util import json from galaxy.model.orm import or_ +from markupsafe import escape import tool_shed.repository_types.util as rt_util @@ -52,7 +53,7 @@ try: trans.app.installed_repository_manager.activate_repository( repository ) except Exception, e: - error_message = "Error activating repository %s: %s" % ( repository.name, str( e ) ) + error_message = "Error activating repository %s: %s" % ( escape( repository.name ), str( e ) ) log.exception( error_message ) message = '%s.<br/>You may be able to resolve this by uninstalling and then reinstalling the repository. Click <a href="%s">here</a> to uninstall the repository.' \ % ( error_message, web.url_for( controller='admin_toolshed', action='deactivate_or_uninstall_repository', id=trans.security.encode_id( repository.id ) ) ) @@ -62,7 +63,7 @@ id=repository_id, message=message, status=status ) ) - message = 'The <b>%s</b> repository has been activated.' % repository.name + message = 'The <b>%s</b> repository has been activated.' % escape( repository.name ) status = 'done' return trans.response.send_redirect( web.url_for( controller='admin_toolshed', action='browse_repositories', @@ -72,7 +73,7 @@ @web.expose @web.require_admin def browse_repository( self, trans, **kwd ): - message = kwd.get( 'message', '' ) + message = escape( kwd.get( 'message', '' ) ) status = kwd.get( 'status', 'done' ) repository = repository_util.get_installed_tool_shed_repository( trans.app, kwd[ 'id' ] ) return trans.fill_template( '/admin/tool_shed_repository/browse_repository.mako', @@ -141,7 +142,7 @@ action='reselect_tool_panel_section', **kwd ) ) else: - message = "Unable to get latest revision for repository <b>%s</b> from " % str( repository.name ) + message = "Unable to get latest revision for repository <b>%s</b> from " % escape( str( repository.name ) ) message += "the Tool Shed, so repository re-installation is not possible at this time." status = "error" return trans.response.send_redirect( web.url_for( controller='admin_toolshed', @@ -169,7 +170,7 @@ @web.expose @web.require_admin def browse_tool_dependency( self, trans, **kwd ): - message = kwd.get( 'message', '' ) + message = escape( kwd.get( 'message', '' ) ) status = kwd.get( 'status', 'done' ) tool_dependency_ids = tool_dependency_util.get_tool_dependency_ids( as_string=False, **kwd ) tool_dependency = tool_dependency_util.get_tool_dependency( trans.app, tool_dependency_ids[ 0 ] ) @@ -197,7 +198,7 @@ @web.expose @web.require_admin def browse_tool_sheds( self, trans, **kwd ): - message = kwd.get( 'message', '' ) + message = escape( kwd.get( 'message', '' ) ) status = kwd.get( 'status', 'done' ) return trans.fill_template( '/webapps/galaxy/admin/tool_sheds.mako', message=message, @@ -230,7 +231,7 @@ require the same entry. For now we'll never delete entries from config.shed_tool_data_table_config, but we may choose to do so in the future if it becomes necessary. """ - message = kwd.get( 'message', '' ) + message = escape( kwd.get( 'message', '' ) ) status = kwd.get( 'status', 'done' ) remove_from_disk = kwd.get( 'remove_from_disk', '' ) remove_from_disk_checked = CheckboxField.is_checked( remove_from_disk ) @@ -303,14 +304,14 @@ trans.install_model.context.add( tool_shed_repository ) trans.install_model.context.flush() if remove_from_disk_checked: - message = 'The repository named <b>%s</b> has been uninstalled. ' % tool_shed_repository.name + message = 'The repository named <b>%s</b> has been uninstalled. ' % escape( tool_shed_repository.name ) if errors: message += 'Attempting to uninstall tool dependencies resulted in errors: %s' % errors status = 'error' else: status = 'done' else: - message = 'The repository named <b>%s</b> has been deactivated. ' % tool_shed_repository.name + message = 'The repository named <b>%s</b> has been deactivated. ' % escape( tool_shed_repository.name ) status = 'done' return trans.response.send_redirect( web.url_for( controller='admin_toolshed', action='browse_repositories', @@ -442,7 +443,7 @@ @web.require_admin def import_workflow( self, trans, workflow_name, repository_id, **kwd ): """Import a workflow contained in an installed tool shed repository into Galaxy.""" - message = kwd.get( 'message', '' ) + message = escape( kwd.get( 'message', '' ) ) status = kwd.get( 'status', 'done' ) if workflow_name: workflow_name = encoding_util.tool_shed_decode( workflow_name ) @@ -453,7 +454,7 @@ workflow_name = encoding_util.tool_shed_encode( str( workflow.name ) ) else: message += 'Unable to locate a workflow named <b>%s</b> within the installed tool shed repository named <b>%s</b>' % \ - ( str( workflow_name ), str( repository.name ) ) + ( escape( str( workflow_name ) ), escape( str( repository.name ) ) ) status = 'error' else: message = 'Invalid repository id <b>%s</b> received.' % str( repository_id ) @@ -479,7 +480,7 @@ tool shed repository. """ # Get the tool_shed_repository from one of the tool_dependencies. - message = kwd.get( 'message', '' ) + message = escape( kwd.get( 'message', '' ) ) status = kwd.get( 'status', 'done' ) err_msg = '' tool_shed_repository = tool_dependencies[ 0 ].tool_shed_repository @@ -512,7 +513,7 @@ @web.require_admin def install_latest_repository_revision( self, trans, **kwd ): """Install the latest installable revision of a repository that has been previously installed.""" - message = kwd.get( 'message', '' ) + message = escape( kwd.get( 'message', '' ) ) status = kwd.get( 'status', 'done' ) repository_id = kwd.get( 'id', None ) if repository_id is not None: @@ -589,7 +590,7 @@ updating_to_changeset_revision = kwd.get( 'updating_to_changeset_revision', None ) updating_to_ctx_rev = kwd.get( 'updating_to_ctx_rev', None ) encoded_updated_metadata = kwd.get( 'encoded_updated_metadata', None ) - message = kwd.get( 'message', '' ) + message = escape( kwd.get( 'message', '' ) ) status = kwd.get( 'status', 'done' ) install_tool_dependencies = CheckboxField.is_checked( kwd.get( 'install_tool_dependencies', '' ) ) if 'install_tool_dependencies_with_update_button' in kwd: @@ -609,7 +610,7 @@ relative_install_dir, set_status=False ) message = "The installed repository named '%s' has been updated to change set revision '%s'. " % \ - ( str( repository.name ), updating_to_changeset_revision ) + ( escape( str( repository.name ) ), updating_to_changeset_revision ) self.initiate_tool_dependency_installation( trans, tool_dependencies, message=message, status=status ) # Handle tool dependencies check box. if trans.app.config.tool_dependency_dir is None: @@ -665,7 +666,7 @@ @web.expose @web.require_admin def manage_repositories( self, trans, **kwd ): - message = kwd.get( 'message', '' ) + message = escape( kwd.get( 'message', '' ) ) status = kwd.get( 'status', 'done' ) tsridslist = common_util.get_tool_shed_repository_ids( **kwd ) if 'operation' in kwd: @@ -744,7 +745,7 @@ @web.expose @web.require_admin def manage_repository( self, trans, **kwd ): - message = kwd.get( 'message', '' ) + message = escape( kwd.get( 'message', '' ) ) status = kwd.get( 'status', 'done' ) repository_id = kwd.get( 'id', None ) if repository_id is None: @@ -808,7 +809,7 @@ @web.expose @web.require_admin def manage_repository_tool_dependencies( self, trans, **kwd ): - message = kwd.get( 'message', '' ) + message = escape( kwd.get( 'message', '' ) ) status = kwd.get( 'status', 'done' ) tool_dependency_ids = tool_dependency_util.get_tool_dependency_ids( as_string=False, **kwd ) if tool_dependency_ids: @@ -890,7 +891,7 @@ def manage_tool_dependencies( self, trans, **kwd ): # This method is called when tool dependencies are being installed. See the related manage_repository_tool_dependencies # method for managing the tool dependencies for a specified installed tool shed repository. - message = kwd.get( 'message', '' ) + message = escape( kwd.get( 'message', '' ) ) status = kwd.get( 'status', 'done' ) tool_dependency_ids = tool_dependency_util.get_tool_dependency_ids( as_string=False, **kwd ) repository_id = kwd.get( 'repository_id', None ) @@ -902,7 +903,7 @@ # The user must be on the manage_repository_tool_dependencies page and clicked the button to either install or uninstall a # tool dependency, but they didn't check any of the available tool dependencies on which to perform the action. tool_shed_repository = suc.get_tool_shed_repository_by_id( trans.app, repository_id ) - self.tool_dependency_grid.title = "Tool shed repository '%s' tool dependencies" % tool_shed_repository.name + self.tool_dependency_grid.title = "Tool shed repository '%s' tool dependencies" % escape( tool_shed_repository.name ) if 'operation' in kwd: operation = kwd[ 'operation' ].lower() if not tool_dependency_ids: @@ -978,7 +979,7 @@ message += 'of Galaxy Tool Shed repository tools into a local Galaxy instance</a> section of the Galaxy Tool ' message += 'Shed wiki for all of the details.' return trans.show_error_message( message ) - message = kwd.get( 'message', '' ) + message = escape( kwd.get( 'message', '' ) ) status = kwd.get( 'status', 'done' ) shed_tool_conf = kwd.get( 'shed_tool_conf', None ) tool_shed_url = kwd.get( 'tool_shed_url', '' ) @@ -1030,7 +1031,7 @@ # The Tool Shed cannot handle the get_repository_id request, so the code must be older than the # 04/2014 Galaxy release when it was introduced. It will be safest to error out and let the # Tool Shed admin update the Tool Shed to a later release. - message = 'The updates available for the repository <b>%s</b> ' % str( repository.name ) + message = 'The updates available for the repository <b>%s</b> ' % escape( str( repository.name ) ) message += 'include newly defined repository or tool dependency definitions, and attempting ' message += 'to update the repository resulted in the following error. Contact the Tool Shed ' message += 'administrator if necessary.<br/>%s' % str( e ) @@ -1314,7 +1315,7 @@ and tool dependencies of the repository. """ rdim = repository_dependency_manager.RepositoryDependencyInstallManager( trans.app ) - message = kwd.get( 'message', '' ) + message = escape( kwd.get( 'message', '' ) ) status = kwd.get( 'status', 'done' ) repository_id = kwd[ 'id' ] tool_shed_repository = repository_util.get_installed_tool_shed_repository( trans.app, repository_id ) @@ -1450,7 +1451,7 @@ Inspect the repository dependency hierarchy for a specified repository and attempt to make sure they are all properly installed as well as each repository's tool dependencies. """ - message = kwd.get( 'message', '' ) + message = escape( kwd.get( 'message', '' ) ) status = kwd.get( 'status', 'done' ) repository_id = kwd.get( 'id', None ) if not repository_id: @@ -1648,12 +1649,12 @@ no_changes_check_box = CheckboxField( 'no_changes', checked=True ) if original_section_name: message += "The tools contained in your <b>%s</b> repository were last loaded into the tool panel section <b>%s</b>. " \ - % ( tool_shed_repository.name, original_section_name ) + % ( escape( tool_shed_repository.name ), original_section_name ) message += "Uncheck the <b>No changes</b> check box and select a different tool panel section to load the tools in a " message += "different section in the tool panel. " status = 'warning' else: - message += "The tools contained in your <b>%s</b> repository were last loaded into the tool panel outside of any sections. " % tool_shed_repository.name + message += "The tools contained in your <b>%s</b> repository were last loaded into the tool panel outside of any sections. " % escape( tool_shed_repository.name ) message += "Uncheck the <b>No changes</b> check box and select a tool panel section to load the tools into that section. " status = 'warning' else: @@ -1715,7 +1716,7 @@ if 'reset_metadata_on_selected_repositories_button' in kwd: message, status = irmm.reset_metadata_on_selected_repositories( trans.user, **kwd ) else: - message = kwd.get( 'message', '' ) + message = escape( kwd.get( 'message', '' ) ) status = kwd.get( 'status', 'done' ) repositories_select_field = irmm.build_repository_ids_select_field() return trans.fill_template( '/admin/tool_shed_repository/reset_metadata_on_selected_repositories.mako', @@ -1749,13 +1750,13 @@ irmm.update_in_shed_tool_config() trans.install_model.context.add( repository ) trans.install_model.context.flush() - message = 'Metadata has been reset on repository <b>%s</b>.' % repository.name + message = 'Metadata has been reset on repository <b>%s</b>.' % escape( repository.name ) status = 'done' else: - message = 'Metadata did not need to be reset on repository <b>%s</b>.' % repository.name + message = 'Metadata did not need to be reset on repository <b>%s</b>.' % escape( repository.name ) status = 'done' else: - message = 'Error locating installation directory for repository <b>%s</b>.' % repository.name + message = 'Error locating installation directory for repository <b>%s</b>.' % escape( repository.name ) status = 'error' return trans.response.send_redirect( web.url_for( controller='admin_toolshed', action='manage_repository', @@ -1777,7 +1778,7 @@ uninstalled=False, remove_from_disk=True ) new_kwd = {} - new_kwd[ 'message' ] = "You can now attempt to install the repository named <b>%s</b> again." % str( repository.name ) + new_kwd[ 'message' ] = "You can now attempt to install the repository named <b>%s</b> again." % escape( str( repository.name ) ) new_kwd[ 'status' ] = "done" return trans.response.send_redirect( web.url_for( controller='admin_toolshed', action='browse_repositories', @@ -1808,7 +1809,7 @@ message = "Tool versions have been set for all included tools." status = 'done' else: - message = "Version information for the tools included in the <b>%s</b> repository is missing. " % repository.name + message = "Version information for the tools included in the <b>%s</b> repository is missing. " % escape( repository.name ) message += "Reset all of this reppository's metadata in the tool shed, then set the installed tool versions " message ++ "from the installed repository's <b>Repository Actions</b> menu. " status = 'error' @@ -1852,7 +1853,7 @@ @web.expose @web.require_admin def uninstall_tool_dependencies( self, trans, **kwd ): - message = kwd.get( 'message', '' ) + message = escape( kwd.get( 'message', '' ) ) status = kwd.get( 'status', 'done' ) tool_dependency_ids = tool_dependency_util.get_tool_dependency_ids( as_string=False, **kwd ) if not tool_dependency_ids: @@ -1897,7 +1898,7 @@ @web.require_admin def update_to_changeset_revision( self, trans, **kwd ): """Update a cloned repository to the latest revision possible.""" - message = kwd.get( 'message', '' ) + message = escape( kwd.get( 'message', '' ) ) status = kwd.get( 'status', 'done' ) tool_shed_url = kwd.get( 'tool_shed_url', '' ) # Handle protocol changes over time. @@ -2070,7 +2071,7 @@ @web.expose @web.require_admin def update_tool_shed_status_for_installed_repository( self, trans, all_installed_repositories=False, **kwd ): - message = kwd.get( 'message', '' ) + message = escape( kwd.get( 'message', '' ) ) status = kwd.get( 'status', 'done' ) if all_installed_repositories: success_count = 0 @@ -2083,7 +2084,7 @@ if ok: success_count += 1 else: - repository_names_not_updated.append( '<b>%s</b>' % str( repository.name ) ) + repository_names_not_updated.append( '<b>%s</b>' % escape( str( repository.name ) ) ) if updated: updated_count += 1 message = "Checked the status in the tool shed for %d repositories. " % success_count @@ -2098,11 +2099,11 @@ repository_util.check_or_update_tool_shed_status_for_installed_repository( trans.app, repository ) if ok: if updated: - message = "The tool shed status for repository <b>%s</b> has been updated." % str( repository.name ) + message = "The tool shed status for repository <b>%s</b> has been updated." % escape( str( repository.name ) ) else: - message = "The status has not changed in the tool shed for repository <b>%s</b>." % str( repository.name ) + message = "The status has not changed in the tool shed for repository <b>%s</b>." % escape( str( repository.name ) ) else: - message = "Unable to retrieve status from the tool shed for repository <b>%s</b>." % str( repository.name ) + message = "Unable to retrieve status from the tool shed for repository <b>%s</b>." % escape( str( repository.name ) ) status = 'error' return trans.response.send_redirect( web.url_for( controller='admin_toolshed', action='browse_repositories', @@ -2112,7 +2113,7 @@ @web.expose @web.require_admin def view_tool_metadata( self, trans, repository_id, tool_id, **kwd ): - message = kwd.get( 'message', '' ) + message = escape( kwd.get( 'message', '' ) ) status = kwd.get( 'status', 'done' ) repository = repository_util.get_installed_tool_shed_repository( trans.app, repository_id ) repository_metadata = repository.metadata @@ -2146,7 +2147,7 @@ @web.require_admin def view_workflow( self, trans, workflow_name=None, repository_id=None, **kwd ): """Retrieve necessary information about a workflow from the database so that it can be displayed in an svg image.""" - message = kwd.get( 'message', '' ) + message = escape( kwd.get( 'message', '' ) ) status = kwd.get( 'status', 'done' ) if workflow_name: workflow_name = encoding_util.tool_shed_decode( workflow_name ) diff -r bce30adc75e94c99fc8fd53f3dee75a26b6c8e86 -r daa0c69e837855af94d2255999e732f1fec87550 lib/galaxy/webapps/galaxy/controllers/library_admin.py --- a/lib/galaxy/webapps/galaxy/controllers/library_admin.py +++ b/lib/galaxy/webapps/galaxy/controllers/library_admin.py @@ -5,8 +5,9 @@ from galaxy import web from galaxy.web.base.controller import BaseUIController -from galaxy.web.framework.helpers import escape, grids, time_ago +from galaxy.web.framework.helpers import grids, time_ago from library_common import get_comptypes, lucene_search, whoosh_search +from markupsafe import escape # from galaxy.model.orm import * log = logging.getLogger( __name__ ) @@ -148,7 +149,7 @@ @web.expose @web.require_admin def create_library( self, trans, **kwd ): - message = kwd.get( 'message', '' ) + message = escape( kwd.get( 'message', '' ) ) status = kwd.get( 'status', 'done' ) if kwd.get( 'create_library_button', False ): name = kwd.get( 'name', 'No name' ) @@ -161,12 +162,12 @@ library.root_folder = root_folder trans.sa_session.add_all( ( library, root_folder ) ) trans.sa_session.flush() - message = "The new library named '%s' has been created" % library.name + message = "The new library named '%s' has been created" return trans.response.send_redirect( web.url_for( controller='library_common', action='browse_library', cntrller='library_admin', id=trans.security.encode_id( library.id ), - message=message, + message=escape( message ), status='done' ) ) return trans.fill_template( '/admin/library/new_library.mako', message=escape( message ), status=escape( status ) ) @web.expose diff -r bce30adc75e94c99fc8fd53f3dee75a26b6c8e86 -r daa0c69e837855af94d2255999e732f1fec87550 lib/galaxy/webapps/galaxy/controllers/library_common.py --- a/lib/galaxy/webapps/galaxy/controllers/library_common.py +++ b/lib/galaxy/webapps/galaxy/controllers/library_common.py @@ -20,7 +20,7 @@ from galaxy.util.streamball import StreamBall from galaxy.web.base.controller import BaseUIController, UsesFormDefinitionsMixin, UsesExtendedMetadataMixin, UsesLibraryMixinItems from galaxy.web.form_builder import AddressField, CheckboxField, SelectField, build_select_field -from galaxy.web.framework.helpers import escape +from markupsafe import escape from galaxy.model.orm import and_, eagerload_all # Whoosh is compatible with Python 2.5+ Try to import Whoosh and set flag to indicate whether tool search is enabled. @@ -93,7 +93,7 @@ @web.expose def browse_library( self, trans, cntrller='library', **kwd ): - message = kwd.get( 'message', '' ) + message = escape( kwd.get( 'message', '' ) ) status = kwd.get( 'status', 'done' ) # If use_panels is True, the library is being accessed via an external link # which did not originate from within the Galaxy instance, and the library will @@ -121,7 +121,7 @@ hidden_folder_ids = util.listify( kwd.get( 'hidden_folder_ids', '' ) ) if created_ldda_ids and not message: message = "%d datasets are uploading in the background to the library '%s' (each is selected). " % \ - ( len( created_ldda_ids.split( ',' ) ), library.name ) + ( len( created_ldda_ids.split( ',' ) ), escape( library.name ) ) message += "Don't navigate away from Galaxy or use the browser's \"stop\" or \"reload\" buttons (on this tab) until the " message += "message \"This job is running\" is cleared from the \"Information\" column below for each selected dataset." status = "info" @@ -152,7 +152,7 @@ message=escape( message ), status=escape( status ) ) except Exception, e: - message = 'Error attempting to display contents of library (%s): %s.' % ( str( library.name ), str( e ) ) + message = 'Error attempting to display contents of library (%s): %s.' % ( escape( str( library.name ) ), str( e ) ) status = 'error' default_action = kwd.get( 'default_action', None ) @@ -165,7 +165,7 @@ @web.expose def library_info( self, trans, cntrller, **kwd ): - message = kwd.get( 'message', '' ) + message = escape( kwd.get( 'message', '' ) ) status = kwd.get( 'status', 'done' ) use_panels = util.string_as_bool( kwd.get( 'use_panels', False ) ) show_deleted = util.string_as_bool( kwd.get( 'show_deleted', False ) ) @@ -225,7 +225,7 @@ @web.expose def library_permissions( self, trans, cntrller, **kwd ): - message = kwd.get( 'message', '' ) + message = escape( kwd.get( 'message', '' ) ) status = kwd.get( 'status', 'done' ) use_panels = util.string_as_bool( kwd.get( 'use_panels', False ) ) show_deleted = util.string_as_bool( kwd.get( 'show_deleted', False ) ) @@ -272,7 +272,7 @@ @web.expose def create_folder( self, trans, cntrller, parent_id, library_id, **kwd ): - message = kwd.get( 'message', '' ) + message = escape( kwd.get( 'message', '' ) ) status = kwd.get( 'status', 'done' ) show_deleted = util.string_as_bool( kwd.get( 'show_deleted', False ) ) use_panels = util.string_as_bool( kwd.get( 'use_panels', False ) ) @@ -349,7 +349,7 @@ @web.expose def folder_info( self, trans, cntrller, id, library_id, **kwd ): - message = kwd.get( 'message', '' ) + message = escape( kwd.get( 'message', '' ) ) status = kwd.get( 'status', 'done' ) show_deleted = util.string_as_bool( kwd.get( 'show_deleted', False ) ) use_panels = util.string_as_bool( kwd.get( 'use_panels', False ) ) @@ -406,7 +406,7 @@ @web.expose def folder_permissions( self, trans, cntrller, id, library_id, **kwd ): - message = kwd.get( 'message', '' ) + message = escape( kwd.get( 'message', '' ) ) status = kwd.get( 'status', 'done' ) show_deleted = util.string_as_bool( kwd.get( 'show_deleted', False ) ) use_panels = util.string_as_bool( kwd.get( 'use_panels', False ) ) @@ -456,7 +456,7 @@ @web.expose def ldda_edit_info( self, trans, cntrller, library_id, folder_id, id, **kwd ): - message = kwd.get( 'message', '' ) + message = escape( kwd.get( 'message', '' ) ) status = kwd.get( 'status', 'done' ) show_deleted = util.string_as_bool( kwd.get( 'show_deleted', False ) ) use_panels = util.string_as_bool( kwd.get( 'use_panels', False ) ) @@ -511,7 +511,7 @@ old_name = ldda.name new_name = kwd.get( 'name', '' ) new_info = kwd.get( 'info', '' ) - new_message = kwd.get( 'message', '' ) + new_message = escape( kwd.get( 'message', '' ) ) if not new_name: message = 'Enter a valid name' status = 'error' @@ -609,7 +609,7 @@ @web.expose def ldda_info( self, trans, cntrller, library_id, folder_id, id, **kwd ): - message = kwd.get( 'message', '' ) + message = escape( kwd.get( 'message', '' ) ) status = kwd.get( 'status', 'done' ) show_deleted = util.string_as_bool( kwd.get( 'show_deleted', False ) ) show_associated_hdas_and_lddas = util.string_as_bool( kwd.get( 'show_associated_hdas_and_lddas', False ) ) @@ -658,7 +658,7 @@ @web.expose def ldda_permissions( self, trans, cntrller, library_id, folder_id, id, **kwd ): - message = kwd.get( 'message', '' ) + message = escape( kwd.get( 'message', '' ) ) status = kwd.get( 'status', 'done' ) show_deleted = util.string_as_bool( kwd.get( 'show_deleted', False ) ) use_panels = util.string_as_bool( kwd.get( 'use_panels', False ) ) @@ -796,9 +796,9 @@ @web.expose def upload_library_dataset( self, trans, cntrller, library_id, folder_id, **kwd ): - message = kwd.get( 'message', '' ) + message = escape( kwd.get( 'message', '' ) ) status = kwd.get( 'status', 'done' ) - ldda_message = kwd.get( 'ldda_message', '' ) + ldda_message = escape( kwd.get( 'ldda_message', '' ) ) deleted = util.string_as_bool( kwd.get( 'deleted', False ) ) show_deleted = util.string_as_bool( kwd.get( 'show_deleted', False ) ) use_panels = util.string_as_bool( kwd.get( 'use_panels', False ) ) @@ -1056,7 +1056,7 @@ dataset_upload_inputs.append( input ) # Library-specific params show_deleted = util.string_as_bool( kwd.get( 'show_deleted', False ) ) - message = kwd.get( 'message', '' ) + message = escape( kwd.get( 'message', '' ) ) status = kwd.get( 'status', 'done' ) server_dir = kwd.get( 'server_dir', '' ) if replace_dataset not in [ None, 'None' ]: @@ -1271,9 +1271,9 @@ @web.expose def add_history_datasets_to_library( self, trans, cntrller, library_id, folder_id, hda_ids='', **kwd ): - message = kwd.get( 'message', '' ) + message = escape( kwd.get( 'message', '' ) ) status = kwd.get( 'status', 'done' ) - ldda_message = kwd.get( 'ldda_message', '' ) + ldda_message = escape( kwd.get( 'ldda_message', '' ) ) show_deleted = kwd.get( 'show_deleted', False ) use_panels = util.string_as_bool( kwd.get( 'use_panels', False ) ) replace_id = kwd.get( 'replace_id', None ) @@ -1567,7 +1567,7 @@ @web.expose def library_dataset_info( self, trans, cntrller, id, library_id, **kwd ): - message = kwd.get( 'message', '' ) + message = escape( kwd.get( 'message', '' ) ) status = kwd.get( 'status', 'done' ) show_deleted = util.string_as_bool( kwd.get( 'show_deleted', False ) ) use_panels = util.string_as_bool( kwd.get( 'use_panels', False ) ) @@ -1616,7 +1616,7 @@ @web.expose def library_dataset_permissions( self, trans, cntrller, id, library_id, **kwd ): - message = kwd.get( 'message', '' ) + message = escape( kwd.get( 'message', '' ) ) status = kwd.get( 'status', 'done' ) show_deleted = util.string_as_bool( kwd.get( 'show_deleted', False ) ) use_panels = util.string_as_bool( kwd.get( 'use_panels', False ) ) @@ -1664,7 +1664,7 @@ @web.expose def make_library_item_public( self, trans, cntrller, library_id, item_type, id, **kwd ): - message = kwd.get( 'message', '' ) + message = escape( kwd.get( 'message', '' ) ) status = kwd.get( 'status', 'done' ) show_deleted = util.string_as_bool( kwd.get( 'show_deleted', False ) ) use_panels = util.string_as_bool( kwd.get( 'use_panels', False ) ) @@ -1726,7 +1726,7 @@ rval += '%s %i %s%s %s\r\n' % ( crc, size, self.url_base, quoted_fname, relpath ) return rval # Perform an action on a list of library datasets. - message = kwd.get( 'message', '' ) + message = escape( kwd.get( 'message', '' ) ) status = kwd.get( 'status', 'done' ) show_deleted = util.string_as_bool( kwd.get( 'show_deleted', False ) ) use_panels = util.string_as_bool( kwd.get( 'use_panels', False ) ) @@ -2002,7 +2002,7 @@ # - a select list option for acting on multiple selected datasets within a library # ( ldda_ids is a comma separated string of ldda ids ) # - a menu option for a library dataset search result set ( ldda_ids is a comma separated string of ldda ids ) - message = kwd.get( 'message', '' ) + message = escape( kwd.get( 'message', '' ) ) status = kwd.get( 'status', 'done' ) show_deleted = util.string_as_bool( kwd.get( 'show_deleted', False ) ) use_panels = util.string_as_bool( kwd.get( 'use_panels', False ) ) @@ -2126,7 +2126,7 @@ def manage_template_inheritance( self, trans, cntrller, item_type, library_id, folder_id=None, ldda_id=None, **kwd ): show_deleted = util.string_as_bool( kwd.get( 'show_deleted', False ) ) use_panels = util.string_as_bool( kwd.get( 'use_panels', False ) ) - message = kwd.get( 'message', '' ) + message = escape( kwd.get( 'message', '' ) ) status = kwd.get( 'status', 'done' ) is_admin = ( trans.user_is_admin() and cntrller == 'library_admin' ) current_user_roles = trans.get_current_user_roles() @@ -2177,7 +2177,7 @@ # 'ldda' and item_id is a comma separated string of ldda ids ) # - a menu option for a library dataset search result set ( item_type is 'ldda' and item_id is a # comma separated string of ldda ids ) - message = kwd.get( 'message', '' ) + message = escape( kwd.get( 'message', '' ) ) status = kwd.get( 'status', 'done' ) show_deleted = util.string_as_bool( kwd.get( 'show_deleted', False ) ) use_panels = util.string_as_bool( kwd.get( 'use_panels', False ) ) @@ -2760,7 +2760,7 @@ def lucene_search( trans, cntrller, search_term, search_url, **kwd ): """Return display of results from a full-text lucene search of data libraries.""" - message = kwd.get( 'message', '' ) + message = escape( kwd.get( 'message', '' ) ) status = kwd.get( 'status', 'done' ) full_url = "%s/find?%s" % ( search_url, urllib.urlencode( { "kwd" : search_term } ) ) response = urllib2.urlopen( full_url ) @@ -2771,7 +2771,7 @@ def whoosh_search( trans, cntrller, search_term, **kwd ): """Return display of results from a full-text whoosh search of data libraries.""" - message = kwd.get( 'message', '' ) + message = escape( kwd.get( 'message', '' ) ) status = kwd.get( 'status', 'done' ) ok = True if whoosh_search_enabled: diff -r bce30adc75e94c99fc8fd53f3dee75a26b6c8e86 -r daa0c69e837855af94d2255999e732f1fec87550 lib/galaxy/webapps/galaxy/controllers/user.py --- a/lib/galaxy/webapps/galaxy/controllers/user.py +++ b/lib/galaxy/webapps/galaxy/controllers/user.py @@ -29,6 +29,8 @@ UsesFormDefinitionsMixin) from galaxy.web.form_builder import build_select_field, CheckboxField from galaxy.web.framework.helpers import escape, grids, time_ago +from galaxy.web.framework.helpers import time_ago, grids +from markupsafe import escape log = logging.getLogger( __name__ ) @@ -252,7 +254,7 @@ if not trans.app.config.enable_openid: return trans.show_error_message( 'OpenID authentication is not enabled in this instance of Galaxy' ) use_panels = util.string_as_bool( kwd.get( 'use_panels', False ) ) - message = kwd.get( 'message', '' ) + message = escape( kwd.get( 'message', '' ) ) status = kwd.get( 'status', 'done' ) email = kwd.get( 'email', '' ) username = kwd.get( 'username', '' ) @@ -498,7 +500,7 @@ def __validate_login( self, trans, **kwd ): """Validates numerous cases that might happen during the login time.""" - message = kwd.get( 'message', '' ) + message = escape( kwd.get( 'message', '' ) ) status = kwd.get( 'status', 'error' ) email = kwd.get( 'email', '' ) password = kwd.get( 'password', '' ) @@ -713,7 +715,7 @@ email = util.restore_text( kwd.get( 'email', '' ) ) password = kwd.get( 'password', '' ) username = util.restore_text( kwd.get( 'username', '' ) ) - message = kwd.get( 'message', '' ) + message = escape( kwd.get( 'message', '' ) ) status = kwd.get( 'status', 'done' ) is_admin = cntrller == 'admin' and trans.user_is_admin() user = self.create_user( trans=trans, email=email, username=username, password=password ) @@ -1107,7 +1109,7 @@ """Reset the user's password. Send an email with the new password.""" if trans.app.config.smtp_server is None: return trans.show_error_message( "Mail is not configured for this Galaxy instance. Please contact your local Galaxy administrator." ) - message = util.sanitize_text(util.restore_text( kwd.get( 'message', '' ) )) + message = util.sanitize_text( util.restore_text( kwd.get( 'message', '' ) ) ) status = kwd.get( 'status', 'done' ) if kwd.get( 'reset_password_button', False ): reset_user = trans.sa_session.query( trans.app.model.User ).filter( trans.app.model.User.table.c.email == email ).first() diff -r bce30adc75e94c99fc8fd53f3dee75a26b6c8e86 -r daa0c69e837855af94d2255999e732f1fec87550 lib/galaxy/webapps/galaxy/controllers/workflow.py --- a/lib/galaxy/webapps/galaxy/controllers/workflow.py +++ b/lib/galaxy/webapps/galaxy/controllers/workflow.py @@ -22,7 +22,7 @@ from galaxy.web import error, url_for from galaxy.web.base.controller import BaseUIController, SharableMixin, UsesStoredWorkflowMixin from galaxy.web.framework.formbuilder import form -from galaxy.web.framework.helpers import grids, time_ago, to_unicode, escape +from galaxy.web.framework.helpers import grids, time_ago, to_unicode from galaxy.workflow.modules import WorkflowModuleInjector from galaxy.workflow.modules import MissingToolException from galaxy.workflow.modules import module_factory, is_tool_module_type @@ -37,6 +37,7 @@ order_workflow_steps_with_levels, ) from galaxy.workflow.render import WorkflowCanvas, MARGIN, LINE_SPACING +from markupsafe import escape class StoredWorkflowListGrid( grids.Grid ): @@ -1021,7 +1022,7 @@ """ url = kwd.get( 'url', '' ) workflow_text = kwd.get( 'workflow_text', '' ) - message = kwd.get( 'message', '' ) + message = escape( kwd.get( 'message', '' ) ) status = kwd.get( 'status', 'done' ) import_button = kwd.get( 'import_button', False ) # The special Galaxy integration landing page's URL on myExperiment diff -r bce30adc75e94c99fc8fd53f3dee75a26b6c8e86 -r daa0c69e837855af94d2255999e732f1fec87550 lib/galaxy/webapps/reports/controllers/users.py --- a/lib/galaxy/webapps/reports/controllers/users.py +++ b/lib/galaxy/webapps/reports/controllers/users.py @@ -9,17 +9,19 @@ pkg_resources.require( "SQLAlchemy >= 0.4" ) import sqlalchemy as sa import logging +from markupsafe import escape + log = logging.getLogger( __name__ ) class Users( BaseUIController ): @web.expose def registered_users( self, trans, **kwd ): - message = util.restore_text( kwd.get( 'message', '' ) ) + message = escape( util.restore_text( kwd.get( 'message', '' ) ) ) num_users = trans.sa_session.query( galaxy.model.User ).count() return trans.fill_template( '/webapps/reports/registered_users.mako', num_users=num_users, message=message ) @web.expose def registered_users_per_month( self, trans, **kwd ): - message = util.restore_text( kwd.get( 'message', '' ) ) + message = escape( util.restore_text( kwd.get( 'message', '' ) ) ) q = sa.select( ( sa.func.date_trunc( 'month', sa.func.date( galaxy.model.User.table.c.create_time ) ).label( 'date' ), sa.func.count( galaxy.model.User.table.c.id ).label( 'num_users' ) ), from_obj = [ galaxy.model.User.table ], @@ -36,7 +38,7 @@ message=message ) @web.expose def specified_month( self, trans, **kwd ): - message = util.restore_text( kwd.get( 'message', '' ) ) + message = escape( util.restore_text( kwd.get( 'message', '' ) ) ) # If specified_date is not received, we'll default to the current month specified_date = kwd.get( 'specified_date', datetime.utcnow().strftime( "%Y-%m-%d" ) ) specified_month = specified_date[ :7 ] @@ -66,7 +68,7 @@ message=message ) @web.expose def specified_date( self, trans, **kwd ): - message = util.restore_text( kwd.get( 'message', '' ) ) + message = escape( util.restore_text( kwd.get( 'message', '' ) ) ) # If specified_date is not received, we'll default to the current month specified_date = kwd.get( 'specified_date', datetime.utcnow().strftime( "%Y-%m-%d" ) ) year, month, day = map( int, specified_date.split( "-" ) ) @@ -95,7 +97,7 @@ message=message ) @web.expose def last_access_date( self, trans, **kwd ): - message = util.restore_text( kwd.get( 'message', '' ) ) + message = escape( util.restore_text( kwd.get( 'message', '' ) ) ) not_logged_in_for_days = kwd.get( 'not_logged_in_for_days', 90 ) if not not_logged_in_for_days: not_logged_in_for_days = 0 @@ -120,7 +122,7 @@ @web.expose def user_disk_usage( self, trans, **kwd ): - message = util.restore_text( kwd.get( 'message', '' ) ) + message = escape( util.restore_text( kwd.get( 'message', '' ) ) ) user_cutoff = int( kwd.get( 'user_cutoff', 60 ) ) # disk_usage isn't indexed users = sorted( trans.sa_session.query( galaxy.model.User ).all(), key=operator.attrgetter( 'disk_usage' ), reverse=True ) diff -r bce30adc75e94c99fc8fd53f3dee75a26b6c8e86 -r daa0c69e837855af94d2255999e732f1fec87550 lib/galaxy/webapps/tool_shed/controllers/admin.py --- a/lib/galaxy/webapps/tool_shed/controllers/admin.py +++ b/lib/galaxy/webapps/tool_shed/controllers/admin.py @@ -3,6 +3,7 @@ from galaxy import util from galaxy.util import inflector from galaxy import web +from markupsafe import escape from galaxy.web.base.controller import BaseUIController from galaxy.web.base.controllers.admin import Admin @@ -121,7 +122,7 @@ @web.expose @web.require_admin def create_category( self, trans, **kwd ): - message = kwd.get( 'message', '' ) + message = escape( kwd.get( 'message', '' ) ) status = kwd.get( 'status', 'done' ) name = kwd.get( 'name', '' ).strip() description = kwd.get( 'description', '' ).strip() @@ -154,7 +155,7 @@ @web.expose @web.require_admin def delete_repository( self, trans, **kwd ): - message = kwd.get( 'message', '' ) + message = escape( kwd.get( 'message', '' ) ) status = kwd.get( 'status', 'done' ) id = kwd.get( 'id', None ) if id: @@ -197,7 +198,7 @@ @web.expose @web.require_admin def delete_repository_metadata( self, trans, **kwd ): - message = kwd.get( 'message', '' ) + message = escape( kwd.get( 'message', '' ) ) status = kwd.get( 'status', 'done' ) id = kwd.get( 'id', None ) if id: @@ -221,7 +222,7 @@ @web.expose @web.require_admin def edit_category( self, trans, **kwd ): - message = kwd.get( 'message', '' ) + message = escape( kwd.get( 'message', '' ) ) status = kwd.get( 'status', 'done' ) id = kwd.get( 'id', None ) if not id: @@ -306,7 +307,7 @@ @web.expose @web.require_admin def regenerate_statistics( self, trans, **kwd ): - message = kwd.get( 'message', '' ) + message = escape( kwd.get( 'message', '' ) ) status = kwd.get( 'status', 'done' ) if 'regenerate_statistics_button' in kwd: trans.app.shed_counter.generate_statistics() @@ -352,7 +353,7 @@ if 'reset_metadata_on_selected_repositories_button' in kwd: message, status = rmm.reset_metadata_on_selected_repositories( **kwd ) else: - message = util.restore_text( kwd.get( 'message', '' ) ) + message = escape( util.restore_text( kwd.get( 'message', '' ) ) ) status = kwd.get( 'status', 'done' ) repositories_select_field = rmm.build_repository_ids_select_field( name='repository_ids', multiple=True, @@ -366,7 +367,7 @@ @web.expose @web.require_admin def undelete_repository( self, trans, **kwd ): - message = kwd.get( 'message', '' ) + message = escape( kwd.get( 'message', '' ) ) status = kwd.get( 'status', 'done' ) id = kwd.get( 'id', None ) if id: @@ -417,7 +418,7 @@ # TODO: We should probably eliminate the Category.deleted column since it really makes no # sense to mark a category as deleted (category names and descriptions can be changed instead). # If we do this, and the following 2 methods can be eliminated. - message = kwd.get( 'message', '' ) + message = escape( kwd.get( 'message', '' ) ) status = kwd.get( 'status', 'done' ) id = kwd.get( 'id', None ) if id: @@ -445,7 +446,7 @@ # This method should only be called for a Category that has previously been deleted. # Purging a deleted Category deletes all of the following from the database: # - RepoitoryCategoryAssociations where category_id == Category.id - message = kwd.get( 'message', '' ) + message = escape( kwd.get( 'message', '' ) ) status = kwd.get( 'status', 'done' ) id = kwd.get( 'id', None ) if id: @@ -473,7 +474,7 @@ @web.expose @web.require_admin def undelete_category( self, trans, **kwd ): - message = kwd.get( 'message', '' ) + message = escape( kwd.get( 'message', '' ) ) status = kwd.get( 'status', 'done' ) id = kwd.get( 'id', None ) if id: diff -r bce30adc75e94c99fc8fd53f3dee75a26b6c8e86 -r daa0c69e837855af94d2255999e732f1fec87550 lib/galaxy/webapps/tool_shed/controllers/repository.py --- a/lib/galaxy/webapps/tool_shed/controllers/repository.py +++ b/lib/galaxy/webapps/tool_shed/controllers/repository.py @@ -6,6 +6,7 @@ from time import strftime from datetime import date from datetime import datetime +from markupsafe import escape from galaxy import util from galaxy import web @@ -385,7 +386,7 @@ action='reviewed_repositories_i_own' ) ) elif operation == "repositories_by_category": category_id = kwd.get( 'id', None ) - message = kwd.get( 'message', '' ) + message = escape( kwd.get( 'message', '' ) ) status = kwd.get( 'status', 'done' ) return trans.response.send_redirect( web.url_for( controller='repository', action='browse_repositories_in_category', @@ -721,9 +722,9 @@ @web.expose def browse_repository( self, trans, id, **kwd ): - message = kwd.get( 'message', '' ) + message = escape( kwd.get( 'message', '' ) ) status = kwd.get( 'status', 'done' ) - commit_message = kwd.get( 'commit_message', 'Deleted selected files' ) + commit_message = escape( kwd.get( 'commit_message', 'Deleted selected files' ) ) repository = suc.get_repository_in_tool_shed( trans.app, id ) repo = hg_util.get_repo_for_repository( trans.app, repository=repository, repo_path=None, create=False ) # Update repository files for browsing. @@ -891,7 +892,7 @@ @web.expose def check_for_updates( self, trans, **kwd ): """Handle a request from a local Galaxy instance.""" - message = kwd.get( 'message', '' ) + message = escape( kwd.get( 'message', '' ) ) status = kwd.get( 'status', 'done' ) # If the request originated with the UpdateRepositoryManager, it will not include a galaxy_url. galaxy_url = common_util.handle_galaxy_url( trans, **kwd ) @@ -976,7 +977,7 @@ @web.expose def contact_owner( self, trans, id, **kwd ): - message = kwd.get( 'message', '' ) + message = escape( kwd.get( 'message', '' ) ) status = kwd.get( 'status', 'done' ) repository = suc.get_repository_in_tool_shed( trans.app, id ) metadata = metadata_util.get_repository_metadata_by_repository_id_changeset_revision( trans.app, @@ -995,7 +996,7 @@ @web.expose def create_galaxy_docker_image( self, trans, **kwd ): - message = kwd.get( 'message', '' ) + message = escape( kwd.get( 'message', '' ) ) status = kwd.get( 'status', 'done' ) repository_ids = util.listify( kwd.get( 'id', '' ) ) if 'operation' in kwd: @@ -1051,7 +1052,7 @@ @web.expose def create_repository( self, trans, **kwd ): - message = kwd.get( 'message', '' ) + message = escape( kwd.get( 'message', '' ) ) status = kwd.get( 'status', 'done' ) categories = suc.get_categories( trans ) if not categories: @@ -1108,7 +1109,7 @@ # Marking a repository in the tool shed as deprecated has no effect on any downloadable changeset # revisions that may be associated with the repository. Revisions are not marked as not downlaodable # because those that have installed the repository must be allowed to get updates. - message = kwd.get( 'message', '' ) + message = escape( kwd.get( 'message', '' ) ) status = kwd.get( 'status', 'done' ) repository_id = kwd.get( 'id', None ) repository = suc.get_repository_in_tool_shed( trans.app, repository_id ) @@ -1164,7 +1165,7 @@ @web.expose def display_tool( self, trans, repository_id, tool_config, changeset_revision, **kwd ): - message = kwd.get( 'message', '' ) + message = escape( kwd.get( 'message', '' ) ) status = kwd.get( 'status', 'done' ) render_repository_actions_for = kwd.get( 'render_repository_actions_for', 'tool_shed' ) tv = tool_validator.ToolValidator( trans.app ) @@ -1229,7 +1230,7 @@ @web.expose def export( self, trans, repository_id, changeset_revision, **kwd ): - message = kwd.get( 'message', '' ) + message = escape( kwd.get( 'message', '' ) ) status = kwd.get( 'status', 'done' ) export_repository_dependencies = kwd.get( 'export_repository_dependencies', '' ) repository = suc.get_repository_in_tool_shed( trans.app, repository_id ) @@ -1309,7 +1310,7 @@ @web.expose def find_tools( self, trans, **kwd ): - message = kwd.get( 'message', '' ) + message = escape( kwd.get( 'message', '' ) ) status = kwd.get( 'status', 'done' ) galaxy_url = common_util.handle_galaxy_url( trans, **kwd ) if 'operation' in kwd: @@ -1400,7 +1401,7 @@ @web.expose def find_workflows( self, trans, **kwd ): - message = kwd.get( 'message', '' ) + message = escape( kwd.get( 'message', '' ) ) status = kwd.get( 'status', 'done' ) galaxy_url = common_util.handle_galaxy_url( trans, **kwd ) if 'operation' in kwd: @@ -2020,13 +2021,13 @@ @web.expose def help( self, trans, **kwd ): - message = kwd.get( 'message', '' ) + message = escape( kwd.get( 'message', '' ) ) status = kwd.get( 'status', 'done' ) return trans.fill_template( '/webapps/tool_shed/repository/help.mako', message=message, status=status, **kwd ) @web.expose def import_capsule( self, trans, **kwd ): - message = kwd.get( 'message', '' ) + message = escape( kwd.get( 'message', '' ) ) status = kwd.get( 'status', 'done' ) capsule_file_name = kwd.get( 'capsule_file_name', None ) encoded_file_path = kwd.get( 'encoded_file_path', None ) @@ -2069,7 +2070,7 @@ @web.expose def index( self, trans, **kwd ): - message = kwd.get( 'message', '' ) + message = escape( kwd.get( 'message', '' ) ) status = kwd.get( 'status', 'done' ) # See if there are any RepositoryMetadata records since menu items require them. repository_metadata = trans.sa_session.query( trans.model.RepositoryMetadata ).first() @@ -2151,7 +2152,7 @@ @web.expose def load_invalid_tool( self, trans, repository_id, tool_config, changeset_revision, **kwd ): - message = kwd.get( 'message', '' ) + message = escape( kwd.get( 'message', '' ) ) status = kwd.get( 'status', 'error' ) render_repository_actions_for = kwd.get( 'render_repository_actions_for', 'tool_shed' ) tv = tool_validator.ToolValidator( trans.app ) @@ -2203,7 +2204,7 @@ @web.expose @web.require_login( "manage email alerts" ) def manage_email_alerts( self, trans, **kwd ): - message = kwd.get( 'message', '' ) + message = escape( kwd.get( 'message', '' ) ) status = kwd.get( 'status', 'done' ) new_repo_alert = kwd.get( 'new_repo_alert', '' ) new_repo_alert_checked = CheckboxField.is_checked( new_repo_alert ) @@ -2234,7 +2235,7 @@ @web.expose @web.require_login( "manage repository" ) def manage_repository( self, trans, id, **kwd ): - message = kwd.get( 'message', '' ) + message = escape( kwd.get( 'message', '' ) ) status = kwd.get( 'status', 'done' ) repository = suc.get_repository_in_tool_shed( trans.app, id ) repository_type = kwd.get( 'repository_type', str( repository.type ) ) @@ -2500,7 +2501,7 @@ @web.expose @web.require_login( "manage repository administrators" ) def manage_repository_admins( self, trans, id, **kwd ): - message = kwd.get( 'message', '' ) + message = escape( kwd.get( 'message', '' ) ) status = kwd.get( 'status', 'done' ) repository = suc.get_repository_in_tool_shed( trans.app, id ) changeset_revision = kwd.get( 'changeset_revision', repository.tip( trans.app ) ) @@ -2558,7 +2559,7 @@ @web.expose @web.require_login( "multi select email alerts" ) def multi_select_email_alerts( self, trans, **kwd ): - message = kwd.get( 'message', '' ) + message = escape( kwd.get( 'message', '' ) ) status = kwd.get( 'status', 'done' ) if 'operation' in kwd: operation = kwd[ 'operation' ].lower() @@ -2607,7 +2608,7 @@ @web.expose def preview_tools_in_changeset( self, trans, repository_id, **kwd ): - message = kwd.get( 'message', '' ) + message = escape( kwd.get( 'message', '' ) ) status = kwd.get( 'status', 'done' ) repository = suc.get_repository_in_tool_shed( trans.app, repository_id ) repo = hg_util.get_repo_for_repository( trans.app, repository=repository, repo_path=None, create=False ) @@ -2714,7 +2715,7 @@ @web.require_login( "rate repositories" ) def rate_repository( self, trans, **kwd ): """ Rate a repository and return updated rating data. """ - message = kwd.get( 'message', '' ) + message = escape( kwd.get( 'message', '' ) ) status = kwd.get( 'status', 'done' ) id = kwd.get( 'id', None ) if not id: @@ -2787,7 +2788,7 @@ if 'reset_metadata_on_selected_repositories_button' in kwd: message, status = rmm.reset_metadata_on_selected_repositories( **kwd ) else: - message = kwd.get( 'message', '' ) + message = escape( kwd.get( 'message', '' ) ) status = kwd.get( 'status', 'done' ) repositories_select_field = rmm.build_repository_ids_select_field( name='repository_ids', multiple=True, @@ -2800,9 +2801,9 @@ @web.expose def select_files_to_delete( self, trans, id, **kwd ): - message = kwd.get( 'message', '' ) + message = escape( kwd.get( 'message', '' ) ) status = kwd.get( 'status', 'done' ) - commit_message = kwd.get( 'commit_message', 'Deleted selected files' ) + commit_message = escape( kwd.get( 'commit_message', 'Deleted selected files' ) ) repository = suc.get_repository_in_tool_shed( trans.app, id ) repo_dir = repository.repo_path( trans.app ) repo = hg_util.get_repo_for_repository( trans.app, repository=None, repo_path=repo_dir, create=False ) @@ -3145,7 +3146,7 @@ @web.expose def upload_capsule( self, trans, **kwd ): - message = kwd.get( 'message', '' ) + message = escape( kwd.get( 'message', '' ) ) status = kwd.get( 'status', 'done' ) url = kwd.get( 'url', '' ) if 'upload_capsule_button' in kwd: @@ -3175,7 +3176,7 @@ @web.expose def view_changelog( self, trans, id, **kwd ): - message = kwd.get( 'message', '' ) + message = escape( kwd.get( 'message', '' ) ) status = kwd.get( 'status', 'done' ) repository = suc.get_repository_in_tool_shed( trans.app, id ) repo = hg_util.get_repo_for_repository( trans.app, repository=repository, repo_path=None, create=False ) @@ -3210,7 +3211,7 @@ @web.expose def view_changeset( self, trans, id, ctx_str, **kwd ): - message = kwd.get( 'message', '' ) + message = escape( kwd.get( 'message', '' ) ) status = kwd.get( 'status', 'done' ) repository = suc.get_repository_in_tool_shed( trans.app, id ) repo = hg_util.get_repo_for_repository( trans.app, repository=repository, repo_path=None, create=False ) @@ -3302,7 +3303,7 @@ @web.expose def view_repository( self, trans, id, **kwd ): - message = kwd.get( 'message', '' ) + message = escape( kwd.get( 'message', '' ) ) status = kwd.get( 'status', 'done' ) repository = suc.get_repository_in_tool_shed( trans.app, id ) repo = hg_util.get_repo_for_repository( trans.app, repository=repository, repo_path=None, create=False ) @@ -3390,7 +3391,7 @@ @web.expose def view_tool_metadata( self, trans, repository_id, changeset_revision, tool_id, **kwd ): - message = kwd.get( 'message', '' ) + message = escape( kwd.get( 'message', '' ) ) status = kwd.get( 'status', 'done' ) render_repository_actions_for = kwd.get( 'render_repository_actions_for', 'tool_shed' ) repository = suc.get_repository_in_tool_shed( trans.app, repository_id ) @@ -3471,7 +3472,7 @@ @web.expose def view_workflow( self, trans, workflow_name, repository_metadata_id, **kwd ): """Retrieve necessary information about a workflow from the database so that it can be displayed in an svg image.""" - message = kwd.get( 'message', '' ) + message = escape( kwd.get( 'message', '' ) ) status = kwd.get( 'status', 'done' ) render_repository_actions_for = kwd.get( 'render_repository_actions_for', 'tool_shed' ) if workflow_name: diff -r bce30adc75e94c99fc8fd53f3dee75a26b6c8e86 -r daa0c69e837855af94d2255999e732f1fec87550 lib/galaxy/webapps/tool_shed/controllers/repository_review.py --- a/lib/galaxy/webapps/tool_shed/controllers/repository_review.py +++ b/lib/galaxy/webapps/tool_shed/controllers/repository_review.py @@ -2,6 +2,7 @@ import os from sqlalchemy.sql.expression import func +from markupsafe import escape from galaxy import util from galaxy import web @@ -40,7 +41,7 @@ @web.require_login( "approve repository review" ) def approve_repository_review( self, trans, **kwd ): # The value of the received id is the encoded review id. - message = kwd.get( 'message', '' ) + message = escape( kwd.get( 'message', '' ) ) status = kwd.get( 'status', 'done' ) encoded_review_id = kwd[ 'id' ] review = review_util.get_review( trans.app, encoded_review_id ) @@ -74,7 +75,7 @@ @web.expose @web.require_login( "browse review" ) def browse_review( self, trans, **kwd ): - message = kwd.get( 'message', '' ) + message = escape( kwd.get( 'message', '' ) ) status = kwd.get( 'status', 'done' ) review = review_util.get_review( trans.app, kwd[ 'id' ] ) repository = review.repository @@ -105,7 +106,7 @@ @web.expose @web.require_login( "create component" ) def create_component( self, trans, **kwd ): - message = kwd.get( 'message', '' ) + message = escape( kwd.get( 'message', '' ) ) status = kwd.get( 'status', 'done' ) name = kwd.get( 'name', '' ) description = kwd.get( 'description', '' ) @@ -136,7 +137,7 @@ @web.require_login( "create review" ) def create_review( self, trans, **kwd ): # The value of the received id is the encoded repository id. - message = kwd.get( 'message', '' ) + message = escape( kwd.get( 'message', '' ) ) status = kwd.get( 'status', 'done' ) repository_id = kwd.get( 'id', None ) changeset_revision = kwd.get( 'changeset_revision', None ) @@ -201,7 +202,7 @@ @web.expose @web.require_login( "edit component" ) def edit_component( self, trans, **kwd ): - message = kwd.get( 'message', '' ) + message = escape( kwd.get( 'message', '' ) ) status = kwd.get( 'status', 'done' ) id = kwd.get( 'id', None ) if not id: @@ -232,7 +233,7 @@ @web.require_login( "edit review" ) def edit_review( self, trans, **kwd ): # The value of the received id is the encoded review id. - message = kwd.get( 'message', '' ) + message = escape( kwd.get( 'message', '' ) ) status = kwd.get( 'status', 'done' ) review_id = kwd.get( 'id', None ) review = review_util.get_review( trans.app, review_id ) @@ -408,7 +409,7 @@ @web.require_login( "manage repositories reviewed by me" ) def manage_repositories_reviewed_by_me( self, trans, **kwd ): # The value of the received id is the encoded repository id. - message = kwd.get( 'message', '' ) + message = escape( kwd.get( 'message', '' ) ) status = kwd.get( 'status', 'done' ) if 'operation' in kwd: kwd[ 'mine' ] = True @@ -475,7 +476,7 @@ @web.require_login( "manage repository reviews" ) def manage_repository_reviews( self, trans, mine=False, **kwd ): # The value of the received id is the encoded repository id. - message = kwd.get( 'message', '' ) + message = escape( kwd.get( 'message', '' ) ) status = kwd.get( 'status', 'done' ) repository_id = kwd.get( 'id', None ) if repository_id: @@ -524,7 +525,7 @@ @web.require_login( "manage repository reviews of revision" ) def manage_repository_reviews_of_revision( self, trans, **kwd ): # The value of the received id is the encoded repository id. - message = kwd.get( 'message', '' ) + message = escape( kwd.get( 'message', '' ) ) status = kwd.get( 'status', 'done' ) repository_id = kwd.get( 'id', None ) changeset_revision = kwd.get( 'changeset_revision', None ) @@ -547,7 +548,7 @@ @web.expose @web.require_login( "repository reviews by user" ) def repository_reviews_by_user( self, trans, **kwd ): - message = kwd.get( 'message', '' ) + message = escape( kwd.get( 'message', '' ) ) status = kwd.get( 'status', 'done' ) if 'operation' in kwd: @@ -573,7 +574,7 @@ @web.expose @web.require_login( "reviewed repositories i own" ) def reviewed_repositories_i_own( self, trans, **kwd ): - message = kwd.get( 'message', '' ) + message = escape( kwd.get( 'message', '' ) ) status = kwd.get( 'status', 'done' ) # The value of the received id is the encoded repository id. if 'operation' in kwd: @@ -592,7 +593,7 @@ @web.require_login( "select previous review" ) def select_previous_review( self, trans, **kwd ): # The value of the received id is the encoded repository id. - message = kwd.get( 'message', '' ) + message = escape( kwd.get( 'message', '' ) ) status = kwd.get( 'status', 'done' ) repository = suc.get_repository_in_tool_shed( trans.app, kwd[ 'id' ] ) changeset_revision = kwd.get( 'changeset_revision', None ) diff -r bce30adc75e94c99fc8fd53f3dee75a26b6c8e86 -r daa0c69e837855af94d2255999e732f1fec87550 lib/galaxy/webapps/tool_shed/controllers/upload.py --- a/lib/galaxy/webapps/tool_shed/controllers/upload.py +++ b/lib/galaxy/webapps/tool_shed/controllers/upload.py @@ -9,6 +9,7 @@ from galaxy import web from galaxy.datatypes import checkers from galaxy.web.base.controller import BaseUIController +from markupsafe import escape from tool_shed.dependencies import attribute_handlers from tool_shed.galaxy_install import dependency_display @@ -35,9 +36,9 @@ @web.expose @web.require_login( 'upload', use_panels=True ) def upload( self, trans, **kwd ): - message = kwd.get( 'message', '' ) + message = escape( kwd.get( 'message', '' ) ) status = kwd.get( 'status', 'done' ) - commit_message = kwd.get( 'commit_message', 'Uploaded' ) + commit_message = escape( kwd.get( 'commit_message', 'Uploaded' ) ) category_ids = util.listify( kwd.get( 'category_id', '' ) ) categories = suc.get_categories( trans.app ) repository_id = kwd.get( 'repository_id', '' ) diff -r bce30adc75e94c99fc8fd53f3dee75a26b6c8e86 -r daa0c69e837855af94d2255999e732f1fec87550 lib/tool_shed/util/repository_util.py --- a/lib/tool_shed/util/repository_util.py +++ b/lib/tool_shed/util/repository_util.py @@ -7,6 +7,7 @@ from galaxy import web from galaxy.web.form_builder import build_select_field from galaxy.webapps.tool_shed.model import directory_hash_id +from markupsafe import escape from tool_shed.dependencies.repository import relation_builder @@ -256,7 +257,7 @@ def handle_role_associations( app, role, repository, **kwd ): sa_session = app.model.context.current - message = kwd.get( 'message', '' ) + message = escape( kwd.get( 'message', '' ) ) status = kwd.get( 'status', 'done' ) repository_owner = repository.user if kwd.get( 'manage_role_associations_button', False ): diff -r bce30adc75e94c99fc8fd53f3dee75a26b6c8e86 -r daa0c69e837855af94d2255999e732f1fec87550 templates/admin/dataset_security/group/group.mako --- a/templates/admin/dataset_security/group/group.mako +++ b/templates/admin/dataset_security/group/group.mako @@ -11,9 +11,9 @@ </%def><%def name="render_select( name, options )"> - <select name="${name}" id="${name}" style="min-width: 250px; height: 150px;" multiple> + <select name="${name|h}" id="${name|h}" style="min-width: 250px; height: 150px;" multiple> %for option in options: - <option value="${option[0]}">${option[1]}</option> + <option value="${option[0]|h}">${option[1]|h}</option> %endfor </select></%def> @@ -48,29 +48,29 @@ %endif <div class="toolForm"> - <div class="toolFormTitle">Group '${group.name}'</div> + <div class="toolFormTitle">Group '${group.name|h}'</div><div class="toolFormBody"><form name="associate_group_role_user" id="associate_group_role_user" action="${h.url_for(controller='admin', action='manage_users_and_roles_for_group', id=trans.security.encode_id( group.id ) )}" method="post" ><div class="form-row"><div style="float: left; margin-right: 10px;"> - <label>Roles associated with '${group.name}'</label> + <label>Roles associated with '${group.name|h}'</label> ${render_select( "in_roles", in_roles )}<br/><input type="submit" id="roles_remove_button" value=">>"/></div><div> - <label>Roles not associated with '${group.name}'</label> + <label>Roles not associated with '${group.name|h}'</label> ${render_select( "out_roles", out_roles )}<br/><input type="submit" id="roles_add_button" value="<<"/></div></div><div class="form-row"><div style="float: left; margin-right: 10px;"> - <label>Users associated with '${group.name}'</label> + <label>Users associated with '${group.name|h}'</label> ${render_select( "in_users", in_users )}<br/><input type="submit" id="users_remove_button" value=">>"/></div><div> - <label>Users not associated with '${group.name}'</label> + <label>Users not associated with '${group.name|h}'</label> ${render_select( "out_users", out_users )}<br/><input type="submit" id="users_add_button" value="<<"/></div> diff -r bce30adc75e94c99fc8fd53f3dee75a26b6c8e86 -r daa0c69e837855af94d2255999e732f1fec87550 templates/admin/dataset_security/group/group_create.mako --- a/templates/admin/dataset_security/group/group_create.mako +++ b/templates/admin/dataset_security/group/group_create.mako @@ -11,9 +11,9 @@ </%def><%def name="render_select( name, options )"> - <select name="${name}" id="${name}" style="min-width: 250px; height: 150px;" multiple> + <select name="${name|h}" id="${name|h}" style="min-width: 250px; height: 150px;" multiple> %for option in options: - <option value="${option[0]}">${option[1]}</option> + <option value="${option[0]|h}">${option[1]|h}</option> %endfor </select></%def> @@ -60,7 +60,7 @@ <form name="associate_group_role_user" id="associate_group_role_user" action="${h.url_for(controller='admin', action='create_group' )}" method="post" ><div class="form-row"><label>Name:</label> - <input name="name" type="textfield" value="${name}" size=40"/> + <input name="name" type="textfield" value="${name|h}" size=40"/></div><div class="form-row"><div style="float: left; margin-right: 10px;"> diff -r bce30adc75e94c99fc8fd53f3dee75a26b6c8e86 -r daa0c69e837855af94d2255999e732f1fec87550 templates/admin/dataset_security/group/group_rename.mako --- a/templates/admin/dataset_security/group/group_rename.mako +++ b/templates/admin/dataset_security/group/group_rename.mako @@ -12,7 +12,7 @@ <div class="form-row"><label>Name:</label><div style="float: left; width: 250px; margin-right: 10px;"> - <input type="text" name="name" value="${group.name}" size="40"/> + <input type="text" name="name" value="${group.name|h}" size="40"/></div><div style="clear: both"></div></div> diff -r bce30adc75e94c99fc8fd53f3dee75a26b6c8e86 -r daa0c69e837855af94d2255999e732f1fec87550 templates/admin/dataset_security/role/role.mako --- a/templates/admin/dataset_security/role/role.mako +++ b/templates/admin/dataset_security/role/role.mako @@ -11,9 +11,9 @@ </%def><%def name="render_select( name, options )"> - <select name="${name}" id="${name}" style="min-width: 250px; height: 150px;" multiple> + <select name="${name|h}" id="${name|h}" style="min-width: 250px; height: 150px;" multiple> %for option in options: - <option value="${option[0]}">${option[1]}</option> + <option value="${option[0]|h}">${option[1]|h}</option> %endfor </select></%def> @@ -48,29 +48,29 @@ %endif <div class="toolForm"> - <div class="toolFormTitle">Role '${role.name}'</div> + <div class="toolFormTitle">Role '${role.name|h}'</div><div class="toolFormBody"><form name="associate_role_user_group" id="associate_role_user_group" action="${h.url_for(controller='admin', action='manage_users_and_groups_for_role', id=trans.security.encode_id( role.id ) )}" method="post" ><div class="form-row"><div style="float: left; margin-right: 10px;"> - <label>Users associated with '${role.name}'</label> + <label>Users associated with '${role.name|h}'</label> ${render_select( "in_users", in_users )}<br/><input type="submit" id="users_remove_button" value=">>"/></div><div> - <label>Users not associated with '${role.name}'</label> + <label>Users not associated with '${role.name|h}'</label> ${render_select( "out_users", out_users )}<br/><input type="submit" id="users_add_button" value="<<"/></div></div><div class="form-row"><div style="float: left; margin-right: 10px;"> - <label>Groups associated with '${role.name}'</label> + <label>Groups associated with '${role.name|h}'</label> ${render_select( "in_groups", in_groups )}<br/><input type="submit" id="groups_remove_button" value=">>"/></div><div> - <label>Groups not associated with '${role.name}'</label> + <label>Groups not associated with '${role.name|h}'</label> ${render_select( "out_groups", out_groups )}<br/><input type="submit" id="groups_add_button" value="<<"/></div> @@ -84,7 +84,7 @@ <br clear="left"/><br/> %if len( library_dataset_actions ) > 0: - <h3>Data library datasets associated with role '${role.name}'</h3> + <h3>Data library datasets associated with role '${role.name|h}'</h3><table class="manage-table colored" border="0" cellspacing="0" cellpadding="0" width="100%"><tr><td> @@ -92,16 +92,16 @@ %for ctr, library, in enumerate( library_dataset_actions.keys() ): <li><img src="${h.url_for( '/static/images/silk/book_open.png' )}" class="rowIcon"/> - ${library.name} + ${library.name|h} <ul> %for folder_path, permissions in library_dataset_actions[ library ].items(): <li><img src="/static/images/silk/folder_page.png" class="rowIcon"/> - ${folder_path} + ${folder_path|h} <ul> % for permission in permissions: <ul> - <li>${permission}</li> + <li>${permission|h}</li></ul> %endfor </ul> diff -r bce30adc75e94c99fc8fd53f3dee75a26b6c8e86 -r daa0c69e837855af94d2255999e732f1fec87550 templates/admin/dataset_security/role/role_create.mako --- a/templates/admin/dataset_security/role/role_create.mako +++ b/templates/admin/dataset_security/role/role_create.mako @@ -11,9 +11,9 @@ </%def><%def name="render_select( name, options )"> - <select name="${name}" id="${name}" style="min-width: 250px; height: 150px;" multiple> + <select name="${name|h}" id="${name|h}" style="min-width: 250px; height: 150px;" multiple> %for option in options: - <option value="${option[0]}">${option[1]}</option> + <option value="${option[0]|h}">${option[1]|h}</option> %endfor </select></%def> @@ -60,11 +60,11 @@ <form name="associate_role_group_user" id="associate_role_group_user" action="${h.url_for(controller='admin', action='create_role' )}" method="post" ><div class="form-row"><label>Name:</label> - <input name="name" type="textfield" value="${name}" size=40"/> + <input name="name" type="textfield" value="${name|h}" size=40"/></div><div class="form-row"><label>Description:</label> - <input name="description" type="textfield" value="${description}" size=40"/> + <input name="description" type="textfield" value="${description|h}" size=40"/></div><div class="form-row"><div style="float: left; margin-right: 10px;"> diff -r bce30adc75e94c99fc8fd53f3dee75a26b6c8e86 -r daa0c69e837855af94d2255999e732f1fec87550 templates/admin/dataset_security/role/role_rename.mako --- a/templates/admin/dataset_security/role/role_rename.mako +++ b/templates/admin/dataset_security/role/role_rename.mako @@ -12,14 +12,14 @@ <div class="form-row"><label>Name:</label><div style="float: left; width: 250px; margin-right: 10px;"> - <input type="text" name="name" value="${role.name}" size="40"/> + <input type="text" name="name" value="${role.name|h}" size="40"/></div><div style="clear: both"></div></div><div class="form-row"><label>Description:</label><div style="float: left; width: 250px; margin-right: 10px;"> - <input name="description" type="textfield" value="${role.description}" size=40"/> + <input name="description" type="textfield" value="${role.description|h}" size=40"/></div><div style="clear: both"></div></div> diff -r bce30adc75e94c99fc8fd53f3dee75a26b6c8e86 -r daa0c69e837855af94d2255999e732f1fec87550 templates/admin/external_service/create_external_service.mako --- a/templates/admin/external_service/create_external_service.mako +++ b/templates/admin/external_service/create_external_service.mako @@ -12,10 +12,10 @@ %if widgets: %for i, field in enumerate( widgets ): <div class="form-row"> - <label>${field['label']}:</label> + <label>${field['label']|h}:</label> ${field['widget'].get_html()} <div class="toolParamHelp" style="clear: both;"> - ${field['helptext']} + ${field['helptext']|h} </div><div style="clear: both"></div></div> diff -r bce30adc75e94c99fc8fd53f3dee75a26b6c8e86 -r daa0c69e837855af94d2255999e732f1fec87550 templates/admin/external_service/edit_external_service.mako --- a/templates/admin/external_service/edit_external_service.mako +++ b/templates/admin/external_service/edit_external_service.mako @@ -25,10 +25,10 @@ <div class="toolFormTitle">Edit external service</div> %for i, field in enumerate( widgets ): <div class="form-row"> - <label>${field['label']}:</label> + <label>${field['label']|h}:</label> ${field['widget'].get_html()} <div class="toolParamHelp" style="clear: both;"> - ${field['helptext']} + ${field['helptext']|h} </div><div style="clear: both"></div></div> diff -r bce30adc75e94c99fc8fd53f3dee75a26b6c8e86 -r daa0c69e837855af94d2255999e732f1fec87550 templates/admin/jobs.mako --- a/templates/admin/jobs.mako +++ b/templates/admin/jobs.mako @@ -63,12 +63,12 @@ </td><td>${job.id}</td> %if job.history and job.history.user: - <td>${job.history.user.email}</td> + <td>${job.history.user.email|h}</td> %else: <td>anonymous</td> %endif <td>${last_updated[job.id]} ago</td> - <td>${job.tool_id}</td> + <td>${job.tool_id|h}</td><td>${job.state}</td><% try: @@ -77,8 +77,8 @@ inputs = 'Unable to determine inputs' %><td>${inputs}</td> - <td>${job.command_line}</td> - <td>${job.job_runner_name}</td> + <td>${job.command_line|h}</td> + <td>${job.job_runner_name|h}</td><td>${job.job_runner_external_id}</td></tr> %endfor @@ -131,12 +131,12 @@ %for job in recent_jobs: <td><a href="${h.url_for( controller="admin", action="job_info" )}?jobid=${job.id}">${job.id}</a></td> %if job.history and job.history.user: - <td>${job.history.user.email}</td> + <td>${job.history.user.email|h}</td> %else: <td>anonymous</td> %endif <td>${finished[job.id]} ago</td> - <td>${job.tool_id}</td> + <td>${job.tool_id|h}</td><td>${job.state}</td><% try: @@ -145,9 +145,9 @@ inputs = 'Unable to determine inputs' %><td>${inputs}</td> - <td>${job.command_line}</td> - <td>${job.job_runner_name}</td> - <td>${job.job_runner_external_id}</td> + <td>${job.command_line|h}</td> + <td>${job.job_runner_name|h}</td> + <td>${job.job_runner_external_id|h}</td></tr> %endfor </table> diff -r bce30adc75e94c99fc8fd53f3dee75a26b6c8e86 -r daa0c69e837855af94d2255999e732f1fec87550 templates/admin/memdump.mako --- a/templates/admin/memdump.mako +++ b/templates/admin/memdump.mako @@ -55,7 +55,7 @@ <br/> You are here: ${breadcrumb}<br/> %if breadcrumb.endswith( 'theone' ): - ${heap} + ${heap|h} %else: <nobr> Sort: diff -r bce30adc75e94c99fc8fd53f3dee75a26b6c8e86 -r daa0c69e837855af94d2255999e732f1fec87550 templates/admin/package_tool.mako --- a/templates/admin/package_tool.mako +++ b/templates/admin/package_tool.mako @@ -28,9 +28,9 @@ <select name="tool_id"> %for key, val in toolbox.tool_panel.items(): %if isinstance( val, Tool ): - <option value="${val.id}">${val.name}</option> + <option value="${val.id|h}">${val.name|h}</option> %elif isinstance( val, ToolSection ): - <optgroup label="${val.name}"> + <optgroup label="${val.name|h}"><% section = val %> %for section_key, section_val in section.elems.items(): %if isinstance( section_val, Tool ): @@ -38,7 +38,7 @@ %if section_val.id == tool_id: <% selected_str = " selected=\"selected\"" %> %endif - <option value="${section_val.id}"${selected_str}>${section_val.name}</option> + <option value="${section_val.id|h}"${selected_str}>${section_val.name|h}</option> %endif %endfor %endif diff -r bce30adc75e94c99fc8fd53f3dee75a26b6c8e86 -r daa0c69e837855af94d2255999e732f1fec87550 templates/admin/quota/quota.mako --- a/templates/admin/quota/quota.mako +++ b/templates/admin/quota/quota.mako @@ -11,9 +11,9 @@ </%def><%def name="render_select( name, options )"> - <select name="${name}" id="${name}" style="min-width: 250px; height: 150px;" multiple> + <select name="${name|h}" id="${name|h}" style="min-width: 250px; height: 150px;" multiple> %for option in options: - <option value="${option[0]}">${option[1]}</option> + <option value="${option[0]|h}">${option[1]|h}</option> %endfor </select></%def> @@ -48,29 +48,29 @@ %endif <div class="toolForm"> - <div class="toolFormTitle">Quota '${name}'</div> + <div class="toolFormTitle">Quota '${name|h}'</div><div class="toolFormBody"><form name="associate_quota_user_group" id="associate_quota_user_group" action="${h.url_for(controller='admin', action='manage_users_and_groups_for_quota', id=id )}" method="post" ><div class="form-row"><div style="float: left; margin-right: 10px;"> - <label>Users associated with '${name}'</label> + <label>Users associated with '${name|h}'</label> ${render_select( "in_users", in_users )}<br/><input type="submit" id="users_remove_button" value=">>"/></div><div> - <label>Users not associated with '${name}'</label> + <label>Users not associated with '${name|h}'</label> ${render_select( "out_users", out_users )}<br/><input type="submit" id="users_add_button" value="<<"/></div></div><div class="form-row"><div style="float: left; margin-right: 10px;"> - <label>Groups associated with '${name}'</label> + <label>Groups associated with '${name|h}'</label> ${render_select( "in_groups", in_groups )}<br/><input type="submit" id="groups_remove_button" value=">>"/></div><div> - <label>Groups not associated with '${name}'</label> + <label>Groups not associated with '${name|h}'</label> ${render_select( "out_groups", out_groups )}<br/><input type="submit" id="groups_add_button" value="<<"/></div> diff -r bce30adc75e94c99fc8fd53f3dee75a26b6c8e86 -r daa0c69e837855af94d2255999e732f1fec87550 templates/admin/quota/quota_create.mako --- a/templates/admin/quota/quota_create.mako +++ b/templates/admin/quota/quota_create.mako @@ -11,9 +11,9 @@ </%def><%def name="render_select( name, options )"> - <select name="${name}" id="${name}" style="min-width: 250px; height: 150px;" multiple> + <select name="${name|h}" id="${name|h}" style="min-width: 250px; height: 150px;" multiple> %for option in options: - <option value="${option[0]}">${option[1]}</option> + <option value="${option[0]|h}">${option[1]|h}</option> %endfor </select></%def> @@ -69,15 +69,15 @@ <form name="associate_quota_group_user" id="associate_quota_group_user" action="${h.url_for(controller='admin', action='create_quota' )}" method="post" ><div class="form-row"><label>Name:</label> - <input name="name" type="textfield" value="${name}" size=40"/> + <input name="name" type="textfield" value="${name|h}" size=40"/></div><div class="form-row"><label>Description:</label> - <input name="description" type="textfield" value="${description}" size=40"/> + <input name="description" type="textfield" value="${description|h}" size=40"/></div><div class="form-row"><label>Amount</label> - <input name="amount" type="textfield" value="${amount}" size=40"/> + <input name="amount" type="textfield" value="${amount|h}" size=40"/><div class="toolParamHelp" style="clear: both;"> Examples: "10000MB", "99 gb", "0.2T", "unlimited" </div> diff -r bce30adc75e94c99fc8fd53f3dee75a26b6c8e86 -r daa0c69e837855af94d2255999e732f1fec87550 templates/admin/quota/quota_edit.mako --- a/templates/admin/quota/quota_edit.mako +++ b/templates/admin/quota/quota_edit.mako @@ -29,7 +29,7 @@ <input name="id" type="hidden" value="${id}"/><div class="form-row"><label>Amount</label> - <input name="amount" type="textfield" value="${display_amount}" size=40"/> + <input name="amount" type="textfield" value="${display_amount|h}" size=40"/><div class="toolParamHelp" style="clear: both;"> Examples: "10000MB", "99 gb", "0.2T", "unlimited" </div> diff -r bce30adc75e94c99fc8fd53f3dee75a26b6c8e86 -r daa0c69e837855af94d2255999e732f1fec87550 templates/admin/quota/quota_rename.mako --- a/templates/admin/quota/quota_rename.mako +++ b/templates/admin/quota/quota_rename.mako @@ -21,14 +21,14 @@ <div class="form-row"><label>Name:</label><div style="float: left; width: 250px; margin-right: 10px;"> - <input type="text" name="name" value="${name}" size="40"/> + <input type="text" name="name" value="${name|h}" size="40"/></div><div style="clear: both"></div></div><div class="form-row"><label>Description:</label><div style="float: left; width: 250px; margin-right: 10px;"> - <input name="description" type="textfield" value="${description}" size=40"/> + <input name="description" type="textfield" value="${description|h}" size=40"/></div><div style="clear: both"></div></div> diff -r bce30adc75e94c99fc8fd53f3dee75a26b6c8e86 -r daa0c69e837855af94d2255999e732f1fec87550 templates/admin/reload_tool.mako --- a/templates/admin/reload_tool.mako +++ b/templates/admin/reload_tool.mako @@ -28,9 +28,9 @@ <select name="tool_id"> %for key, val in toolbox.tool_panel.items(): %if isinstance( val, Tool ): - <option value="${val.id}">${val.name}</option> + <option value="${val.id}">${val.name|h}</option> %elif isinstance( val, ToolSection ): - <optgroup label="${val.name}"> + <optgroup label="${val.name|h}"><% section = val %> %for section_key, section_val in section.elems.items(): %if isinstance( section_val, Tool ): @@ -38,7 +38,7 @@ %if section_val.id == tool_id: <% selected_str = " selected=\"selected\"" %> %endif - <option value="${section_val.id}"${selected_str}>${section_val.name}</option> + <option value="${section_val.id}"${selected_str}>${section_val.name|h}</option> %endif %endfor %endif diff -r bce30adc75e94c99fc8fd53f3dee75a26b6c8e86 -r daa0c69e837855af94d2255999e732f1fec87550 templates/admin/review_tool_migration_stages.mako --- a/templates/admin/review_tool_migration_stages.mako +++ b/templates/admin/review_tool_migration_stages.mako @@ -4,7 +4,9 @@ %if message: ${render_msg( message, status )} %endif - +<% +from markupsafe import escape +%><div class="toolForm"><div class="toolFormTitle">Tool migrations that can be performed on this Galaxy instance</div><div class="toolFormBody"> @@ -51,7 +53,7 @@ repository_names.sort() repository_names = ', '.join( repository_names ) %> - <tr><td bgcolor="#D8D8D8"><b>Tool migration stage ${stage} - repositories: ${repository_names}</b></td></tr> + <tr><td bgcolor="#D8D8D8"><b>Tool migration stage ${stage} - repositories: ${repository_names|h}</b></td></tr><tr><td bgcolor="#FFFFCC"><div class="form-row"> @@ -59,11 +61,11 @@ <p> %if tool_dependencies: This migration stage includes tools that have tool dependencies that can be automatically installed. To install them, run:<br/> - <b>${install_dependencies}</b><br/><br/> + <b>${install_dependencies|h}</b><br/><br/> To skip tool dependency installation run:<br/> - <b>${migration_command}</b> + <b>${migration_command|h}</b> %else: - <b>${migration_command}</b> + <b>${migration_command|h}</b> %endif </p></div> @@ -74,7 +76,7 @@ <tr><td bgcolor="#DADFEF"><div class="form-row"> - <b>Repository:</b> ${repository_name} + <b>Repository:</b> ${repository_name|h} </div></td></tr> @@ -88,10 +90,10 @@ </tr> %for tool_dependencies_tup in tool_dependencies: <% - tool_dependency_name = tool_dependencies_tup[0] - tool_dependency_version = tool_dependencies_tup[1] - tool_dependency_type = tool_dependencies_tup[2] - installation_requirements = tool_dependencies_tup[3].replace( '\n', '<br/>' ) + tool_dependency_name = escape( tool_dependencies_tup[0] ) + tool_dependency_version = escape( tool_dependencies_tup[1] ) + tool_dependency_type = escape( tool_dependencies_tup[2] ) + installation_requirements = escape( tool_dependencies_tup[3] ).replace( '\n', '<br/>' ) %><tr><td> diff -r bce30adc75e94c99fc8fd53f3dee75a26b6c8e86 -r daa0c69e837855af94d2255999e732f1fec87550 templates/admin/tool_shed_repository/browse_repository.mako --- a/templates/admin/tool_shed_repository/browse_repository.mako +++ b/templates/admin/tool_shed_repository/browse_repository.mako @@ -21,7 +21,7 @@ %endif <div class="toolForm"> - <div class="toolFormTitle">Browse ${repository.name} revision ${repository.changeset_revision} files</div> + <div class="toolFormTitle">Browse ${repository.name|h} revision ${repository.changeset_revision} files</div><div class="toolFormBody"><div class="form-row" ><label>Contents:</label> This diff is so big that we needed to truncate the remainder. https://bitbucket.org/galaxy/galaxy-central/commits/72143d1079be/ Changeset: 72143d1079be User: davebgx Date: 2014-12-11 19:20:21+00:00 Summary: Merge next-stable changes to default. Affected #: 67 files diff -r 2dc383cbb700f9d8d6a30eb976b70e8dcf1832db -r 72143d1079be191695e7ce2171926e891795bd7a .hgtags --- a/.hgtags +++ b/.hgtags @@ -20,4 +20,4 @@ ca45b78adb4152fc6e7395514d46eba6b7d0b838 release_2014.08.11 548ab24667d6206780237bd807f7d857a484c461 latest_2014.08.11 2092948937ac30ef82f71463a235c66d34987088 release_2014.10.06 -782cf1a1f6b56f8a9c0b3e5e9ffd29fd93b16ce3 latest_2014.10.06 +212e1d5e9be5a9a1e12c834bd545de504753c9fe latest_2014.10.06 diff -r 2dc383cbb700f9d8d6a30eb976b70e8dcf1832db -r 72143d1079be191695e7ce2171926e891795bd7a lib/galaxy/web/base/controllers/admin.py --- a/lib/galaxy/web/base/controllers/admin.py +++ b/lib/galaxy/web/base/controllers/admin.py @@ -7,6 +7,7 @@ from galaxy.web.form_builder import CheckboxField from string import punctuation as PUNCTUATION import galaxy.queue_worker +from markupsafe import escape from tool_shed.util import shed_util_common as suc @@ -28,7 +29,7 @@ @web.expose @web.require_admin def index( self, trans, **kwd ): - message = kwd.get( 'message', '' ) + message = escape( kwd.get( 'message', '' ) ) status = kwd.get( 'status', 'done' ) if trans.webapp.name == 'galaxy': installed_repositories = trans.install_model.context.query( trans.install_model.ToolShedRepository ).first() @@ -46,7 +47,7 @@ @web.expose @web.require_admin def center( self, trans, **kwd ): - message = kwd.get( 'message', '' ) + message = escape( kwd.get( 'message', '' ) ) status = kwd.get( 'status', 'done' ) if trans.webapp.name == 'galaxy': return trans.fill_template( '/webapps/galaxy/admin/center.mako', diff -r 2dc383cbb700f9d8d6a30eb976b70e8dcf1832db -r 72143d1079be191695e7ce2171926e891795bd7a lib/galaxy/webapps/demo_sequencer/controllers/common.py --- a/lib/galaxy/webapps/demo_sequencer/controllers/common.py +++ b/lib/galaxy/webapps/demo_sequencer/controllers/common.py @@ -4,6 +4,7 @@ import time, socket, urllib, urllib2, base64, copy from galaxy.util.json import * from urllib import quote_plus, unquote_plus +from markupsafe import escape import logging log = logging.getLogger( __name__ ) @@ -16,7 +17,7 @@ titles = util.listify( titles ) JobId = util.restore_text( kwd.get( 'JobId', '' ) ) sample_id = util.restore_text( kwd.get( 'sample_id', '' ) ) - message = util.restore_text( kwd.get( 'message', '' ) ) + message = escape( util.restore_text( kwd.get( 'message', '' ) ) ) status = kwd.get( 'status', 'done' ) redirect_delay = trans.app.sequencer_actions_registry.redirect_delay sequencer_redirects = copy.deepcopy( trans.app.sequencer_actions_registry.sequencer_redirects ) @@ -144,7 +145,7 @@ titles = util.restore_text( kwd.get( 'titles', '' ) ) JobId = util.restore_text( kwd.get( 'JobId', '' ) ) sample_id = util.restore_text( kwd.get( 'sample_id', '' ) ) - message = util.restore_text( kwd.get( 'message', '' ) ) + message = escape( util.restore_text( kwd.get( 'message', '' ) ) ) status = kwd.get( 'status', 'done' ) url, http_method, request_params, response_type = request_tup url = unquote_plus( url ) diff -r 2dc383cbb700f9d8d6a30eb976b70e8dcf1832db -r 72143d1079be191695e7ce2171926e891795bd7a lib/galaxy/webapps/galaxy/controllers/admin.py --- a/lib/galaxy/webapps/galaxy/controllers/admin.py +++ b/lib/galaxy/webapps/galaxy/controllers/admin.py @@ -17,6 +17,7 @@ from galaxy.web.params import QuotaParamParser from tool_shed.util import common_util from tool_shed.util import encoding_util +from markupsafe import escape log = logging.getLogger( __name__ ) @@ -838,7 +839,7 @@ @web.expose @web.require_admin def review_tool_migration_stages( self, trans, **kwd ): - message = galaxy.util.restore_text( kwd.get( 'message', '' ) ) + message = escape( galaxy.util.restore_text( kwd.get( 'message', '' ) ) ) status = galaxy.util.restore_text( kwd.get( 'status', 'done' ) ) migration_stages_dict = odict() migration_modules = [] @@ -870,13 +871,13 @@ @web.expose @web.require_admin def view_datatypes_registry( self, trans, **kwd ): - message = galaxy.util.restore_text( kwd.get( 'message', '' ) ) + message = escape( galaxy.util.restore_text( kwd.get( 'message', '' ) ) ) status = galaxy.util.restore_text( kwd.get( 'status', 'done' ) ) return trans.fill_template( 'admin/view_datatypes_registry.mako', message=message, status=status ) @web.expose @web.require_admin def view_tool_data_tables( self, trans, **kwd ): - message = galaxy.util.restore_text( kwd.get( 'message', '' ) ) + message = escape( galaxy.util.restore_text( kwd.get( 'message', '' ) ) ) status = galaxy.util.restore_text( kwd.get( 'status', 'done' ) ) return trans.fill_template( 'admin/view_data_tables_registry.mako', message=message, status=status ) diff -r 2dc383cbb700f9d8d6a30eb976b70e8dcf1832db -r 72143d1079be191695e7ce2171926e891795bd7a lib/galaxy/webapps/galaxy/controllers/admin_toolshed.py --- a/lib/galaxy/webapps/galaxy/controllers/admin_toolshed.py +++ b/lib/galaxy/webapps/galaxy/controllers/admin_toolshed.py @@ -8,6 +8,7 @@ from galaxy.web.form_builder import CheckboxField from galaxy.util import json from galaxy.model.orm import or_ +from markupsafe import escape import tool_shed.repository_types.util as rt_util @@ -52,7 +53,7 @@ try: trans.app.installed_repository_manager.activate_repository( repository ) except Exception, e: - error_message = "Error activating repository %s: %s" % ( repository.name, str( e ) ) + error_message = "Error activating repository %s: %s" % ( escape( repository.name ), str( e ) ) log.exception( error_message ) message = '%s.<br/>You may be able to resolve this by uninstalling and then reinstalling the repository. Click <a href="%s">here</a> to uninstall the repository.' \ % ( error_message, web.url_for( controller='admin_toolshed', action='deactivate_or_uninstall_repository', id=trans.security.encode_id( repository.id ) ) ) @@ -62,7 +63,7 @@ id=repository_id, message=message, status=status ) ) - message = 'The <b>%s</b> repository has been activated.' % repository.name + message = 'The <b>%s</b> repository has been activated.' % escape( repository.name ) status = 'done' return trans.response.send_redirect( web.url_for( controller='admin_toolshed', action='browse_repositories', @@ -72,7 +73,7 @@ @web.expose @web.require_admin def browse_repository( self, trans, **kwd ): - message = kwd.get( 'message', '' ) + message = escape( kwd.get( 'message', '' ) ) status = kwd.get( 'status', 'done' ) repository = repository_util.get_installed_tool_shed_repository( trans.app, kwd[ 'id' ] ) return trans.fill_template( '/admin/tool_shed_repository/browse_repository.mako', @@ -141,7 +142,7 @@ action='reselect_tool_panel_section', **kwd ) ) else: - message = "Unable to get latest revision for repository <b>%s</b> from " % str( repository.name ) + message = "Unable to get latest revision for repository <b>%s</b> from " % escape( str( repository.name ) ) message += "the Tool Shed, so repository re-installation is not possible at this time." status = "error" return trans.response.send_redirect( web.url_for( controller='admin_toolshed', @@ -169,7 +170,7 @@ @web.expose @web.require_admin def browse_tool_dependency( self, trans, **kwd ): - message = kwd.get( 'message', '' ) + message = escape( kwd.get( 'message', '' ) ) status = kwd.get( 'status', 'done' ) tool_dependency_ids = tool_dependency_util.get_tool_dependency_ids( as_string=False, **kwd ) tool_dependency = tool_dependency_util.get_tool_dependency( trans.app, tool_dependency_ids[ 0 ] ) @@ -197,7 +198,7 @@ @web.expose @web.require_admin def browse_tool_sheds( self, trans, **kwd ): - message = kwd.get( 'message', '' ) + message = escape( kwd.get( 'message', '' ) ) status = kwd.get( 'status', 'done' ) return trans.fill_template( '/webapps/galaxy/admin/tool_sheds.mako', message=message, @@ -230,7 +231,7 @@ require the same entry. For now we'll never delete entries from config.shed_tool_data_table_config, but we may choose to do so in the future if it becomes necessary. """ - message = kwd.get( 'message', '' ) + message = escape( kwd.get( 'message', '' ) ) status = kwd.get( 'status', 'done' ) remove_from_disk = kwd.get( 'remove_from_disk', '' ) remove_from_disk_checked = CheckboxField.is_checked( remove_from_disk ) @@ -303,14 +304,14 @@ trans.install_model.context.add( tool_shed_repository ) trans.install_model.context.flush() if remove_from_disk_checked: - message = 'The repository named <b>%s</b> has been uninstalled. ' % tool_shed_repository.name + message = 'The repository named <b>%s</b> has been uninstalled. ' % escape( tool_shed_repository.name ) if errors: message += 'Attempting to uninstall tool dependencies resulted in errors: %s' % errors status = 'error' else: status = 'done' else: - message = 'The repository named <b>%s</b> has been deactivated. ' % tool_shed_repository.name + message = 'The repository named <b>%s</b> has been deactivated. ' % escape( tool_shed_repository.name ) status = 'done' return trans.response.send_redirect( web.url_for( controller='admin_toolshed', action='browse_repositories', @@ -442,7 +443,7 @@ @web.require_admin def import_workflow( self, trans, workflow_name, repository_id, **kwd ): """Import a workflow contained in an installed tool shed repository into Galaxy.""" - message = kwd.get( 'message', '' ) + message = escape( kwd.get( 'message', '' ) ) status = kwd.get( 'status', 'done' ) if workflow_name: workflow_name = encoding_util.tool_shed_decode( workflow_name ) @@ -453,7 +454,7 @@ workflow_name = encoding_util.tool_shed_encode( str( workflow.name ) ) else: message += 'Unable to locate a workflow named <b>%s</b> within the installed tool shed repository named <b>%s</b>' % \ - ( str( workflow_name ), str( repository.name ) ) + ( escape( str( workflow_name ) ), escape( str( repository.name ) ) ) status = 'error' else: message = 'Invalid repository id <b>%s</b> received.' % str( repository_id ) @@ -479,7 +480,7 @@ tool shed repository. """ # Get the tool_shed_repository from one of the tool_dependencies. - message = kwd.get( 'message', '' ) + message = escape( kwd.get( 'message', '' ) ) status = kwd.get( 'status', 'done' ) err_msg = '' tool_shed_repository = tool_dependencies[ 0 ].tool_shed_repository @@ -512,7 +513,7 @@ @web.require_admin def install_latest_repository_revision( self, trans, **kwd ): """Install the latest installable revision of a repository that has been previously installed.""" - message = kwd.get( 'message', '' ) + message = escape( kwd.get( 'message', '' ) ) status = kwd.get( 'status', 'done' ) repository_id = kwd.get( 'id', None ) if repository_id is not None: @@ -589,7 +590,7 @@ updating_to_changeset_revision = kwd.get( 'updating_to_changeset_revision', None ) updating_to_ctx_rev = kwd.get( 'updating_to_ctx_rev', None ) encoded_updated_metadata = kwd.get( 'encoded_updated_metadata', None ) - message = kwd.get( 'message', '' ) + message = escape( kwd.get( 'message', '' ) ) status = kwd.get( 'status', 'done' ) install_tool_dependencies = CheckboxField.is_checked( kwd.get( 'install_tool_dependencies', '' ) ) if 'install_tool_dependencies_with_update_button' in kwd: @@ -609,7 +610,7 @@ relative_install_dir, set_status=False ) message = "The installed repository named '%s' has been updated to change set revision '%s'. " % \ - ( str( repository.name ), updating_to_changeset_revision ) + ( escape( str( repository.name ) ), updating_to_changeset_revision ) self.initiate_tool_dependency_installation( trans, tool_dependencies, message=message, status=status ) # Handle tool dependencies check box. if trans.app.config.tool_dependency_dir is None: @@ -665,7 +666,7 @@ @web.expose @web.require_admin def manage_repositories( self, trans, **kwd ): - message = kwd.get( 'message', '' ) + message = escape( kwd.get( 'message', '' ) ) status = kwd.get( 'status', 'done' ) tsridslist = common_util.get_tool_shed_repository_ids( **kwd ) if 'operation' in kwd: @@ -744,7 +745,7 @@ @web.expose @web.require_admin def manage_repository( self, trans, **kwd ): - message = kwd.get( 'message', '' ) + message = escape( kwd.get( 'message', '' ) ) status = kwd.get( 'status', 'done' ) repository_id = kwd.get( 'id', None ) if repository_id is None: @@ -808,7 +809,7 @@ @web.expose @web.require_admin def manage_repository_tool_dependencies( self, trans, **kwd ): - message = kwd.get( 'message', '' ) + message = escape( kwd.get( 'message', '' ) ) status = kwd.get( 'status', 'done' ) tool_dependency_ids = tool_dependency_util.get_tool_dependency_ids( as_string=False, **kwd ) if tool_dependency_ids: @@ -890,7 +891,7 @@ def manage_tool_dependencies( self, trans, **kwd ): # This method is called when tool dependencies are being installed. See the related manage_repository_tool_dependencies # method for managing the tool dependencies for a specified installed tool shed repository. - message = kwd.get( 'message', '' ) + message = escape( kwd.get( 'message', '' ) ) status = kwd.get( 'status', 'done' ) tool_dependency_ids = tool_dependency_util.get_tool_dependency_ids( as_string=False, **kwd ) repository_id = kwd.get( 'repository_id', None ) @@ -902,7 +903,7 @@ # The user must be on the manage_repository_tool_dependencies page and clicked the button to either install or uninstall a # tool dependency, but they didn't check any of the available tool dependencies on which to perform the action. tool_shed_repository = suc.get_tool_shed_repository_by_id( trans.app, repository_id ) - self.tool_dependency_grid.title = "Tool shed repository '%s' tool dependencies" % tool_shed_repository.name + self.tool_dependency_grid.title = "Tool shed repository '%s' tool dependencies" % escape( tool_shed_repository.name ) if 'operation' in kwd: operation = kwd[ 'operation' ].lower() if not tool_dependency_ids: @@ -978,7 +979,7 @@ message += 'of Galaxy Tool Shed repository tools into a local Galaxy instance</a> section of the Galaxy Tool ' message += 'Shed wiki for all of the details.' return trans.show_error_message( message ) - message = kwd.get( 'message', '' ) + message = escape( kwd.get( 'message', '' ) ) status = kwd.get( 'status', 'done' ) shed_tool_conf = kwd.get( 'shed_tool_conf', None ) tool_shed_url = kwd.get( 'tool_shed_url', '' ) @@ -1030,7 +1031,7 @@ # The Tool Shed cannot handle the get_repository_id request, so the code must be older than the # 04/2014 Galaxy release when it was introduced. It will be safest to error out and let the # Tool Shed admin update the Tool Shed to a later release. - message = 'The updates available for the repository <b>%s</b> ' % str( repository.name ) + message = 'The updates available for the repository <b>%s</b> ' % escape( str( repository.name ) ) message += 'include newly defined repository or tool dependency definitions, and attempting ' message += 'to update the repository resulted in the following error. Contact the Tool Shed ' message += 'administrator if necessary.<br/>%s' % str( e ) @@ -1314,7 +1315,7 @@ and tool dependencies of the repository. """ rdim = repository_dependency_manager.RepositoryDependencyInstallManager( trans.app ) - message = kwd.get( 'message', '' ) + message = escape( kwd.get( 'message', '' ) ) status = kwd.get( 'status', 'done' ) repository_id = kwd[ 'id' ] tool_shed_repository = repository_util.get_installed_tool_shed_repository( trans.app, repository_id ) @@ -1450,7 +1451,7 @@ Inspect the repository dependency hierarchy for a specified repository and attempt to make sure they are all properly installed as well as each repository's tool dependencies. """ - message = kwd.get( 'message', '' ) + message = escape( kwd.get( 'message', '' ) ) status = kwd.get( 'status', 'done' ) repository_id = kwd.get( 'id', None ) if not repository_id: @@ -1648,12 +1649,12 @@ no_changes_check_box = CheckboxField( 'no_changes', checked=True ) if original_section_name: message += "The tools contained in your <b>%s</b> repository were last loaded into the tool panel section <b>%s</b>. " \ - % ( tool_shed_repository.name, original_section_name ) + % ( escape( tool_shed_repository.name ), original_section_name ) message += "Uncheck the <b>No changes</b> check box and select a different tool panel section to load the tools in a " message += "different section in the tool panel. " status = 'warning' else: - message += "The tools contained in your <b>%s</b> repository were last loaded into the tool panel outside of any sections. " % tool_shed_repository.name + message += "The tools contained in your <b>%s</b> repository were last loaded into the tool panel outside of any sections. " % escape( tool_shed_repository.name ) message += "Uncheck the <b>No changes</b> check box and select a tool panel section to load the tools into that section. " status = 'warning' else: @@ -1715,7 +1716,7 @@ if 'reset_metadata_on_selected_repositories_button' in kwd: message, status = irmm.reset_metadata_on_selected_repositories( trans.user, **kwd ) else: - message = kwd.get( 'message', '' ) + message = escape( kwd.get( 'message', '' ) ) status = kwd.get( 'status', 'done' ) repositories_select_field = irmm.build_repository_ids_select_field() return trans.fill_template( '/admin/tool_shed_repository/reset_metadata_on_selected_repositories.mako', @@ -1749,13 +1750,13 @@ irmm.update_in_shed_tool_config() trans.install_model.context.add( repository ) trans.install_model.context.flush() - message = 'Metadata has been reset on repository <b>%s</b>.' % repository.name + message = 'Metadata has been reset on repository <b>%s</b>.' % escape( repository.name ) status = 'done' else: - message = 'Metadata did not need to be reset on repository <b>%s</b>.' % repository.name + message = 'Metadata did not need to be reset on repository <b>%s</b>.' % escape( repository.name ) status = 'done' else: - message = 'Error locating installation directory for repository <b>%s</b>.' % repository.name + message = 'Error locating installation directory for repository <b>%s</b>.' % escape( repository.name ) status = 'error' return trans.response.send_redirect( web.url_for( controller='admin_toolshed', action='manage_repository', @@ -1777,7 +1778,7 @@ uninstalled=False, remove_from_disk=True ) new_kwd = {} - new_kwd[ 'message' ] = "You can now attempt to install the repository named <b>%s</b> again." % str( repository.name ) + new_kwd[ 'message' ] = "You can now attempt to install the repository named <b>%s</b> again." % escape( str( repository.name ) ) new_kwd[ 'status' ] = "done" return trans.response.send_redirect( web.url_for( controller='admin_toolshed', action='browse_repositories', @@ -1808,7 +1809,7 @@ message = "Tool versions have been set for all included tools." status = 'done' else: - message = "Version information for the tools included in the <b>%s</b> repository is missing. " % repository.name + message = "Version information for the tools included in the <b>%s</b> repository is missing. " % escape( repository.name ) message += "Reset all of this reppository's metadata in the tool shed, then set the installed tool versions " message ++ "from the installed repository's <b>Repository Actions</b> menu. " status = 'error' @@ -1852,7 +1853,7 @@ @web.expose @web.require_admin def uninstall_tool_dependencies( self, trans, **kwd ): - message = kwd.get( 'message', '' ) + message = escape( kwd.get( 'message', '' ) ) status = kwd.get( 'status', 'done' ) tool_dependency_ids = tool_dependency_util.get_tool_dependency_ids( as_string=False, **kwd ) if not tool_dependency_ids: @@ -1897,7 +1898,7 @@ @web.require_admin def update_to_changeset_revision( self, trans, **kwd ): """Update a cloned repository to the latest revision possible.""" - message = kwd.get( 'message', '' ) + message = escape( kwd.get( 'message', '' ) ) status = kwd.get( 'status', 'done' ) tool_shed_url = kwd.get( 'tool_shed_url', '' ) # Handle protocol changes over time. @@ -2070,7 +2071,7 @@ @web.expose @web.require_admin def update_tool_shed_status_for_installed_repository( self, trans, all_installed_repositories=False, **kwd ): - message = kwd.get( 'message', '' ) + message = escape( kwd.get( 'message', '' ) ) status = kwd.get( 'status', 'done' ) if all_installed_repositories: success_count = 0 @@ -2083,7 +2084,7 @@ if ok: success_count += 1 else: - repository_names_not_updated.append( '<b>%s</b>' % str( repository.name ) ) + repository_names_not_updated.append( '<b>%s</b>' % escape( str( repository.name ) ) ) if updated: updated_count += 1 message = "Checked the status in the tool shed for %d repositories. " % success_count @@ -2098,11 +2099,11 @@ repository_util.check_or_update_tool_shed_status_for_installed_repository( trans.app, repository ) if ok: if updated: - message = "The tool shed status for repository <b>%s</b> has been updated." % str( repository.name ) + message = "The tool shed status for repository <b>%s</b> has been updated." % escape( str( repository.name ) ) else: - message = "The status has not changed in the tool shed for repository <b>%s</b>." % str( repository.name ) + message = "The status has not changed in the tool shed for repository <b>%s</b>." % escape( str( repository.name ) ) else: - message = "Unable to retrieve status from the tool shed for repository <b>%s</b>." % str( repository.name ) + message = "Unable to retrieve status from the tool shed for repository <b>%s</b>." % escape( str( repository.name ) ) status = 'error' return trans.response.send_redirect( web.url_for( controller='admin_toolshed', action='browse_repositories', @@ -2112,7 +2113,7 @@ @web.expose @web.require_admin def view_tool_metadata( self, trans, repository_id, tool_id, **kwd ): - message = kwd.get( 'message', '' ) + message = escape( kwd.get( 'message', '' ) ) status = kwd.get( 'status', 'done' ) repository = repository_util.get_installed_tool_shed_repository( trans.app, repository_id ) repository_metadata = repository.metadata @@ -2146,7 +2147,7 @@ @web.require_admin def view_workflow( self, trans, workflow_name=None, repository_id=None, **kwd ): """Retrieve necessary information about a workflow from the database so that it can be displayed in an svg image.""" - message = kwd.get( 'message', '' ) + message = escape( kwd.get( 'message', '' ) ) status = kwd.get( 'status', 'done' ) if workflow_name: workflow_name = encoding_util.tool_shed_decode( workflow_name ) diff -r 2dc383cbb700f9d8d6a30eb976b70e8dcf1832db -r 72143d1079be191695e7ce2171926e891795bd7a lib/galaxy/webapps/galaxy/controllers/library_admin.py --- a/lib/galaxy/webapps/galaxy/controllers/library_admin.py +++ b/lib/galaxy/webapps/galaxy/controllers/library_admin.py @@ -5,8 +5,9 @@ from galaxy import web from galaxy.web.base.controller import BaseUIController -from galaxy.web.framework.helpers import escape, grids, time_ago +from galaxy.web.framework.helpers import grids, time_ago from library_common import get_comptypes, lucene_search, whoosh_search +from markupsafe import escape # from galaxy.model.orm import * log = logging.getLogger( __name__ ) @@ -148,7 +149,7 @@ @web.expose @web.require_admin def create_library( self, trans, **kwd ): - message = kwd.get( 'message', '' ) + message = escape( kwd.get( 'message', '' ) ) status = kwd.get( 'status', 'done' ) if kwd.get( 'create_library_button', False ): name = kwd.get( 'name', 'No name' ) @@ -161,12 +162,12 @@ library.root_folder = root_folder trans.sa_session.add_all( ( library, root_folder ) ) trans.sa_session.flush() - message = "The new library named '%s' has been created" % library.name + message = "The new library named '%s' has been created" return trans.response.send_redirect( web.url_for( controller='library_common', action='browse_library', cntrller='library_admin', id=trans.security.encode_id( library.id ), - message=message, + message=escape( message ), status='done' ) ) return trans.fill_template( '/admin/library/new_library.mako', message=escape( message ), status=escape( status ) ) @web.expose diff -r 2dc383cbb700f9d8d6a30eb976b70e8dcf1832db -r 72143d1079be191695e7ce2171926e891795bd7a lib/galaxy/webapps/galaxy/controllers/library_common.py --- a/lib/galaxy/webapps/galaxy/controllers/library_common.py +++ b/lib/galaxy/webapps/galaxy/controllers/library_common.py @@ -20,7 +20,7 @@ from galaxy.util.streamball import StreamBall from galaxy.web.base.controller import BaseUIController, UsesFormDefinitionsMixin, UsesExtendedMetadataMixin, UsesLibraryMixinItems from galaxy.web.form_builder import AddressField, CheckboxField, SelectField, build_select_field -from galaxy.web.framework.helpers import escape +from markupsafe import escape from galaxy.model.orm import and_, eagerload_all # Whoosh is compatible with Python 2.5+ Try to import Whoosh and set flag to indicate whether tool search is enabled. @@ -93,7 +93,7 @@ @web.expose def browse_library( self, trans, cntrller='library', **kwd ): - message = kwd.get( 'message', '' ) + message = escape( kwd.get( 'message', '' ) ) status = kwd.get( 'status', 'done' ) # If use_panels is True, the library is being accessed via an external link # which did not originate from within the Galaxy instance, and the library will @@ -121,7 +121,7 @@ hidden_folder_ids = util.listify( kwd.get( 'hidden_folder_ids', '' ) ) if created_ldda_ids and not message: message = "%d datasets are uploading in the background to the library '%s' (each is selected). " % \ - ( len( created_ldda_ids.split( ',' ) ), library.name ) + ( len( created_ldda_ids.split( ',' ) ), escape( library.name ) ) message += "Don't navigate away from Galaxy or use the browser's \"stop\" or \"reload\" buttons (on this tab) until the " message += "message \"This job is running\" is cleared from the \"Information\" column below for each selected dataset." status = "info" @@ -152,7 +152,7 @@ message=escape( message ), status=escape( status ) ) except Exception, e: - message = 'Error attempting to display contents of library (%s): %s.' % ( str( library.name ), str( e ) ) + message = 'Error attempting to display contents of library (%s): %s.' % ( escape( str( library.name ) ), str( e ) ) status = 'error' default_action = kwd.get( 'default_action', None ) @@ -165,7 +165,7 @@ @web.expose def library_info( self, trans, cntrller, **kwd ): - message = kwd.get( 'message', '' ) + message = escape( kwd.get( 'message', '' ) ) status = kwd.get( 'status', 'done' ) use_panels = util.string_as_bool( kwd.get( 'use_panels', False ) ) show_deleted = util.string_as_bool( kwd.get( 'show_deleted', False ) ) @@ -225,7 +225,7 @@ @web.expose def library_permissions( self, trans, cntrller, **kwd ): - message = kwd.get( 'message', '' ) + message = escape( kwd.get( 'message', '' ) ) status = kwd.get( 'status', 'done' ) use_panels = util.string_as_bool( kwd.get( 'use_panels', False ) ) show_deleted = util.string_as_bool( kwd.get( 'show_deleted', False ) ) @@ -272,7 +272,7 @@ @web.expose def create_folder( self, trans, cntrller, parent_id, library_id, **kwd ): - message = kwd.get( 'message', '' ) + message = escape( kwd.get( 'message', '' ) ) status = kwd.get( 'status', 'done' ) show_deleted = util.string_as_bool( kwd.get( 'show_deleted', False ) ) use_panels = util.string_as_bool( kwd.get( 'use_panels', False ) ) @@ -349,7 +349,7 @@ @web.expose def folder_info( self, trans, cntrller, id, library_id, **kwd ): - message = kwd.get( 'message', '' ) + message = escape( kwd.get( 'message', '' ) ) status = kwd.get( 'status', 'done' ) show_deleted = util.string_as_bool( kwd.get( 'show_deleted', False ) ) use_panels = util.string_as_bool( kwd.get( 'use_panels', False ) ) @@ -406,7 +406,7 @@ @web.expose def folder_permissions( self, trans, cntrller, id, library_id, **kwd ): - message = kwd.get( 'message', '' ) + message = escape( kwd.get( 'message', '' ) ) status = kwd.get( 'status', 'done' ) show_deleted = util.string_as_bool( kwd.get( 'show_deleted', False ) ) use_panels = util.string_as_bool( kwd.get( 'use_panels', False ) ) @@ -456,7 +456,7 @@ @web.expose def ldda_edit_info( self, trans, cntrller, library_id, folder_id, id, **kwd ): - message = kwd.get( 'message', '' ) + message = escape( kwd.get( 'message', '' ) ) status = kwd.get( 'status', 'done' ) show_deleted = util.string_as_bool( kwd.get( 'show_deleted', False ) ) use_panels = util.string_as_bool( kwd.get( 'use_panels', False ) ) @@ -511,7 +511,7 @@ old_name = ldda.name new_name = kwd.get( 'name', '' ) new_info = kwd.get( 'info', '' ) - new_message = kwd.get( 'message', '' ) + new_message = escape( kwd.get( 'message', '' ) ) if not new_name: message = 'Enter a valid name' status = 'error' @@ -609,7 +609,7 @@ @web.expose def ldda_info( self, trans, cntrller, library_id, folder_id, id, **kwd ): - message = kwd.get( 'message', '' ) + message = escape( kwd.get( 'message', '' ) ) status = kwd.get( 'status', 'done' ) show_deleted = util.string_as_bool( kwd.get( 'show_deleted', False ) ) show_associated_hdas_and_lddas = util.string_as_bool( kwd.get( 'show_associated_hdas_and_lddas', False ) ) @@ -658,7 +658,7 @@ @web.expose def ldda_permissions( self, trans, cntrller, library_id, folder_id, id, **kwd ): - message = kwd.get( 'message', '' ) + message = escape( kwd.get( 'message', '' ) ) status = kwd.get( 'status', 'done' ) show_deleted = util.string_as_bool( kwd.get( 'show_deleted', False ) ) use_panels = util.string_as_bool( kwd.get( 'use_panels', False ) ) @@ -796,9 +796,9 @@ @web.expose def upload_library_dataset( self, trans, cntrller, library_id, folder_id, **kwd ): - message = kwd.get( 'message', '' ) + message = escape( kwd.get( 'message', '' ) ) status = kwd.get( 'status', 'done' ) - ldda_message = kwd.get( 'ldda_message', '' ) + ldda_message = escape( kwd.get( 'ldda_message', '' ) ) deleted = util.string_as_bool( kwd.get( 'deleted', False ) ) show_deleted = util.string_as_bool( kwd.get( 'show_deleted', False ) ) use_panels = util.string_as_bool( kwd.get( 'use_panels', False ) ) @@ -1056,7 +1056,7 @@ dataset_upload_inputs.append( input ) # Library-specific params show_deleted = util.string_as_bool( kwd.get( 'show_deleted', False ) ) - message = kwd.get( 'message', '' ) + message = escape( kwd.get( 'message', '' ) ) status = kwd.get( 'status', 'done' ) server_dir = kwd.get( 'server_dir', '' ) if replace_dataset not in [ None, 'None' ]: @@ -1271,9 +1271,9 @@ @web.expose def add_history_datasets_to_library( self, trans, cntrller, library_id, folder_id, hda_ids='', **kwd ): - message = kwd.get( 'message', '' ) + message = escape( kwd.get( 'message', '' ) ) status = kwd.get( 'status', 'done' ) - ldda_message = kwd.get( 'ldda_message', '' ) + ldda_message = escape( kwd.get( 'ldda_message', '' ) ) show_deleted = kwd.get( 'show_deleted', False ) use_panels = util.string_as_bool( kwd.get( 'use_panels', False ) ) replace_id = kwd.get( 'replace_id', None ) @@ -1567,7 +1567,7 @@ @web.expose def library_dataset_info( self, trans, cntrller, id, library_id, **kwd ): - message = kwd.get( 'message', '' ) + message = escape( kwd.get( 'message', '' ) ) status = kwd.get( 'status', 'done' ) show_deleted = util.string_as_bool( kwd.get( 'show_deleted', False ) ) use_panels = util.string_as_bool( kwd.get( 'use_panels', False ) ) @@ -1616,7 +1616,7 @@ @web.expose def library_dataset_permissions( self, trans, cntrller, id, library_id, **kwd ): - message = kwd.get( 'message', '' ) + message = escape( kwd.get( 'message', '' ) ) status = kwd.get( 'status', 'done' ) show_deleted = util.string_as_bool( kwd.get( 'show_deleted', False ) ) use_panels = util.string_as_bool( kwd.get( 'use_panels', False ) ) @@ -1664,7 +1664,7 @@ @web.expose def make_library_item_public( self, trans, cntrller, library_id, item_type, id, **kwd ): - message = kwd.get( 'message', '' ) + message = escape( kwd.get( 'message', '' ) ) status = kwd.get( 'status', 'done' ) show_deleted = util.string_as_bool( kwd.get( 'show_deleted', False ) ) use_panels = util.string_as_bool( kwd.get( 'use_panels', False ) ) @@ -1726,7 +1726,7 @@ rval += '%s %i %s%s %s\r\n' % ( crc, size, self.url_base, quoted_fname, relpath ) return rval # Perform an action on a list of library datasets. - message = kwd.get( 'message', '' ) + message = escape( kwd.get( 'message', '' ) ) status = kwd.get( 'status', 'done' ) show_deleted = util.string_as_bool( kwd.get( 'show_deleted', False ) ) use_panels = util.string_as_bool( kwd.get( 'use_panels', False ) ) @@ -2002,7 +2002,7 @@ # - a select list option for acting on multiple selected datasets within a library # ( ldda_ids is a comma separated string of ldda ids ) # - a menu option for a library dataset search result set ( ldda_ids is a comma separated string of ldda ids ) - message = kwd.get( 'message', '' ) + message = escape( kwd.get( 'message', '' ) ) status = kwd.get( 'status', 'done' ) show_deleted = util.string_as_bool( kwd.get( 'show_deleted', False ) ) use_panels = util.string_as_bool( kwd.get( 'use_panels', False ) ) @@ -2126,7 +2126,7 @@ def manage_template_inheritance( self, trans, cntrller, item_type, library_id, folder_id=None, ldda_id=None, **kwd ): show_deleted = util.string_as_bool( kwd.get( 'show_deleted', False ) ) use_panels = util.string_as_bool( kwd.get( 'use_panels', False ) ) - message = kwd.get( 'message', '' ) + message = escape( kwd.get( 'message', '' ) ) status = kwd.get( 'status', 'done' ) is_admin = ( trans.user_is_admin() and cntrller == 'library_admin' ) current_user_roles = trans.get_current_user_roles() @@ -2177,7 +2177,7 @@ # 'ldda' and item_id is a comma separated string of ldda ids ) # - a menu option for a library dataset search result set ( item_type is 'ldda' and item_id is a # comma separated string of ldda ids ) - message = kwd.get( 'message', '' ) + message = escape( kwd.get( 'message', '' ) ) status = kwd.get( 'status', 'done' ) show_deleted = util.string_as_bool( kwd.get( 'show_deleted', False ) ) use_panels = util.string_as_bool( kwd.get( 'use_panels', False ) ) @@ -2760,7 +2760,7 @@ def lucene_search( trans, cntrller, search_term, search_url, **kwd ): """Return display of results from a full-text lucene search of data libraries.""" - message = kwd.get( 'message', '' ) + message = escape( kwd.get( 'message', '' ) ) status = kwd.get( 'status', 'done' ) full_url = "%s/find?%s" % ( search_url, urllib.urlencode( { "kwd" : search_term } ) ) response = urllib2.urlopen( full_url ) @@ -2771,7 +2771,7 @@ def whoosh_search( trans, cntrller, search_term, **kwd ): """Return display of results from a full-text whoosh search of data libraries.""" - message = kwd.get( 'message', '' ) + message = escape( kwd.get( 'message', '' ) ) status = kwd.get( 'status', 'done' ) ok = True if whoosh_search_enabled: diff -r 2dc383cbb700f9d8d6a30eb976b70e8dcf1832db -r 72143d1079be191695e7ce2171926e891795bd7a lib/galaxy/webapps/galaxy/controllers/user.py --- a/lib/galaxy/webapps/galaxy/controllers/user.py +++ b/lib/galaxy/webapps/galaxy/controllers/user.py @@ -29,6 +29,8 @@ UsesFormDefinitionsMixin) from galaxy.web.form_builder import build_select_field, CheckboxField from galaxy.web.framework.helpers import escape, grids, time_ago +from galaxy.web.framework.helpers import time_ago, grids +from markupsafe import escape log = logging.getLogger( __name__ ) @@ -252,7 +254,7 @@ if not trans.app.config.enable_openid: return trans.show_error_message( 'OpenID authentication is not enabled in this instance of Galaxy' ) use_panels = util.string_as_bool( kwd.get( 'use_panels', False ) ) - message = kwd.get( 'message', '' ) + message = escape( kwd.get( 'message', '' ) ) status = kwd.get( 'status', 'done' ) email = kwd.get( 'email', '' ) username = kwd.get( 'username', '' ) @@ -498,7 +500,7 @@ def __validate_login( self, trans, **kwd ): """Validates numerous cases that might happen during the login time.""" - message = kwd.get( 'message', '' ) + message = escape( kwd.get( 'message', '' ) ) status = kwd.get( 'status', 'error' ) email = kwd.get( 'email', '' ) password = kwd.get( 'password', '' ) @@ -713,7 +715,7 @@ email = util.restore_text( kwd.get( 'email', '' ) ) password = kwd.get( 'password', '' ) username = util.restore_text( kwd.get( 'username', '' ) ) - message = kwd.get( 'message', '' ) + message = escape( kwd.get( 'message', '' ) ) status = kwd.get( 'status', 'done' ) is_admin = cntrller == 'admin' and trans.user_is_admin() user = self.create_user( trans=trans, email=email, username=username, password=password ) diff -r 2dc383cbb700f9d8d6a30eb976b70e8dcf1832db -r 72143d1079be191695e7ce2171926e891795bd7a lib/galaxy/webapps/galaxy/controllers/workflow.py --- a/lib/galaxy/webapps/galaxy/controllers/workflow.py +++ b/lib/galaxy/webapps/galaxy/controllers/workflow.py @@ -22,7 +22,7 @@ from galaxy.web import error, url_for from galaxy.web.base.controller import BaseUIController, SharableMixin, UsesStoredWorkflowMixin from galaxy.web.framework.formbuilder import form -from galaxy.web.framework.helpers import grids, time_ago, to_unicode, escape +from galaxy.web.framework.helpers import grids, time_ago, to_unicode from galaxy.workflow.modules import WorkflowModuleInjector from galaxy.workflow.modules import MissingToolException from galaxy.workflow.modules import module_factory, is_tool_module_type @@ -37,6 +37,7 @@ order_workflow_steps_with_levels, ) from galaxy.workflow.render import WorkflowCanvas, MARGIN, LINE_SPACING +from markupsafe import escape class StoredWorkflowListGrid( grids.Grid ): @@ -1000,7 +1001,7 @@ """ url = kwd.get( 'url', '' ) workflow_text = kwd.get( 'workflow_text', '' ) - message = kwd.get( 'message', '' ) + message = escape( kwd.get( 'message', '' ) ) status = kwd.get( 'status', 'done' ) import_button = kwd.get( 'import_button', False ) # The special Galaxy integration landing page's URL on myExperiment diff -r 2dc383cbb700f9d8d6a30eb976b70e8dcf1832db -r 72143d1079be191695e7ce2171926e891795bd7a lib/galaxy/webapps/reports/controllers/users.py --- a/lib/galaxy/webapps/reports/controllers/users.py +++ b/lib/galaxy/webapps/reports/controllers/users.py @@ -9,17 +9,19 @@ pkg_resources.require( "SQLAlchemy >= 0.4" ) import sqlalchemy as sa import logging +from markupsafe import escape + log = logging.getLogger( __name__ ) class Users( BaseUIController ): @web.expose def registered_users( self, trans, **kwd ): - message = util.restore_text( kwd.get( 'message', '' ) ) + message = escape( util.restore_text( kwd.get( 'message', '' ) ) ) num_users = trans.sa_session.query( galaxy.model.User ).count() return trans.fill_template( '/webapps/reports/registered_users.mako', num_users=num_users, message=message ) @web.expose def registered_users_per_month( self, trans, **kwd ): - message = util.restore_text( kwd.get( 'message', '' ) ) + message = escape( util.restore_text( kwd.get( 'message', '' ) ) ) q = sa.select( ( sa.func.date_trunc( 'month', sa.func.date( galaxy.model.User.table.c.create_time ) ).label( 'date' ), sa.func.count( galaxy.model.User.table.c.id ).label( 'num_users' ) ), from_obj = [ galaxy.model.User.table ], @@ -36,7 +38,7 @@ message=message ) @web.expose def specified_month( self, trans, **kwd ): - message = util.restore_text( kwd.get( 'message', '' ) ) + message = escape( util.restore_text( kwd.get( 'message', '' ) ) ) # If specified_date is not received, we'll default to the current month specified_date = kwd.get( 'specified_date', datetime.utcnow().strftime( "%Y-%m-%d" ) ) specified_month = specified_date[ :7 ] @@ -66,7 +68,7 @@ message=message ) @web.expose def specified_date( self, trans, **kwd ): - message = util.restore_text( kwd.get( 'message', '' ) ) + message = escape( util.restore_text( kwd.get( 'message', '' ) ) ) # If specified_date is not received, we'll default to the current month specified_date = kwd.get( 'specified_date', datetime.utcnow().strftime( "%Y-%m-%d" ) ) year, month, day = map( int, specified_date.split( "-" ) ) @@ -95,7 +97,7 @@ message=message ) @web.expose def last_access_date( self, trans, **kwd ): - message = util.restore_text( kwd.get( 'message', '' ) ) + message = escape( util.restore_text( kwd.get( 'message', '' ) ) ) not_logged_in_for_days = kwd.get( 'not_logged_in_for_days', 90 ) if not not_logged_in_for_days: not_logged_in_for_days = 0 @@ -120,7 +122,7 @@ @web.expose def user_disk_usage( self, trans, **kwd ): - message = util.restore_text( kwd.get( 'message', '' ) ) + message = escape( util.restore_text( kwd.get( 'message', '' ) ) ) user_cutoff = int( kwd.get( 'user_cutoff', 60 ) ) # disk_usage isn't indexed users = sorted( trans.sa_session.query( galaxy.model.User ).all(), key=operator.attrgetter( 'disk_usage' ), reverse=True ) diff -r 2dc383cbb700f9d8d6a30eb976b70e8dcf1832db -r 72143d1079be191695e7ce2171926e891795bd7a lib/galaxy/webapps/tool_shed/controllers/admin.py --- a/lib/galaxy/webapps/tool_shed/controllers/admin.py +++ b/lib/galaxy/webapps/tool_shed/controllers/admin.py @@ -3,6 +3,7 @@ from galaxy import util from galaxy.util import inflector from galaxy import web +from markupsafe import escape from galaxy.web.base.controller import BaseUIController from galaxy.web.base.controllers.admin import Admin @@ -121,7 +122,7 @@ @web.expose @web.require_admin def create_category( self, trans, **kwd ): - message = kwd.get( 'message', '' ) + message = escape( kwd.get( 'message', '' ) ) status = kwd.get( 'status', 'done' ) name = kwd.get( 'name', '' ).strip() description = kwd.get( 'description', '' ).strip() @@ -154,7 +155,7 @@ @web.expose @web.require_admin def delete_repository( self, trans, **kwd ): - message = kwd.get( 'message', '' ) + message = escape( kwd.get( 'message', '' ) ) status = kwd.get( 'status', 'done' ) id = kwd.get( 'id', None ) if id: @@ -197,7 +198,7 @@ @web.expose @web.require_admin def delete_repository_metadata( self, trans, **kwd ): - message = kwd.get( 'message', '' ) + message = escape( kwd.get( 'message', '' ) ) status = kwd.get( 'status', 'done' ) id = kwd.get( 'id', None ) if id: @@ -221,7 +222,7 @@ @web.expose @web.require_admin def edit_category( self, trans, **kwd ): - message = kwd.get( 'message', '' ) + message = escape( kwd.get( 'message', '' ) ) status = kwd.get( 'status', 'done' ) id = kwd.get( 'id', None ) if not id: @@ -306,7 +307,7 @@ @web.expose @web.require_admin def regenerate_statistics( self, trans, **kwd ): - message = kwd.get( 'message', '' ) + message = escape( kwd.get( 'message', '' ) ) status = kwd.get( 'status', 'done' ) if 'regenerate_statistics_button' in kwd: trans.app.shed_counter.generate_statistics() @@ -352,7 +353,7 @@ if 'reset_metadata_on_selected_repositories_button' in kwd: message, status = rmm.reset_metadata_on_selected_repositories( **kwd ) else: - message = util.restore_text( kwd.get( 'message', '' ) ) + message = escape( util.restore_text( kwd.get( 'message', '' ) ) ) status = kwd.get( 'status', 'done' ) repositories_select_field = rmm.build_repository_ids_select_field( name='repository_ids', multiple=True, @@ -366,7 +367,7 @@ @web.expose @web.require_admin def undelete_repository( self, trans, **kwd ): - message = kwd.get( 'message', '' ) + message = escape( kwd.get( 'message', '' ) ) status = kwd.get( 'status', 'done' ) id = kwd.get( 'id', None ) if id: @@ -417,7 +418,7 @@ # TODO: We should probably eliminate the Category.deleted column since it really makes no # sense to mark a category as deleted (category names and descriptions can be changed instead). # If we do this, and the following 2 methods can be eliminated. - message = kwd.get( 'message', '' ) + message = escape( kwd.get( 'message', '' ) ) status = kwd.get( 'status', 'done' ) id = kwd.get( 'id', None ) if id: @@ -445,7 +446,7 @@ # This method should only be called for a Category that has previously been deleted. # Purging a deleted Category deletes all of the following from the database: # - RepoitoryCategoryAssociations where category_id == Category.id - message = kwd.get( 'message', '' ) + message = escape( kwd.get( 'message', '' ) ) status = kwd.get( 'status', 'done' ) id = kwd.get( 'id', None ) if id: @@ -473,7 +474,7 @@ @web.expose @web.require_admin def undelete_category( self, trans, **kwd ): - message = kwd.get( 'message', '' ) + message = escape( kwd.get( 'message', '' ) ) status = kwd.get( 'status', 'done' ) id = kwd.get( 'id', None ) if id: diff -r 2dc383cbb700f9d8d6a30eb976b70e8dcf1832db -r 72143d1079be191695e7ce2171926e891795bd7a lib/galaxy/webapps/tool_shed/controllers/repository.py --- a/lib/galaxy/webapps/tool_shed/controllers/repository.py +++ b/lib/galaxy/webapps/tool_shed/controllers/repository.py @@ -6,6 +6,7 @@ from time import strftime from datetime import date from datetime import datetime +from markupsafe import escape from galaxy import util from galaxy import web @@ -385,7 +386,7 @@ action='reviewed_repositories_i_own' ) ) elif operation == "repositories_by_category": category_id = kwd.get( 'id', None ) - message = kwd.get( 'message', '' ) + message = escape( kwd.get( 'message', '' ) ) status = kwd.get( 'status', 'done' ) return trans.response.send_redirect( web.url_for( controller='repository', action='browse_repositories_in_category', @@ -721,9 +722,9 @@ @web.expose def browse_repository( self, trans, id, **kwd ): - message = kwd.get( 'message', '' ) + message = escape( kwd.get( 'message', '' ) ) status = kwd.get( 'status', 'done' ) - commit_message = kwd.get( 'commit_message', 'Deleted selected files' ) + commit_message = escape( kwd.get( 'commit_message', 'Deleted selected files' ) ) repository = suc.get_repository_in_tool_shed( trans.app, id ) repo = hg_util.get_repo_for_repository( trans.app, repository=repository, repo_path=None, create=False ) # Update repository files for browsing. @@ -891,7 +892,7 @@ @web.expose def check_for_updates( self, trans, **kwd ): """Handle a request from a local Galaxy instance.""" - message = kwd.get( 'message', '' ) + message = escape( kwd.get( 'message', '' ) ) status = kwd.get( 'status', 'done' ) # If the request originated with the UpdateRepositoryManager, it will not include a galaxy_url. galaxy_url = common_util.handle_galaxy_url( trans, **kwd ) @@ -976,7 +977,7 @@ @web.expose def contact_owner( self, trans, id, **kwd ): - message = kwd.get( 'message', '' ) + message = escape( kwd.get( 'message', '' ) ) status = kwd.get( 'status', 'done' ) repository = suc.get_repository_in_tool_shed( trans.app, id ) metadata = metadata_util.get_repository_metadata_by_repository_id_changeset_revision( trans.app, @@ -995,7 +996,7 @@ @web.expose def create_galaxy_docker_image( self, trans, **kwd ): - message = kwd.get( 'message', '' ) + message = escape( kwd.get( 'message', '' ) ) status = kwd.get( 'status', 'done' ) repository_ids = util.listify( kwd.get( 'id', '' ) ) if 'operation' in kwd: @@ -1051,7 +1052,7 @@ @web.expose def create_repository( self, trans, **kwd ): - message = kwd.get( 'message', '' ) + message = escape( kwd.get( 'message', '' ) ) status = kwd.get( 'status', 'done' ) categories = suc.get_categories( trans ) if not categories: @@ -1114,7 +1115,7 @@ # Marking a repository in the tool shed as deprecated has no effect on any downloadable changeset # revisions that may be associated with the repository. Revisions are not marked as not downlaodable # because those that have installed the repository must be allowed to get updates. - message = kwd.get( 'message', '' ) + message = escape( kwd.get( 'message', '' ) ) status = kwd.get( 'status', 'done' ) repository_id = kwd.get( 'id', None ) repository = suc.get_repository_in_tool_shed( trans.app, repository_id ) @@ -1170,7 +1171,7 @@ @web.expose def display_tool( self, trans, repository_id, tool_config, changeset_revision, **kwd ): - message = kwd.get( 'message', '' ) + message = escape( kwd.get( 'message', '' ) ) status = kwd.get( 'status', 'done' ) render_repository_actions_for = kwd.get( 'render_repository_actions_for', 'tool_shed' ) tv = tool_validator.ToolValidator( trans.app ) @@ -1235,7 +1236,7 @@ @web.expose def export( self, trans, repository_id, changeset_revision, **kwd ): - message = kwd.get( 'message', '' ) + message = escape( kwd.get( 'message', '' ) ) status = kwd.get( 'status', 'done' ) export_repository_dependencies = kwd.get( 'export_repository_dependencies', '' ) repository = suc.get_repository_in_tool_shed( trans.app, repository_id ) @@ -1315,7 +1316,7 @@ @web.expose def find_tools( self, trans, **kwd ): - message = kwd.get( 'message', '' ) + message = escape( kwd.get( 'message', '' ) ) status = kwd.get( 'status', 'done' ) galaxy_url = common_util.handle_galaxy_url( trans, **kwd ) if 'operation' in kwd: @@ -1406,7 +1407,7 @@ @web.expose def find_workflows( self, trans, **kwd ): - message = kwd.get( 'message', '' ) + message = escape( kwd.get( 'message', '' ) ) status = kwd.get( 'status', 'done' ) galaxy_url = common_util.handle_galaxy_url( trans, **kwd ) if 'operation' in kwd: @@ -2026,13 +2027,13 @@ @web.expose def help( self, trans, **kwd ): - message = kwd.get( 'message', '' ) + message = escape( kwd.get( 'message', '' ) ) status = kwd.get( 'status', 'done' ) return trans.fill_template( '/webapps/tool_shed/repository/help.mako', message=message, status=status, **kwd ) @web.expose def import_capsule( self, trans, **kwd ): - message = kwd.get( 'message', '' ) + message = escape( kwd.get( 'message', '' ) ) status = kwd.get( 'status', 'done' ) capsule_file_name = kwd.get( 'capsule_file_name', None ) encoded_file_path = kwd.get( 'encoded_file_path', None ) @@ -2075,7 +2076,7 @@ @web.expose def index( self, trans, **kwd ): - message = kwd.get( 'message', '' ) + message = escape( kwd.get( 'message', '' ) ) status = kwd.get( 'status', 'done' ) # See if there are any RepositoryMetadata records since menu items require them. repository_metadata = trans.sa_session.query( trans.model.RepositoryMetadata ).first() @@ -2157,7 +2158,7 @@ @web.expose def load_invalid_tool( self, trans, repository_id, tool_config, changeset_revision, **kwd ): - message = kwd.get( 'message', '' ) + message = escape( kwd.get( 'message', '' ) ) status = kwd.get( 'status', 'error' ) render_repository_actions_for = kwd.get( 'render_repository_actions_for', 'tool_shed' ) tv = tool_validator.ToolValidator( trans.app ) @@ -2209,7 +2210,7 @@ @web.expose @web.require_login( "manage email alerts" ) def manage_email_alerts( self, trans, **kwd ): - message = kwd.get( 'message', '' ) + message = escape( kwd.get( 'message', '' ) ) status = kwd.get( 'status', 'done' ) new_repo_alert = kwd.get( 'new_repo_alert', '' ) new_repo_alert_checked = CheckboxField.is_checked( new_repo_alert ) @@ -2240,7 +2241,7 @@ @web.expose @web.require_login( "manage repository" ) def manage_repository( self, trans, id, **kwd ): - message = kwd.get( 'message', '' ) + message = escape( kwd.get( 'message', '' ) ) status = kwd.get( 'status', 'done' ) repository = suc.get_repository_in_tool_shed( trans.app, id ) repository_type = kwd.get( 'repository_type', str( repository.type ) ) @@ -2516,7 +2517,7 @@ @web.expose @web.require_login( "manage repository administrators" ) def manage_repository_admins( self, trans, id, **kwd ): - message = kwd.get( 'message', '' ) + message = escape( kwd.get( 'message', '' ) ) status = kwd.get( 'status', 'done' ) repository = suc.get_repository_in_tool_shed( trans.app, id ) changeset_revision = kwd.get( 'changeset_revision', repository.tip( trans.app ) ) @@ -2574,7 +2575,7 @@ @web.expose @web.require_login( "multi select email alerts" ) def multi_select_email_alerts( self, trans, **kwd ): - message = kwd.get( 'message', '' ) + message = escape( kwd.get( 'message', '' ) ) status = kwd.get( 'status', 'done' ) if 'operation' in kwd: operation = kwd[ 'operation' ].lower() @@ -2623,7 +2624,7 @@ @web.expose def preview_tools_in_changeset( self, trans, repository_id, **kwd ): - message = kwd.get( 'message', '' ) + message = escape( kwd.get( 'message', '' ) ) status = kwd.get( 'status', 'done' ) repository = suc.get_repository_in_tool_shed( trans.app, repository_id ) repo = hg_util.get_repo_for_repository( trans.app, repository=repository, repo_path=None, create=False ) @@ -2730,7 +2731,7 @@ @web.require_login( "rate repositories" ) def rate_repository( self, trans, **kwd ): """ Rate a repository and return updated rating data. """ - message = kwd.get( 'message', '' ) + message = escape( kwd.get( 'message', '' ) ) status = kwd.get( 'status', 'done' ) id = kwd.get( 'id', None ) if not id: @@ -2803,7 +2804,7 @@ if 'reset_metadata_on_selected_repositories_button' in kwd: message, status = rmm.reset_metadata_on_selected_repositories( **kwd ) else: - message = kwd.get( 'message', '' ) + message = escape( kwd.get( 'message', '' ) ) status = kwd.get( 'status', 'done' ) repositories_select_field = rmm.build_repository_ids_select_field( name='repository_ids', multiple=True, @@ -2816,9 +2817,9 @@ @web.expose def select_files_to_delete( self, trans, id, **kwd ): - message = kwd.get( 'message', '' ) + message = escape( kwd.get( 'message', '' ) ) status = kwd.get( 'status', 'done' ) - commit_message = kwd.get( 'commit_message', 'Deleted selected files' ) + commit_message = escape( kwd.get( 'commit_message', 'Deleted selected files' ) ) repository = suc.get_repository_in_tool_shed( trans.app, id ) repo_dir = repository.repo_path( trans.app ) repo = hg_util.get_repo_for_repository( trans.app, repository=None, repo_path=repo_dir, create=False ) @@ -3161,7 +3162,7 @@ @web.expose def upload_capsule( self, trans, **kwd ): - message = kwd.get( 'message', '' ) + message = escape( kwd.get( 'message', '' ) ) status = kwd.get( 'status', 'done' ) url = kwd.get( 'url', '' ) if 'upload_capsule_button' in kwd: @@ -3191,7 +3192,7 @@ @web.expose def view_changelog( self, trans, id, **kwd ): - message = kwd.get( 'message', '' ) + message = escape( kwd.get( 'message', '' ) ) status = kwd.get( 'status', 'done' ) repository = suc.get_repository_in_tool_shed( trans.app, id ) repo = hg_util.get_repo_for_repository( trans.app, repository=repository, repo_path=None, create=False ) @@ -3226,7 +3227,7 @@ @web.expose def view_changeset( self, trans, id, ctx_str, **kwd ): - message = kwd.get( 'message', '' ) + message = escape( kwd.get( 'message', '' ) ) status = kwd.get( 'status', 'done' ) repository = suc.get_repository_in_tool_shed( trans.app, id ) repo = hg_util.get_repo_for_repository( trans.app, repository=repository, repo_path=None, create=False ) @@ -3318,7 +3319,7 @@ @web.expose def view_repository( self, trans, id, **kwd ): - message = kwd.get( 'message', '' ) + message = escape( kwd.get( 'message', '' ) ) status = kwd.get( 'status', 'done' ) repository = suc.get_repository_in_tool_shed( trans.app, id ) repo = hg_util.get_repo_for_repository( trans.app, repository=repository, repo_path=None, create=False ) @@ -3406,7 +3407,7 @@ @web.expose def view_tool_metadata( self, trans, repository_id, changeset_revision, tool_id, **kwd ): - message = kwd.get( 'message', '' ) + message = escape( kwd.get( 'message', '' ) ) status = kwd.get( 'status', 'done' ) render_repository_actions_for = kwd.get( 'render_repository_actions_for', 'tool_shed' ) repository = suc.get_repository_in_tool_shed( trans.app, repository_id ) @@ -3487,7 +3488,7 @@ @web.expose def view_workflow( self, trans, workflow_name, repository_metadata_id, **kwd ): """Retrieve necessary information about a workflow from the database so that it can be displayed in an svg image.""" - message = kwd.get( 'message', '' ) + message = escape( kwd.get( 'message', '' ) ) status = kwd.get( 'status', 'done' ) render_repository_actions_for = kwd.get( 'render_repository_actions_for', 'tool_shed' ) if workflow_name: diff -r 2dc383cbb700f9d8d6a30eb976b70e8dcf1832db -r 72143d1079be191695e7ce2171926e891795bd7a lib/galaxy/webapps/tool_shed/controllers/repository_review.py --- a/lib/galaxy/webapps/tool_shed/controllers/repository_review.py +++ b/lib/galaxy/webapps/tool_shed/controllers/repository_review.py @@ -2,6 +2,7 @@ import os from sqlalchemy.sql.expression import func +from markupsafe import escape from galaxy import util from galaxy import web @@ -40,7 +41,7 @@ @web.require_login( "approve repository review" ) def approve_repository_review( self, trans, **kwd ): # The value of the received id is the encoded review id. - message = kwd.get( 'message', '' ) + message = escape( kwd.get( 'message', '' ) ) status = kwd.get( 'status', 'done' ) encoded_review_id = kwd[ 'id' ] review = review_util.get_review( trans.app, encoded_review_id ) @@ -74,7 +75,7 @@ @web.expose @web.require_login( "browse review" ) def browse_review( self, trans, **kwd ): - message = kwd.get( 'message', '' ) + message = escape( kwd.get( 'message', '' ) ) status = kwd.get( 'status', 'done' ) review = review_util.get_review( trans.app, kwd[ 'id' ] ) repository = review.repository @@ -105,7 +106,7 @@ @web.expose @web.require_login( "create component" ) def create_component( self, trans, **kwd ): - message = kwd.get( 'message', '' ) + message = escape( kwd.get( 'message', '' ) ) status = kwd.get( 'status', 'done' ) name = kwd.get( 'name', '' ) description = kwd.get( 'description', '' ) @@ -136,7 +137,7 @@ @web.require_login( "create review" ) def create_review( self, trans, **kwd ): # The value of the received id is the encoded repository id. - message = kwd.get( 'message', '' ) + message = escape( kwd.get( 'message', '' ) ) status = kwd.get( 'status', 'done' ) repository_id = kwd.get( 'id', None ) changeset_revision = kwd.get( 'changeset_revision', None ) @@ -201,7 +202,7 @@ @web.expose @web.require_login( "edit component" ) def edit_component( self, trans, **kwd ): - message = kwd.get( 'message', '' ) + message = escape( kwd.get( 'message', '' ) ) status = kwd.get( 'status', 'done' ) id = kwd.get( 'id', None ) if not id: @@ -232,7 +233,7 @@ @web.require_login( "edit review" ) def edit_review( self, trans, **kwd ): # The value of the received id is the encoded review id. - message = kwd.get( 'message', '' ) + message = escape( kwd.get( 'message', '' ) ) status = kwd.get( 'status', 'done' ) review_id = kwd.get( 'id', None ) review = review_util.get_review( trans.app, review_id ) @@ -408,7 +409,7 @@ @web.require_login( "manage repositories reviewed by me" ) def manage_repositories_reviewed_by_me( self, trans, **kwd ): # The value of the received id is the encoded repository id. - message = kwd.get( 'message', '' ) + message = escape( kwd.get( 'message', '' ) ) status = kwd.get( 'status', 'done' ) if 'operation' in kwd: kwd[ 'mine' ] = True @@ -475,7 +476,7 @@ @web.require_login( "manage repository reviews" ) def manage_repository_reviews( self, trans, mine=False, **kwd ): # The value of the received id is the encoded repository id. - message = kwd.get( 'message', '' ) + message = escape( kwd.get( 'message', '' ) ) status = kwd.get( 'status', 'done' ) repository_id = kwd.get( 'id', None ) if repository_id: @@ -524,7 +525,7 @@ @web.require_login( "manage repository reviews of revision" ) def manage_repository_reviews_of_revision( self, trans, **kwd ): # The value of the received id is the encoded repository id. - message = kwd.get( 'message', '' ) + message = escape( kwd.get( 'message', '' ) ) status = kwd.get( 'status', 'done' ) repository_id = kwd.get( 'id', None ) changeset_revision = kwd.get( 'changeset_revision', None ) @@ -547,7 +548,7 @@ @web.expose @web.require_login( "repository reviews by user" ) def repository_reviews_by_user( self, trans, **kwd ): - message = kwd.get( 'message', '' ) + message = escape( kwd.get( 'message', '' ) ) status = kwd.get( 'status', 'done' ) if 'operation' in kwd: @@ -573,7 +574,7 @@ @web.expose @web.require_login( "reviewed repositories i own" ) def reviewed_repositories_i_own( self, trans, **kwd ): - message = kwd.get( 'message', '' ) + message = escape( kwd.get( 'message', '' ) ) status = kwd.get( 'status', 'done' ) # The value of the received id is the encoded repository id. if 'operation' in kwd: @@ -592,7 +593,7 @@ @web.require_login( "select previous review" ) def select_previous_review( self, trans, **kwd ): # The value of the received id is the encoded repository id. - message = kwd.get( 'message', '' ) + message = escape( kwd.get( 'message', '' ) ) status = kwd.get( 'status', 'done' ) repository = suc.get_repository_in_tool_shed( trans.app, kwd[ 'id' ] ) changeset_revision = kwd.get( 'changeset_revision', None ) diff -r 2dc383cbb700f9d8d6a30eb976b70e8dcf1832db -r 72143d1079be191695e7ce2171926e891795bd7a lib/galaxy/webapps/tool_shed/controllers/upload.py --- a/lib/galaxy/webapps/tool_shed/controllers/upload.py +++ b/lib/galaxy/webapps/tool_shed/controllers/upload.py @@ -9,6 +9,7 @@ from galaxy import web from galaxy.datatypes import checkers from galaxy.web.base.controller import BaseUIController +from markupsafe import escape from tool_shed.dependencies import attribute_handlers from tool_shed.galaxy_install import dependency_display @@ -35,9 +36,9 @@ @web.expose @web.require_login( 'upload', use_panels=True ) def upload( self, trans, **kwd ): - message = kwd.get( 'message', '' ) + message = escape( kwd.get( 'message', '' ) ) status = kwd.get( 'status', 'done' ) - commit_message = kwd.get( 'commit_message', 'Uploaded' ) + commit_message = escape( kwd.get( 'commit_message', 'Uploaded' ) ) category_ids = util.listify( kwd.get( 'category_id', '' ) ) categories = suc.get_categories( trans.app ) repository_id = kwd.get( 'repository_id', '' ) diff -r 2dc383cbb700f9d8d6a30eb976b70e8dcf1832db -r 72143d1079be191695e7ce2171926e891795bd7a lib/tool_shed/util/repository_util.py --- a/lib/tool_shed/util/repository_util.py +++ b/lib/tool_shed/util/repository_util.py @@ -7,6 +7,7 @@ from galaxy import web from galaxy.web.form_builder import build_select_field from galaxy.webapps.tool_shed.model import directory_hash_id +from markupsafe import escape from tool_shed.dependencies.repository import relation_builder @@ -259,7 +260,7 @@ def handle_role_associations( app, role, repository, **kwd ): sa_session = app.model.context.current - message = kwd.get( 'message', '' ) + message = escape( kwd.get( 'message', '' ) ) status = kwd.get( 'status', 'done' ) repository_owner = repository.user if kwd.get( 'manage_role_associations_button', False ): diff -r 2dc383cbb700f9d8d6a30eb976b70e8dcf1832db -r 72143d1079be191695e7ce2171926e891795bd7a templates/admin/dataset_security/group/group.mako --- a/templates/admin/dataset_security/group/group.mako +++ b/templates/admin/dataset_security/group/group.mako @@ -11,9 +11,9 @@ </%def><%def name="render_select( name, options )"> - <select name="${name}" id="${name}" style="min-width: 250px; height: 150px;" multiple> + <select name="${name|h}" id="${name|h}" style="min-width: 250px; height: 150px;" multiple> %for option in options: - <option value="${option[0]}">${option[1]}</option> + <option value="${option[0]|h}">${option[1]|h}</option> %endfor </select></%def> @@ -48,29 +48,29 @@ %endif <div class="toolForm"> - <div class="toolFormTitle">Group '${group.name}'</div> + <div class="toolFormTitle">Group '${group.name|h}'</div><div class="toolFormBody"><form name="associate_group_role_user" id="associate_group_role_user" action="${h.url_for(controller='admin', action='manage_users_and_roles_for_group', id=trans.security.encode_id( group.id ) )}" method="post" ><div class="form-row"><div style="float: left; margin-right: 10px;"> - <label>Roles associated with '${group.name}'</label> + <label>Roles associated with '${group.name|h}'</label> ${render_select( "in_roles", in_roles )}<br/><input type="submit" id="roles_remove_button" value=">>"/></div><div> - <label>Roles not associated with '${group.name}'</label> + <label>Roles not associated with '${group.name|h}'</label> ${render_select( "out_roles", out_roles )}<br/><input type="submit" id="roles_add_button" value="<<"/></div></div><div class="form-row"><div style="float: left; margin-right: 10px;"> - <label>Users associated with '${group.name}'</label> + <label>Users associated with '${group.name|h}'</label> ${render_select( "in_users", in_users )}<br/><input type="submit" id="users_remove_button" value=">>"/></div><div> - <label>Users not associated with '${group.name}'</label> + <label>Users not associated with '${group.name|h}'</label> ${render_select( "out_users", out_users )}<br/><input type="submit" id="users_add_button" value="<<"/></div> diff -r 2dc383cbb700f9d8d6a30eb976b70e8dcf1832db -r 72143d1079be191695e7ce2171926e891795bd7a templates/admin/dataset_security/group/group_create.mako --- a/templates/admin/dataset_security/group/group_create.mako +++ b/templates/admin/dataset_security/group/group_create.mako @@ -11,9 +11,9 @@ </%def><%def name="render_select( name, options )"> - <select name="${name}" id="${name}" style="min-width: 250px; height: 150px;" multiple> + <select name="${name|h}" id="${name|h}" style="min-width: 250px; height: 150px;" multiple> %for option in options: - <option value="${option[0]}">${option[1]}</option> + <option value="${option[0]|h}">${option[1]|h}</option> %endfor </select></%def> @@ -60,7 +60,7 @@ <form name="associate_group_role_user" id="associate_group_role_user" action="${h.url_for(controller='admin', action='create_group' )}" method="post" ><div class="form-row"><label>Name:</label> - <input name="name" type="textfield" value="${name}" size=40"/> + <input name="name" type="textfield" value="${name|h}" size=40"/></div><div class="form-row"><div style="float: left; margin-right: 10px;"> diff -r 2dc383cbb700f9d8d6a30eb976b70e8dcf1832db -r 72143d1079be191695e7ce2171926e891795bd7a templates/admin/dataset_security/group/group_rename.mako --- a/templates/admin/dataset_security/group/group_rename.mako +++ b/templates/admin/dataset_security/group/group_rename.mako @@ -12,7 +12,7 @@ <div class="form-row"><label>Name:</label><div style="float: left; width: 250px; margin-right: 10px;"> - <input type="text" name="name" value="${group.name}" size="40"/> + <input type="text" name="name" value="${group.name|h}" size="40"/></div><div style="clear: both"></div></div> diff -r 2dc383cbb700f9d8d6a30eb976b70e8dcf1832db -r 72143d1079be191695e7ce2171926e891795bd7a templates/admin/dataset_security/role/role.mako --- a/templates/admin/dataset_security/role/role.mako +++ b/templates/admin/dataset_security/role/role.mako @@ -11,9 +11,9 @@ </%def><%def name="render_select( name, options )"> - <select name="${name}" id="${name}" style="min-width: 250px; height: 150px;" multiple> + <select name="${name|h}" id="${name|h}" style="min-width: 250px; height: 150px;" multiple> %for option in options: - <option value="${option[0]}">${option[1]}</option> + <option value="${option[0]|h}">${option[1]|h}</option> %endfor </select></%def> @@ -48,29 +48,29 @@ %endif <div class="toolForm"> - <div class="toolFormTitle">Role '${role.name}'</div> + <div class="toolFormTitle">Role '${role.name|h}'</div><div class="toolFormBody"><form name="associate_role_user_group" id="associate_role_user_group" action="${h.url_for(controller='admin', action='manage_users_and_groups_for_role', id=trans.security.encode_id( role.id ) )}" method="post" ><div class="form-row"><div style="float: left; margin-right: 10px;"> - <label>Users associated with '${role.name}'</label> + <label>Users associated with '${role.name|h}'</label> ${render_select( "in_users", in_users )}<br/><input type="submit" id="users_remove_button" value=">>"/></div><div> - <label>Users not associated with '${role.name}'</label> + <label>Users not associated with '${role.name|h}'</label> ${render_select( "out_users", out_users )}<br/><input type="submit" id="users_add_button" value="<<"/></div></div><div class="form-row"><div style="float: left; margin-right: 10px;"> - <label>Groups associated with '${role.name}'</label> + <label>Groups associated with '${role.name|h}'</label> ${render_select( "in_groups", in_groups )}<br/><input type="submit" id="groups_remove_button" value=">>"/></div><div> - <label>Groups not associated with '${role.name}'</label> + <label>Groups not associated with '${role.name|h}'</label> ${render_select( "out_groups", out_groups )}<br/><input type="submit" id="groups_add_button" value="<<"/></div> @@ -84,7 +84,7 @@ <br clear="left"/><br/> %if len( library_dataset_actions ) > 0: - <h3>Data library datasets associated with role '${role.name}'</h3> + <h3>Data library datasets associated with role '${role.name|h}'</h3><table class="manage-table colored" border="0" cellspacing="0" cellpadding="0" width="100%"><tr><td> @@ -92,16 +92,16 @@ %for ctr, library, in enumerate( library_dataset_actions.keys() ): <li><img src="${h.url_for( '/static/images/silk/book_open.png' )}" class="rowIcon"/> - ${library.name} + ${library.name|h} <ul> %for folder_path, permissions in library_dataset_actions[ library ].items(): <li><img src="/static/images/silk/folder_page.png" class="rowIcon"/> - ${folder_path} + ${folder_path|h} <ul> % for permission in permissions: <ul> - <li>${permission}</li> + <li>${permission|h}</li></ul> %endfor </ul> diff -r 2dc383cbb700f9d8d6a30eb976b70e8dcf1832db -r 72143d1079be191695e7ce2171926e891795bd7a templates/admin/dataset_security/role/role_create.mako --- a/templates/admin/dataset_security/role/role_create.mako +++ b/templates/admin/dataset_security/role/role_create.mako @@ -11,9 +11,9 @@ </%def><%def name="render_select( name, options )"> - <select name="${name}" id="${name}" style="min-width: 250px; height: 150px;" multiple> + <select name="${name|h}" id="${name|h}" style="min-width: 250px; height: 150px;" multiple> %for option in options: - <option value="${option[0]}">${option[1]}</option> + <option value="${option[0]|h}">${option[1]|h}</option> %endfor </select></%def> @@ -60,11 +60,11 @@ <form name="associate_role_group_user" id="associate_role_group_user" action="${h.url_for(controller='admin', action='create_role' )}" method="post" ><div class="form-row"><label>Name:</label> - <input name="name" type="textfield" value="${name}" size=40"/> + <input name="name" type="textfield" value="${name|h}" size=40"/></div><div class="form-row"><label>Description:</label> - <input name="description" type="textfield" value="${description}" size=40"/> + <input name="description" type="textfield" value="${description|h}" size=40"/></div><div class="form-row"><div style="float: left; margin-right: 10px;"> diff -r 2dc383cbb700f9d8d6a30eb976b70e8dcf1832db -r 72143d1079be191695e7ce2171926e891795bd7a templates/admin/dataset_security/role/role_rename.mako --- a/templates/admin/dataset_security/role/role_rename.mako +++ b/templates/admin/dataset_security/role/role_rename.mako @@ -12,14 +12,14 @@ <div class="form-row"><label>Name:</label><div style="float: left; width: 250px; margin-right: 10px;"> - <input type="text" name="name" value="${role.name}" size="40"/> + <input type="text" name="name" value="${role.name|h}" size="40"/></div><div style="clear: both"></div></div><div class="form-row"><label>Description:</label><div style="float: left; width: 250px; margin-right: 10px;"> - <input name="description" type="textfield" value="${role.description}" size=40"/> + <input name="description" type="textfield" value="${role.description|h}" size=40"/></div><div style="clear: both"></div></div> diff -r 2dc383cbb700f9d8d6a30eb976b70e8dcf1832db -r 72143d1079be191695e7ce2171926e891795bd7a templates/admin/external_service/create_external_service.mako --- a/templates/admin/external_service/create_external_service.mako +++ b/templates/admin/external_service/create_external_service.mako @@ -12,10 +12,10 @@ %if widgets: %for i, field in enumerate( widgets ): <div class="form-row"> - <label>${field['label']}:</label> + <label>${field['label']|h}:</label> ${field['widget'].get_html()} <div class="toolParamHelp" style="clear: both;"> - ${field['helptext']} + ${field['helptext']|h} </div><div style="clear: both"></div></div> diff -r 2dc383cbb700f9d8d6a30eb976b70e8dcf1832db -r 72143d1079be191695e7ce2171926e891795bd7a templates/admin/external_service/edit_external_service.mako --- a/templates/admin/external_service/edit_external_service.mako +++ b/templates/admin/external_service/edit_external_service.mako @@ -25,10 +25,10 @@ <div class="toolFormTitle">Edit external service</div> %for i, field in enumerate( widgets ): <div class="form-row"> - <label>${field['label']}:</label> + <label>${field['label']|h}:</label> ${field['widget'].get_html()} <div class="toolParamHelp" style="clear: both;"> - ${field['helptext']} + ${field['helptext']|h} </div><div style="clear: both"></div></div> diff -r 2dc383cbb700f9d8d6a30eb976b70e8dcf1832db -r 72143d1079be191695e7ce2171926e891795bd7a templates/admin/jobs.mako --- a/templates/admin/jobs.mako +++ b/templates/admin/jobs.mako @@ -63,12 +63,12 @@ </td><td>${job.id}</td> %if job.history and job.history.user: - <td>${job.history.user.email}</td> + <td>${job.history.user.email|h}</td> %else: <td>anonymous</td> %endif <td>${last_updated[job.id]} ago</td> - <td>${job.tool_id}</td> + <td>${job.tool_id|h}</td><td>${job.state}</td><% try: @@ -77,8 +77,8 @@ inputs = 'Unable to determine inputs' %><td>${inputs}</td> - <td>${job.command_line}</td> - <td>${job.job_runner_name}</td> + <td>${job.command_line|h}</td> + <td>${job.job_runner_name|h}</td><td>${job.job_runner_external_id}</td></tr> %endfor @@ -131,12 +131,12 @@ %for job in recent_jobs: <td><a href="${h.url_for( controller="admin", action="job_info" )}?jobid=${job.id}">${job.id}</a></td> %if job.history and job.history.user: - <td>${job.history.user.email}</td> + <td>${job.history.user.email|h}</td> %else: <td>anonymous</td> %endif <td>${finished[job.id]} ago</td> - <td>${job.tool_id}</td> + <td>${job.tool_id|h}</td><td>${job.state}</td><% try: @@ -145,9 +145,9 @@ inputs = 'Unable to determine inputs' %><td>${inputs}</td> - <td>${job.command_line}</td> - <td>${job.job_runner_name}</td> - <td>${job.job_runner_external_id}</td> + <td>${job.command_line|h}</td> + <td>${job.job_runner_name|h}</td> + <td>${job.job_runner_external_id|h}</td></tr> %endfor </table> diff -r 2dc383cbb700f9d8d6a30eb976b70e8dcf1832db -r 72143d1079be191695e7ce2171926e891795bd7a templates/admin/memdump.mako --- a/templates/admin/memdump.mako +++ b/templates/admin/memdump.mako @@ -55,7 +55,7 @@ <br/> You are here: ${breadcrumb}<br/> %if breadcrumb.endswith( 'theone' ): - ${heap} + ${heap|h} %else: <nobr> Sort: diff -r 2dc383cbb700f9d8d6a30eb976b70e8dcf1832db -r 72143d1079be191695e7ce2171926e891795bd7a templates/admin/package_tool.mako --- a/templates/admin/package_tool.mako +++ b/templates/admin/package_tool.mako @@ -28,9 +28,9 @@ <select name="tool_id"> %for key, val in toolbox.tool_panel.items(): %if isinstance( val, Tool ): - <option value="${val.id}">${val.name}</option> + <option value="${val.id|h}">${val.name|h}</option> %elif isinstance( val, ToolSection ): - <optgroup label="${val.name}"> + <optgroup label="${val.name|h}"><% section = val %> %for section_key, section_val in section.elems.items(): %if isinstance( section_val, Tool ): @@ -38,7 +38,7 @@ %if section_val.id == tool_id: <% selected_str = " selected=\"selected\"" %> %endif - <option value="${section_val.id}"${selected_str}>${section_val.name}</option> + <option value="${section_val.id|h}"${selected_str}>${section_val.name|h}</option> %endif %endfor %endif diff -r 2dc383cbb700f9d8d6a30eb976b70e8dcf1832db -r 72143d1079be191695e7ce2171926e891795bd7a templates/admin/quota/quota.mako --- a/templates/admin/quota/quota.mako +++ b/templates/admin/quota/quota.mako @@ -11,9 +11,9 @@ </%def><%def name="render_select( name, options )"> - <select name="${name}" id="${name}" style="min-width: 250px; height: 150px;" multiple> + <select name="${name|h}" id="${name|h}" style="min-width: 250px; height: 150px;" multiple> %for option in options: - <option value="${option[0]}">${option[1]}</option> + <option value="${option[0]|h}">${option[1]|h}</option> %endfor </select></%def> @@ -48,29 +48,29 @@ %endif <div class="toolForm"> - <div class="toolFormTitle">Quota '${name}'</div> + <div class="toolFormTitle">Quota '${name|h}'</div><div class="toolFormBody"><form name="associate_quota_user_group" id="associate_quota_user_group" action="${h.url_for(controller='admin', action='manage_users_and_groups_for_quota', id=id )}" method="post" ><div class="form-row"><div style="float: left; margin-right: 10px;"> - <label>Users associated with '${name}'</label> + <label>Users associated with '${name|h}'</label> ${render_select( "in_users", in_users )}<br/><input type="submit" id="users_remove_button" value=">>"/></div><div> - <label>Users not associated with '${name}'</label> + <label>Users not associated with '${name|h}'</label> ${render_select( "out_users", out_users )}<br/><input type="submit" id="users_add_button" value="<<"/></div></div><div class="form-row"><div style="float: left; margin-right: 10px;"> - <label>Groups associated with '${name}'</label> + <label>Groups associated with '${name|h}'</label> ${render_select( "in_groups", in_groups )}<br/><input type="submit" id="groups_remove_button" value=">>"/></div><div> - <label>Groups not associated with '${name}'</label> + <label>Groups not associated with '${name|h}'</label> ${render_select( "out_groups", out_groups )}<br/><input type="submit" id="groups_add_button" value="<<"/></div> diff -r 2dc383cbb700f9d8d6a30eb976b70e8dcf1832db -r 72143d1079be191695e7ce2171926e891795bd7a templates/admin/quota/quota_create.mako --- a/templates/admin/quota/quota_create.mako +++ b/templates/admin/quota/quota_create.mako @@ -11,9 +11,9 @@ </%def><%def name="render_select( name, options )"> - <select name="${name}" id="${name}" style="min-width: 250px; height: 150px;" multiple> + <select name="${name|h}" id="${name|h}" style="min-width: 250px; height: 150px;" multiple> %for option in options: - <option value="${option[0]}">${option[1]}</option> + <option value="${option[0]|h}">${option[1]|h}</option> %endfor </select></%def> @@ -69,15 +69,15 @@ <form name="associate_quota_group_user" id="associate_quota_group_user" action="${h.url_for(controller='admin', action='create_quota' )}" method="post" ><div class="form-row"><label>Name:</label> - <input name="name" type="textfield" value="${name}" size=40"/> + <input name="name" type="textfield" value="${name|h}" size=40"/></div><div class="form-row"><label>Description:</label> - <input name="description" type="textfield" value="${description}" size=40"/> + <input name="description" type="textfield" value="${description|h}" size=40"/></div><div class="form-row"><label>Amount</label> - <input name="amount" type="textfield" value="${amount}" size=40"/> + <input name="amount" type="textfield" value="${amount|h}" size=40"/><div class="toolParamHelp" style="clear: both;"> Examples: "10000MB", "99 gb", "0.2T", "unlimited" </div> diff -r 2dc383cbb700f9d8d6a30eb976b70e8dcf1832db -r 72143d1079be191695e7ce2171926e891795bd7a templates/admin/quota/quota_edit.mako --- a/templates/admin/quota/quota_edit.mako +++ b/templates/admin/quota/quota_edit.mako @@ -29,7 +29,7 @@ <input name="id" type="hidden" value="${id}"/><div class="form-row"><label>Amount</label> - <input name="amount" type="textfield" value="${display_amount}" size=40"/> + <input name="amount" type="textfield" value="${display_amount|h}" size=40"/><div class="toolParamHelp" style="clear: both;"> Examples: "10000MB", "99 gb", "0.2T", "unlimited" </div> diff -r 2dc383cbb700f9d8d6a30eb976b70e8dcf1832db -r 72143d1079be191695e7ce2171926e891795bd7a templates/admin/quota/quota_rename.mako --- a/templates/admin/quota/quota_rename.mako +++ b/templates/admin/quota/quota_rename.mako @@ -21,14 +21,14 @@ <div class="form-row"><label>Name:</label><div style="float: left; width: 250px; margin-right: 10px;"> - <input type="text" name="name" value="${name}" size="40"/> + <input type="text" name="name" value="${name|h}" size="40"/></div><div style="clear: both"></div></div><div class="form-row"><label>Description:</label><div style="float: left; width: 250px; margin-right: 10px;"> - <input name="description" type="textfield" value="${description}" size=40"/> + <input name="description" type="textfield" value="${description|h}" size=40"/></div><div style="clear: both"></div></div> diff -r 2dc383cbb700f9d8d6a30eb976b70e8dcf1832db -r 72143d1079be191695e7ce2171926e891795bd7a templates/admin/reload_tool.mako --- a/templates/admin/reload_tool.mako +++ b/templates/admin/reload_tool.mako @@ -28,9 +28,9 @@ <select name="tool_id"> %for key, val in toolbox.tool_panel.items(): %if isinstance( val, Tool ): - <option value="${val.id}">${val.name}</option> + <option value="${val.id}">${val.name|h}</option> %elif isinstance( val, ToolSection ): - <optgroup label="${val.name}"> + <optgroup label="${val.name|h}"><% section = val %> %for section_key, section_val in section.elems.items(): %if isinstance( section_val, Tool ): @@ -38,7 +38,7 @@ %if section_val.id == tool_id: <% selected_str = " selected=\"selected\"" %> %endif - <option value="${section_val.id}"${selected_str}>${section_val.name}</option> + <option value="${section_val.id}"${selected_str}>${section_val.name|h}</option> %endif %endfor %endif diff -r 2dc383cbb700f9d8d6a30eb976b70e8dcf1832db -r 72143d1079be191695e7ce2171926e891795bd7a templates/admin/review_tool_migration_stages.mako --- a/templates/admin/review_tool_migration_stages.mako +++ b/templates/admin/review_tool_migration_stages.mako @@ -4,7 +4,9 @@ %if message: ${render_msg( message, status )} %endif - +<% +from markupsafe import escape +%><div class="toolForm"><div class="toolFormTitle">Tool migrations that can be performed on this Galaxy instance</div><div class="toolFormBody"> @@ -51,7 +53,7 @@ repository_names.sort() repository_names = ', '.join( repository_names ) %> - <tr><td bgcolor="#D8D8D8"><b>Tool migration stage ${stage} - repositories: ${repository_names}</b></td></tr> + <tr><td bgcolor="#D8D8D8"><b>Tool migration stage ${stage} - repositories: ${repository_names|h}</b></td></tr><tr><td bgcolor="#FFFFCC"><div class="form-row"> @@ -59,11 +61,11 @@ <p> %if tool_dependencies: This migration stage includes tools that have tool dependencies that can be automatically installed. To install them, run:<br/> - <b>${install_dependencies}</b><br/><br/> + <b>${install_dependencies|h}</b><br/><br/> To skip tool dependency installation run:<br/> - <b>${migration_command}</b> + <b>${migration_command|h}</b> %else: - <b>${migration_command}</b> + <b>${migration_command|h}</b> %endif </p></div> @@ -74,7 +76,7 @@ <tr><td bgcolor="#DADFEF"><div class="form-row"> - <b>Repository:</b> ${repository_name} + <b>Repository:</b> ${repository_name|h} </div></td></tr> @@ -88,10 +90,10 @@ </tr> %for tool_dependencies_tup in tool_dependencies: <% - tool_dependency_name = tool_dependencies_tup[0] - tool_dependency_version = tool_dependencies_tup[1] - tool_dependency_type = tool_dependencies_tup[2] - installation_requirements = tool_dependencies_tup[3].replace( '\n', '<br/>' ) + tool_dependency_name = escape( tool_dependencies_tup[0] ) + tool_dependency_version = escape( tool_dependencies_tup[1] ) + tool_dependency_type = escape( tool_dependencies_tup[2] ) + installation_requirements = escape( tool_dependencies_tup[3] ).replace( '\n', '<br/>' ) %><tr><td> diff -r 2dc383cbb700f9d8d6a30eb976b70e8dcf1832db -r 72143d1079be191695e7ce2171926e891795bd7a templates/admin/tool_shed_repository/browse_repository.mako --- a/templates/admin/tool_shed_repository/browse_repository.mako +++ b/templates/admin/tool_shed_repository/browse_repository.mako @@ -21,7 +21,7 @@ %endif <div class="toolForm"> - <div class="toolFormTitle">Browse ${repository.name} revision ${repository.changeset_revision} files</div> + <div class="toolFormTitle">Browse ${repository.name|h} revision ${repository.changeset_revision} files</div><div class="toolFormBody"><div class="form-row" ><label>Contents:</label> diff -r 2dc383cbb700f9d8d6a30eb976b70e8dcf1832db -r 72143d1079be191695e7ce2171926e891795bd7a templates/admin/tool_shed_repository/browse_tool_dependency.mako --- a/templates/admin/tool_shed_repository/browse_tool_dependency.mako +++ b/templates/admin/tool_shed_repository/browse_tool_dependency.mako @@ -23,33 +23,33 @@ %endif <div class="toolForm"> - <div class="toolFormTitle">Browse tool dependency ${tool_dependency.name} installation directory</div> + <div class="toolFormTitle">Browse tool dependency ${tool_dependency.name|h} installation directory</div><div class="toolFormBody"><div class="form-row" ><label>Tool shed repository:</label> - ${repository.name} + ${repository.name|h} <div style="clear: both"></div></div><div class="form-row" ><label>Tool shed repository changeset revision:</label> - ${repository.changeset_revision} + ${repository.changeset_revision|h} <div style="clear: both"></div></div><div class="form-row" ><label>Tool dependency status:</label> - ${tool_dependency.status} + ${tool_dependency.status|h} <div style="clear: both"></div></div> %if tool_dependency.in_error_state: <div class="form-row" ><label>Tool dependency installation error:</label> - ${tool_dependency.error_message} + ${tool_dependency.error_message|h} <div style="clear: both"></div></div> %endif <div class="form-row" ><label>Tool dependency installation directory:</label> - ${tool_dependency.installation_directory( trans.app )} + ${tool_dependency.installation_directory( trans.app )|h} <div style="clear: both"></div></div><div class="form-row" > This diff is so big that we needed to truncate the remainder. https://bitbucket.org/galaxy/galaxy-central/commits/ba401d5b9aa0/ Changeset: ba401d5b9aa0 Branch: peterjc/clearer-error-messages-where-parameter-v-1418233351514 User: davebgx Date: 2014-12-11 19:23:18+00:00 Summary: Close branch peterjc/clearer-error-messages-where-parameter-v-1418233351514. Affected #: 0 files Repository URL: https://bitbucket.org/galaxy/galaxy-central/ -- This is a commit notification from bitbucket.org. You are receiving this because you have the service enabled, addressing the recipient of this email.

1 0

commit/galaxy-central: martenson: Merged in davebgx/galaxy-central/stable (pull request #606)
by commits-noreply＠bitbucket.org 11 Dec '14

11 Dec '14

1 new commit in galaxy-central: https://bitbucket.org/galaxy/galaxy-central/commits/e416697be38e/ Changeset: e416697be38e Branch: stable User: martenson Date: 2014-12-11 18:08:35+00:00 Summary: Merged in davebgx/galaxy-central/stable (pull request #606) [STABLE] Escape instances of message passed in through kwd before pushing them back out to mako. Affected #: 14 files diff -r 0ac7297b58491d542948ae3976732dd2c3450b89 -r e416697be38e66f18be89a4cfca70457c9784294 lib/galaxy/web/base/controllers/admin.py --- a/lib/galaxy/web/base/controllers/admin.py +++ b/lib/galaxy/web/base/controllers/admin.py @@ -7,6 +7,7 @@ from galaxy.web.form_builder import CheckboxField from string import punctuation as PUNCTUATION import galaxy.queue_worker +from markupsafe import escape from tool_shed.util import shed_util_common as suc @@ -28,7 +29,7 @@ @web.expose @web.require_admin def index( self, trans, **kwd ): - message = kwd.get( 'message', '' ) + message = escape( kwd.get( 'message', '' ) ) status = kwd.get( 'status', 'done' ) if trans.webapp.name == 'galaxy': installed_repositories = trans.install_model.context.query( trans.install_model.ToolShedRepository ).first() @@ -46,7 +47,7 @@ @web.expose @web.require_admin def center( self, trans, **kwd ): - message = kwd.get( 'message', '' ) + message = escape( kwd.get( 'message', '' ) ) status = kwd.get( 'status', 'done' ) if trans.webapp.name == 'galaxy': return trans.fill_template( '/webapps/galaxy/admin/center.mako', diff -r 0ac7297b58491d542948ae3976732dd2c3450b89 -r e416697be38e66f18be89a4cfca70457c9784294 lib/galaxy/webapps/demo_sequencer/controllers/common.py --- a/lib/galaxy/webapps/demo_sequencer/controllers/common.py +++ b/lib/galaxy/webapps/demo_sequencer/controllers/common.py @@ -4,6 +4,7 @@ import time, socket, urllib, urllib2, base64, copy from galaxy.util.json import * from urllib import quote_plus, unquote_plus +from markupsafe import escape import logging log = logging.getLogger( __name__ ) @@ -16,7 +17,7 @@ titles = util.listify( titles ) JobId = util.restore_text( kwd.get( 'JobId', '' ) ) sample_id = util.restore_text( kwd.get( 'sample_id', '' ) ) - message = util.restore_text( kwd.get( 'message', '' ) ) + message = escape( util.restore_text( kwd.get( 'message', '' ) ) ) status = kwd.get( 'status', 'done' ) redirect_delay = trans.app.sequencer_actions_registry.redirect_delay sequencer_redirects = copy.deepcopy( trans.app.sequencer_actions_registry.sequencer_redirects ) @@ -144,7 +145,7 @@ titles = util.restore_text( kwd.get( 'titles', '' ) ) JobId = util.restore_text( kwd.get( 'JobId', '' ) ) sample_id = util.restore_text( kwd.get( 'sample_id', '' ) ) - message = util.restore_text( kwd.get( 'message', '' ) ) + message = escape( util.restore_text( kwd.get( 'message', '' ) ) ) status = kwd.get( 'status', 'done' ) url, http_method, request_params, response_type = request_tup url = unquote_plus( url ) diff -r 0ac7297b58491d542948ae3976732dd2c3450b89 -r e416697be38e66f18be89a4cfca70457c9784294 lib/galaxy/webapps/galaxy/controllers/admin.py --- a/lib/galaxy/webapps/galaxy/controllers/admin.py +++ b/lib/galaxy/webapps/galaxy/controllers/admin.py @@ -17,6 +17,7 @@ from galaxy.web.params import QuotaParamParser from tool_shed.util import common_util from tool_shed.util import encoding_util +from markupsafe import escape log = logging.getLogger( __name__ ) @@ -838,7 +839,7 @@ @web.expose @web.require_admin def review_tool_migration_stages( self, trans, **kwd ): - message = galaxy.util.restore_text( kwd.get( 'message', '' ) ) + message = escape( galaxy.util.restore_text( kwd.get( 'message', '' ) ) ) status = galaxy.util.restore_text( kwd.get( 'status', 'done' ) ) migration_stages_dict = odict() migration_modules = [] @@ -870,13 +871,13 @@ @web.expose @web.require_admin def view_datatypes_registry( self, trans, **kwd ): - message = galaxy.util.restore_text( kwd.get( 'message', '' ) ) + message = escape( galaxy.util.restore_text( kwd.get( 'message', '' ) ) ) status = galaxy.util.restore_text( kwd.get( 'status', 'done' ) ) return trans.fill_template( 'admin/view_datatypes_registry.mako', message=message, status=status ) @web.expose @web.require_admin def view_tool_data_tables( self, trans, **kwd ): - message = galaxy.util.restore_text( kwd.get( 'message', '' ) ) + message = escape( galaxy.util.restore_text( kwd.get( 'message', '' ) ) ) status = galaxy.util.restore_text( kwd.get( 'status', 'done' ) ) return trans.fill_template( 'admin/view_data_tables_registry.mako', message=message, status=status ) diff -r 0ac7297b58491d542948ae3976732dd2c3450b89 -r e416697be38e66f18be89a4cfca70457c9784294 lib/galaxy/webapps/galaxy/controllers/admin_toolshed.py --- a/lib/galaxy/webapps/galaxy/controllers/admin_toolshed.py +++ b/lib/galaxy/webapps/galaxy/controllers/admin_toolshed.py @@ -8,6 +8,7 @@ from galaxy.web.form_builder import CheckboxField from galaxy.util import json from galaxy.model.orm import or_ +from markupsafe import escape import tool_shed.repository_types.util as rt_util @@ -52,7 +53,7 @@ try: trans.app.installed_repository_manager.activate_repository( repository ) except Exception, e: - error_message = "Error activating repository %s: %s" % ( repository.name, str( e ) ) + error_message = "Error activating repository %s: %s" % ( escape( repository.name ), str( e ) ) log.exception( error_message ) message = '%s.<br/>You may be able to resolve this by uninstalling and then reinstalling the repository. Click <a href="%s">here</a> to uninstall the repository.' \ % ( error_message, web.url_for( controller='admin_toolshed', action='deactivate_or_uninstall_repository', id=trans.security.encode_id( repository.id ) ) ) @@ -62,7 +63,7 @@ id=repository_id, message=message, status=status ) ) - message = 'The <b>%s</b> repository has been activated.' % repository.name + message = 'The <b>%s</b> repository has been activated.' % escape( repository.name ) status = 'done' return trans.response.send_redirect( web.url_for( controller='admin_toolshed', action='browse_repositories', @@ -72,7 +73,7 @@ @web.expose @web.require_admin def browse_repository( self, trans, **kwd ): - message = kwd.get( 'message', '' ) + message = escape( kwd.get( 'message', '' ) ) status = kwd.get( 'status', 'done' ) repository = repository_util.get_installed_tool_shed_repository( trans.app, kwd[ 'id' ] ) return trans.fill_template( '/admin/tool_shed_repository/browse_repository.mako', @@ -141,7 +142,7 @@ action='reselect_tool_panel_section', **kwd ) ) else: - message = "Unable to get latest revision for repository <b>%s</b> from " % str( repository.name ) + message = "Unable to get latest revision for repository <b>%s</b> from " % escape( str( repository.name ) ) message += "the Tool Shed, so repository re-installation is not possible at this time." status = "error" return trans.response.send_redirect( web.url_for( controller='admin_toolshed', @@ -169,7 +170,7 @@ @web.expose @web.require_admin def browse_tool_dependency( self, trans, **kwd ): - message = kwd.get( 'message', '' ) + message = escape( kwd.get( 'message', '' ) ) status = kwd.get( 'status', 'done' ) tool_dependency_ids = tool_dependency_util.get_tool_dependency_ids( as_string=False, **kwd ) tool_dependency = tool_dependency_util.get_tool_dependency( trans.app, tool_dependency_ids[ 0 ] ) @@ -197,7 +198,7 @@ @web.expose @web.require_admin def browse_tool_sheds( self, trans, **kwd ): - message = kwd.get( 'message', '' ) + message = escape( kwd.get( 'message', '' ) ) status = kwd.get( 'status', 'done' ) return trans.fill_template( '/webapps/galaxy/admin/tool_sheds.mako', message=message, @@ -230,7 +231,7 @@ require the same entry. For now we'll never delete entries from config.shed_tool_data_table_config, but we may choose to do so in the future if it becomes necessary. """ - message = kwd.get( 'message', '' ) + message = escape( kwd.get( 'message', '' ) ) status = kwd.get( 'status', 'done' ) remove_from_disk = kwd.get( 'remove_from_disk', '' ) remove_from_disk_checked = CheckboxField.is_checked( remove_from_disk ) @@ -303,14 +304,14 @@ trans.install_model.context.add( tool_shed_repository ) trans.install_model.context.flush() if remove_from_disk_checked: - message = 'The repository named <b>%s</b> has been uninstalled. ' % tool_shed_repository.name + message = 'The repository named <b>%s</b> has been uninstalled. ' % escape( tool_shed_repository.name ) if errors: message += 'Attempting to uninstall tool dependencies resulted in errors: %s' % errors status = 'error' else: status = 'done' else: - message = 'The repository named <b>%s</b> has been deactivated. ' % tool_shed_repository.name + message = 'The repository named <b>%s</b> has been deactivated. ' % escape( tool_shed_repository.name ) status = 'done' return trans.response.send_redirect( web.url_for( controller='admin_toolshed', action='browse_repositories', @@ -442,7 +443,7 @@ @web.require_admin def import_workflow( self, trans, workflow_name, repository_id, **kwd ): """Import a workflow contained in an installed tool shed repository into Galaxy.""" - message = kwd.get( 'message', '' ) + message = escape( kwd.get( 'message', '' ) ) status = kwd.get( 'status', 'done' ) if workflow_name: workflow_name = encoding_util.tool_shed_decode( workflow_name ) @@ -453,7 +454,7 @@ workflow_name = encoding_util.tool_shed_encode( str( workflow.name ) ) else: message += 'Unable to locate a workflow named <b>%s</b> within the installed tool shed repository named <b>%s</b>' % \ - ( str( workflow_name ), str( repository.name ) ) + ( escape( str( workflow_name ) ), escape( str( repository.name ) ) ) status = 'error' else: message = 'Invalid repository id <b>%s</b> received.' % str( repository_id ) @@ -479,7 +480,7 @@ tool shed repository. """ # Get the tool_shed_repository from one of the tool_dependencies. - message = kwd.get( 'message', '' ) + message = escape( kwd.get( 'message', '' ) ) status = kwd.get( 'status', 'done' ) err_msg = '' tool_shed_repository = tool_dependencies[ 0 ].tool_shed_repository @@ -512,7 +513,7 @@ @web.require_admin def install_latest_repository_revision( self, trans, **kwd ): """Install the latest installable revision of a repository that has been previously installed.""" - message = kwd.get( 'message', '' ) + message = escape( kwd.get( 'message', '' ) ) status = kwd.get( 'status', 'done' ) repository_id = kwd.get( 'id', None ) if repository_id is not None: @@ -589,7 +590,7 @@ updating_to_changeset_revision = kwd.get( 'updating_to_changeset_revision', None ) updating_to_ctx_rev = kwd.get( 'updating_to_ctx_rev', None ) encoded_updated_metadata = kwd.get( 'encoded_updated_metadata', None ) - message = kwd.get( 'message', '' ) + message = escape( kwd.get( 'message', '' ) ) status = kwd.get( 'status', 'done' ) install_tool_dependencies = CheckboxField.is_checked( kwd.get( 'install_tool_dependencies', '' ) ) if 'install_tool_dependencies_with_update_button' in kwd: @@ -609,7 +610,7 @@ relative_install_dir, set_status=False ) message = "The installed repository named '%s' has been updated to change set revision '%s'. " % \ - ( str( repository.name ), updating_to_changeset_revision ) + ( escape( str( repository.name ) ), updating_to_changeset_revision ) self.initiate_tool_dependency_installation( trans, tool_dependencies, message=message, status=status ) # Handle tool dependencies check box. if trans.app.config.tool_dependency_dir is None: @@ -665,7 +666,7 @@ @web.expose @web.require_admin def manage_repositories( self, trans, **kwd ): - message = kwd.get( 'message', '' ) + message = escape( kwd.get( 'message', '' ) ) status = kwd.get( 'status', 'done' ) tsridslist = common_util.get_tool_shed_repository_ids( **kwd ) if 'operation' in kwd: @@ -744,7 +745,7 @@ @web.expose @web.require_admin def manage_repository( self, trans, **kwd ): - message = kwd.get( 'message', '' ) + message = escape( kwd.get( 'message', '' ) ) status = kwd.get( 'status', 'done' ) repository_id = kwd.get( 'id', None ) if repository_id is None: @@ -808,7 +809,7 @@ @web.expose @web.require_admin def manage_repository_tool_dependencies( self, trans, **kwd ): - message = kwd.get( 'message', '' ) + message = escape( kwd.get( 'message', '' ) ) status = kwd.get( 'status', 'done' ) tool_dependency_ids = tool_dependency_util.get_tool_dependency_ids( as_string=False, **kwd ) if tool_dependency_ids: @@ -890,7 +891,7 @@ def manage_tool_dependencies( self, trans, **kwd ): # This method is called when tool dependencies are being installed. See the related manage_repository_tool_dependencies # method for managing the tool dependencies for a specified installed tool shed repository. - message = kwd.get( 'message', '' ) + message = escape( kwd.get( 'message', '' ) ) status = kwd.get( 'status', 'done' ) tool_dependency_ids = tool_dependency_util.get_tool_dependency_ids( as_string=False, **kwd ) repository_id = kwd.get( 'repository_id', None ) @@ -902,7 +903,7 @@ # The user must be on the manage_repository_tool_dependencies page and clicked the button to either install or uninstall a # tool dependency, but they didn't check any of the available tool dependencies on which to perform the action. tool_shed_repository = suc.get_tool_shed_repository_by_id( trans.app, repository_id ) - self.tool_dependency_grid.title = "Tool shed repository '%s' tool dependencies" % tool_shed_repository.name + self.tool_dependency_grid.title = "Tool shed repository '%s' tool dependencies" % escape( tool_shed_repository.name ) if 'operation' in kwd: operation = kwd[ 'operation' ].lower() if not tool_dependency_ids: @@ -978,7 +979,7 @@ message += 'of Galaxy Tool Shed repository tools into a local Galaxy instance</a> section of the Galaxy Tool ' message += 'Shed wiki for all of the details.' return trans.show_error_message( message ) - message = kwd.get( 'message', '' ) + message = escape( kwd.get( 'message', '' ) ) status = kwd.get( 'status', 'done' ) shed_tool_conf = kwd.get( 'shed_tool_conf', None ) tool_shed_url = kwd.get( 'tool_shed_url', '' ) @@ -1030,7 +1031,7 @@ # The Tool Shed cannot handle the get_repository_id request, so the code must be older than the # 04/2014 Galaxy release when it was introduced. It will be safest to error out and let the # Tool Shed admin update the Tool Shed to a later release. - message = 'The updates available for the repository <b>%s</b> ' % str( repository.name ) + message = 'The updates available for the repository <b>%s</b> ' % escape( str( repository.name ) ) message += 'include newly defined repository or tool dependency definitions, and attempting ' message += 'to update the repository resulted in the following error. Contact the Tool Shed ' message += 'administrator if necessary.<br/>%s' % str( e ) @@ -1314,7 +1315,7 @@ and tool dependencies of the repository. """ rdim = repository_dependency_manager.RepositoryDependencyInstallManager( trans.app ) - message = kwd.get( 'message', '' ) + message = escape( kwd.get( 'message', '' ) ) status = kwd.get( 'status', 'done' ) repository_id = kwd[ 'id' ] tool_shed_repository = repository_util.get_installed_tool_shed_repository( trans.app, repository_id ) @@ -1450,7 +1451,7 @@ Inspect the repository dependency hierarchy for a specified repository and attempt to make sure they are all properly installed as well as each repository's tool dependencies. """ - message = kwd.get( 'message', '' ) + message = escape( kwd.get( 'message', '' ) ) status = kwd.get( 'status', 'done' ) repository_id = kwd.get( 'id', None ) if not repository_id: @@ -1648,12 +1649,12 @@ no_changes_check_box = CheckboxField( 'no_changes', checked=True ) if original_section_name: message += "The tools contained in your <b>%s</b> repository were last loaded into the tool panel section <b>%s</b>. " \ - % ( tool_shed_repository.name, original_section_name ) + % ( escape( tool_shed_repository.name ), original_section_name ) message += "Uncheck the <b>No changes</b> check box and select a different tool panel section to load the tools in a " message += "different section in the tool panel. " status = 'warning' else: - message += "The tools contained in your <b>%s</b> repository were last loaded into the tool panel outside of any sections. " % tool_shed_repository.name + message += "The tools contained in your <b>%s</b> repository were last loaded into the tool panel outside of any sections. " % escape( tool_shed_repository.name ) message += "Uncheck the <b>No changes</b> check box and select a tool panel section to load the tools into that section. " status = 'warning' else: @@ -1715,7 +1716,7 @@ if 'reset_metadata_on_selected_repositories_button' in kwd: message, status = irmm.reset_metadata_on_selected_repositories( trans.user, **kwd ) else: - message = kwd.get( 'message', '' ) + message = escape( kwd.get( 'message', '' ) ) status = kwd.get( 'status', 'done' ) repositories_select_field = irmm.build_repository_ids_select_field() return trans.fill_template( '/admin/tool_shed_repository/reset_metadata_on_selected_repositories.mako', @@ -1749,13 +1750,13 @@ irmm.update_in_shed_tool_config() trans.install_model.context.add( repository ) trans.install_model.context.flush() - message = 'Metadata has been reset on repository <b>%s</b>.' % repository.name + message = 'Metadata has been reset on repository <b>%s</b>.' % escape( repository.name ) status = 'done' else: - message = 'Metadata did not need to be reset on repository <b>%s</b>.' % repository.name + message = 'Metadata did not need to be reset on repository <b>%s</b>.' % escape( repository.name ) status = 'done' else: - message = 'Error locating installation directory for repository <b>%s</b>.' % repository.name + message = 'Error locating installation directory for repository <b>%s</b>.' % escape( repository.name ) status = 'error' return trans.response.send_redirect( web.url_for( controller='admin_toolshed', action='manage_repository', @@ -1777,7 +1778,7 @@ uninstalled=False, remove_from_disk=True ) new_kwd = {} - new_kwd[ 'message' ] = "You can now attempt to install the repository named <b>%s</b> again." % str( repository.name ) + new_kwd[ 'message' ] = "You can now attempt to install the repository named <b>%s</b> again." % escape( str( repository.name ) ) new_kwd[ 'status' ] = "done" return trans.response.send_redirect( web.url_for( controller='admin_toolshed', action='browse_repositories', @@ -1808,7 +1809,7 @@ message = "Tool versions have been set for all included tools." status = 'done' else: - message = "Version information for the tools included in the <b>%s</b> repository is missing. " % repository.name + message = "Version information for the tools included in the <b>%s</b> repository is missing. " % escape( repository.name ) message += "Reset all of this reppository's metadata in the tool shed, then set the installed tool versions " message ++ "from the installed repository's <b>Repository Actions</b> menu. " status = 'error' @@ -1852,7 +1853,7 @@ @web.expose @web.require_admin def uninstall_tool_dependencies( self, trans, **kwd ): - message = kwd.get( 'message', '' ) + message = escape( kwd.get( 'message', '' ) ) status = kwd.get( 'status', 'done' ) tool_dependency_ids = tool_dependency_util.get_tool_dependency_ids( as_string=False, **kwd ) if not tool_dependency_ids: @@ -1897,7 +1898,7 @@ @web.require_admin def update_to_changeset_revision( self, trans, **kwd ): """Update a cloned repository to the latest revision possible.""" - message = kwd.get( 'message', '' ) + message = escape( kwd.get( 'message', '' ) ) status = kwd.get( 'status', 'done' ) tool_shed_url = kwd.get( 'tool_shed_url', '' ) # Handle protocol changes over time. @@ -2070,7 +2071,7 @@ @web.expose @web.require_admin def update_tool_shed_status_for_installed_repository( self, trans, all_installed_repositories=False, **kwd ): - message = kwd.get( 'message', '' ) + message = escape( kwd.get( 'message', '' ) ) status = kwd.get( 'status', 'done' ) if all_installed_repositories: success_count = 0 @@ -2083,7 +2084,7 @@ if ok: success_count += 1 else: - repository_names_not_updated.append( '<b>%s</b>' % str( repository.name ) ) + repository_names_not_updated.append( '<b>%s</b>' % escape( str( repository.name ) ) ) if updated: updated_count += 1 message = "Checked the status in the tool shed for %d repositories. " % success_count @@ -2098,11 +2099,11 @@ repository_util.check_or_update_tool_shed_status_for_installed_repository( trans.app, repository ) if ok: if updated: - message = "The tool shed status for repository <b>%s</b> has been updated." % str( repository.name ) + message = "The tool shed status for repository <b>%s</b> has been updated." % escape( str( repository.name ) ) else: - message = "The status has not changed in the tool shed for repository <b>%s</b>." % str( repository.name ) + message = "The status has not changed in the tool shed for repository <b>%s</b>." % escape( str( repository.name ) ) else: - message = "Unable to retrieve status from the tool shed for repository <b>%s</b>." % str( repository.name ) + message = "Unable to retrieve status from the tool shed for repository <b>%s</b>." % escape( str( repository.name ) ) status = 'error' return trans.response.send_redirect( web.url_for( controller='admin_toolshed', action='browse_repositories', @@ -2112,7 +2113,7 @@ @web.expose @web.require_admin def view_tool_metadata( self, trans, repository_id, tool_id, **kwd ): - message = kwd.get( 'message', '' ) + message = escape( kwd.get( 'message', '' ) ) status = kwd.get( 'status', 'done' ) repository = repository_util.get_installed_tool_shed_repository( trans.app, repository_id ) repository_metadata = repository.metadata @@ -2146,7 +2147,7 @@ @web.require_admin def view_workflow( self, trans, workflow_name=None, repository_id=None, **kwd ): """Retrieve necessary information about a workflow from the database so that it can be displayed in an svg image.""" - message = kwd.get( 'message', '' ) + message = escape( kwd.get( 'message', '' ) ) status = kwd.get( 'status', 'done' ) if workflow_name: workflow_name = encoding_util.tool_shed_decode( workflow_name ) diff -r 0ac7297b58491d542948ae3976732dd2c3450b89 -r e416697be38e66f18be89a4cfca70457c9784294 lib/galaxy/webapps/galaxy/controllers/library_admin.py --- a/lib/galaxy/webapps/galaxy/controllers/library_admin.py +++ b/lib/galaxy/webapps/galaxy/controllers/library_admin.py @@ -5,8 +5,9 @@ from galaxy import web from galaxy.web.base.controller import BaseUIController -from galaxy.web.framework.helpers import escape, grids, time_ago +from galaxy.web.framework.helpers import grids, time_ago from library_common import get_comptypes, lucene_search, whoosh_search +from markupsafe import escape # from galaxy.model.orm import * log = logging.getLogger( __name__ ) @@ -148,7 +149,7 @@ @web.expose @web.require_admin def create_library( self, trans, **kwd ): - message = kwd.get( 'message', '' ) + message = escape( kwd.get( 'message', '' ) ) status = kwd.get( 'status', 'done' ) if kwd.get( 'create_library_button', False ): name = kwd.get( 'name', 'No name' ) @@ -161,12 +162,12 @@ library.root_folder = root_folder trans.sa_session.add_all( ( library, root_folder ) ) trans.sa_session.flush() - message = "The new library named '%s' has been created" % library.name + message = "The new library named '%s' has been created" return trans.response.send_redirect( web.url_for( controller='library_common', action='browse_library', cntrller='library_admin', id=trans.security.encode_id( library.id ), - message=message, + message=escape( message ), status='done' ) ) return trans.fill_template( '/admin/library/new_library.mako', message=escape( message ), status=escape( status ) ) @web.expose diff -r 0ac7297b58491d542948ae3976732dd2c3450b89 -r e416697be38e66f18be89a4cfca70457c9784294 lib/galaxy/webapps/galaxy/controllers/library_common.py --- a/lib/galaxy/webapps/galaxy/controllers/library_common.py +++ b/lib/galaxy/webapps/galaxy/controllers/library_common.py @@ -20,7 +20,7 @@ from galaxy.util.streamball import StreamBall from galaxy.web.base.controller import BaseUIController, UsesFormDefinitionsMixin, UsesExtendedMetadataMixin, UsesLibraryMixinItems from galaxy.web.form_builder import AddressField, CheckboxField, SelectField, build_select_field -from galaxy.web.framework.helpers import escape +from markupsafe import escape from galaxy.model.orm import and_, eagerload_all # Whoosh is compatible with Python 2.5+ Try to import Whoosh and set flag to indicate whether tool search is enabled. @@ -93,7 +93,7 @@ @web.expose def browse_library( self, trans, cntrller='library', **kwd ): - message = kwd.get( 'message', '' ) + message = escape( kwd.get( 'message', '' ) ) status = kwd.get( 'status', 'done' ) # If use_panels is True, the library is being accessed via an external link # which did not originate from within the Galaxy instance, and the library will @@ -121,7 +121,7 @@ hidden_folder_ids = util.listify( kwd.get( 'hidden_folder_ids', '' ) ) if created_ldda_ids and not message: message = "%d datasets are uploading in the background to the library '%s' (each is selected). " % \ - ( len( created_ldda_ids.split( ',' ) ), library.name ) + ( len( created_ldda_ids.split( ',' ) ), escape( library.name ) ) message += "Don't navigate away from Galaxy or use the browser's \"stop\" or \"reload\" buttons (on this tab) until the " message += "message \"This job is running\" is cleared from the \"Information\" column below for each selected dataset." status = "info" @@ -152,7 +152,7 @@ message=escape( message ), status=escape( status ) ) except Exception, e: - message = 'Error attempting to display contents of library (%s): %s.' % ( str( library.name ), str( e ) ) + message = 'Error attempting to display contents of library (%s): %s.' % ( escape( str( library.name ) ), str( e ) ) status = 'error' default_action = kwd.get( 'default_action', None ) @@ -164,7 +164,7 @@ status=status ) ) @web.expose def library_info( self, trans, cntrller, **kwd ): - message = kwd.get( 'message', '' ) + message = escape( kwd.get( 'message', '' ) ) status = kwd.get( 'status', 'done' ) use_panels = util.string_as_bool( kwd.get( 'use_panels', False ) ) show_deleted = util.string_as_bool( kwd.get( 'show_deleted', False ) ) @@ -223,7 +223,7 @@ status=escape( status ) ) @web.expose def library_permissions( self, trans, cntrller, **kwd ): - message = kwd.get( 'message', '' ) + message = escape( kwd.get( 'message', '' ) ) status = kwd.get( 'status', 'done' ) use_panels = util.string_as_bool( kwd.get( 'use_panels', False ) ) show_deleted = util.string_as_bool( kwd.get( 'show_deleted', False ) ) @@ -269,7 +269,7 @@ status=escape( status ) ) @web.expose def create_folder( self, trans, cntrller, parent_id, library_id, **kwd ): - message = kwd.get( 'message', '' ) + message = escape( kwd.get( 'message', '' ) ) status = kwd.get( 'status', 'done' ) show_deleted = util.string_as_bool( kwd.get( 'show_deleted', False ) ) use_panels = util.string_as_bool( kwd.get( 'use_panels', False ) ) @@ -345,7 +345,7 @@ status=escape( status ) ) @web.expose def folder_info( self, trans, cntrller, id, library_id, **kwd ): - message = kwd.get( 'message', '' ) + message = escape( kwd.get( 'message', '' ) ) status = kwd.get( 'status', 'done' ) show_deleted = util.string_as_bool( kwd.get( 'show_deleted', False ) ) use_panels = util.string_as_bool( kwd.get( 'use_panels', False ) ) @@ -401,7 +401,7 @@ status=escape( status ) ) @web.expose def folder_permissions( self, trans, cntrller, id, library_id, **kwd ): - message = kwd.get( 'message', '' ) + message = escape( kwd.get( 'message', '' ) ) status = kwd.get( 'status', 'done' ) show_deleted = util.string_as_bool( kwd.get( 'show_deleted', False ) ) use_panels = util.string_as_bool( kwd.get( 'use_panels', False ) ) @@ -450,7 +450,7 @@ status=escape( status ) ) @web.expose def ldda_edit_info( self, trans, cntrller, library_id, folder_id, id, **kwd ): - message = kwd.get( 'message', '' ) + message = escape( kwd.get( 'message', '' ) ) status = kwd.get( 'status', 'done' ) show_deleted = util.string_as_bool( kwd.get( 'show_deleted', False ) ) use_panels = util.string_as_bool( kwd.get( 'use_panels', False ) ) @@ -505,7 +505,7 @@ old_name = ldda.name new_name = kwd.get( 'name', '' ) new_info = kwd.get( 'info', '' ) - new_message = kwd.get( 'message', '' ) + new_message = escape( kwd.get( 'message', '' ) ) if not new_name: message = 'Enter a valid name' status = 'error' @@ -602,7 +602,7 @@ status=escape( status ) ) @web.expose def ldda_info( self, trans, cntrller, library_id, folder_id, id, **kwd ): - message = kwd.get( 'message', '' ) + message = escape( kwd.get( 'message', '' ) ) status = kwd.get( 'status', 'done' ) show_deleted = util.string_as_bool( kwd.get( 'show_deleted', False ) ) show_associated_hdas_and_lddas = util.string_as_bool( kwd.get( 'show_associated_hdas_and_lddas', False ) ) @@ -650,7 +650,7 @@ status=escape( status ) ) @web.expose def ldda_permissions( self, trans, cntrller, library_id, folder_id, id, **kwd ): - message = kwd.get( 'message', '' ) + message = escape( kwd.get( 'message', '' ) ) status = kwd.get( 'status', 'done' ) show_deleted = util.string_as_bool( kwd.get( 'show_deleted', False ) ) use_panels = util.string_as_bool( kwd.get( 'use_panels', False ) ) @@ -787,9 +787,9 @@ status=escape( status ) ) @web.expose def upload_library_dataset( self, trans, cntrller, library_id, folder_id, **kwd ): - message = kwd.get( 'message', '' ) + message = escape( kwd.get( 'message', '' ) ) status = kwd.get( 'status', 'done' ) - ldda_message = kwd.get( 'ldda_message', '' ) + ldda_message = escape( kwd.get( 'ldda_message', '' ) ) deleted = util.string_as_bool( kwd.get( 'deleted', False ) ) show_deleted = util.string_as_bool( kwd.get( 'show_deleted', False ) ) use_panels = util.string_as_bool( kwd.get( 'use_panels', False ) ) @@ -1046,7 +1046,7 @@ dataset_upload_inputs.append( input ) # Library-specific params show_deleted = util.string_as_bool( kwd.get( 'show_deleted', False ) ) - message = kwd.get( 'message', '' ) + message = escape( kwd.get( 'message', '' ) ) status = kwd.get( 'status', 'done' ) server_dir = kwd.get( 'server_dir', '' ) if replace_dataset not in [ None, 'None' ]: @@ -1256,9 +1256,9 @@ @web.expose def add_history_datasets_to_library( self, trans, cntrller, library_id, folder_id, hda_ids='', **kwd ): - message = kwd.get( 'message', '' ) + message = escape( kwd.get( 'message', '' ) ) status = kwd.get( 'status', 'done' ) - ldda_message = kwd.get( 'ldda_message', '' ) + ldda_message = escape( kwd.get( 'ldda_message', '' ) ) show_deleted = kwd.get( 'show_deleted', False ) use_panels = util.string_as_bool( kwd.get( 'use_panels', False ) ) replace_id = kwd.get( 'replace_id', None ) @@ -1547,7 +1547,7 @@ status='error' ) ) @web.expose def library_dataset_info( self, trans, cntrller, id, library_id, **kwd ): - message = kwd.get( 'message', '' ) + message = escape( kwd.get( 'message', '' ) ) status = kwd.get( 'status', 'done' ) show_deleted = util.string_as_bool( kwd.get( 'show_deleted', False ) ) use_panels = util.string_as_bool( kwd.get( 'use_panels', False ) ) @@ -1595,7 +1595,7 @@ status=escape( status ) ) @web.expose def library_dataset_permissions( self, trans, cntrller, id, library_id, **kwd ): - message = kwd.get( 'message', '' ) + message = escape( kwd.get( 'message', '' ) ) status = kwd.get( 'status', 'done' ) show_deleted = util.string_as_bool( kwd.get( 'show_deleted', False ) ) use_panels = util.string_as_bool( kwd.get( 'use_panels', False ) ) @@ -1642,7 +1642,7 @@ status=escape( status ) ) @web.expose def make_library_item_public( self, trans, cntrller, library_id, item_type, id, **kwd ): - message = kwd.get( 'message', '' ) + message = escape( kwd.get( 'message', '' ) ) status = kwd.get( 'status', 'done' ) show_deleted = util.string_as_bool( kwd.get( 'show_deleted', False ) ) use_panels = util.string_as_bool( kwd.get( 'use_panels', False ) ) @@ -1703,7 +1703,7 @@ rval += '%s %i %s%s %s\r\n' % ( crc, size, self.url_base, quoted_fname, relpath ) return rval # Perform an action on a list of library datasets. - message = kwd.get( 'message', '' ) + message = escape( kwd.get( 'message', '' ) ) status = kwd.get( 'status', 'done' ) show_deleted = util.string_as_bool( kwd.get( 'show_deleted', False ) ) use_panels = util.string_as_bool( kwd.get( 'use_panels', False ) ) @@ -1979,7 +1979,7 @@ # - a select list option for acting on multiple selected datasets within a library # ( ldda_ids is a comma separated string of ldda ids ) # - a menu option for a library dataset search result set ( ldda_ids is a comma separated string of ldda ids ) - message = kwd.get( 'message', '' ) + message = escape( kwd.get( 'message', '' ) ) status = kwd.get( 'status', 'done' ) show_deleted = util.string_as_bool( kwd.get( 'show_deleted', False ) ) use_panels = util.string_as_bool( kwd.get( 'use_panels', False ) ) @@ -2102,7 +2102,7 @@ def manage_template_inheritance( self, trans, cntrller, item_type, library_id, folder_id=None, ldda_id=None, **kwd ): show_deleted = util.string_as_bool( kwd.get( 'show_deleted', False ) ) use_panels = util.string_as_bool( kwd.get( 'use_panels', False ) ) - message = kwd.get( 'message', '' ) + message = escape( kwd.get( 'message', '' ) ) status = kwd.get( 'status', 'done' ) is_admin = ( trans.user_is_admin() and cntrller == 'library_admin' ) current_user_roles = trans.get_current_user_roles() @@ -2152,7 +2152,7 @@ # 'ldda' and item_id is a comma separated string of ldda ids ) # - a menu option for a library dataset search result set ( item_type is 'ldda' and item_id is a # comma separated string of ldda ids ) - message = kwd.get( 'message', '' ) + message = escape( kwd.get( 'message', '' ) ) status = kwd.get( 'status', 'done' ) show_deleted = util.string_as_bool( kwd.get( 'show_deleted', False ) ) use_panels = util.string_as_bool( kwd.get( 'use_panels', False ) ) @@ -2723,7 +2723,7 @@ return map( operator.getitem, intermed, ( -1, ) * len( intermed ) ) def lucene_search( trans, cntrller, search_term, search_url, **kwd ): """Return display of results from a full-text lucene search of data libraries.""" - message = kwd.get( 'message', '' ) + message = escape( kwd.get( 'message', '' ) ) status = kwd.get( 'status', 'done' ) full_url = "%s/find?%s" % ( search_url, urllib.urlencode( { "kwd" : search_term } ) ) response = urllib2.urlopen( full_url ) @@ -2733,7 +2733,7 @@ return status, message, get_sorted_accessible_library_items( trans, cntrller, lddas, 'name' ) def whoosh_search( trans, cntrller, search_term, **kwd ): """Return display of results from a full-text whoosh search of data libraries.""" - message = kwd.get( 'message', '' ) + message = escape( kwd.get( 'message', '' ) ) status = kwd.get( 'status', 'done' ) ok = True if whoosh_search_enabled: diff -r 0ac7297b58491d542948ae3976732dd2c3450b89 -r e416697be38e66f18be89a4cfca70457c9784294 lib/galaxy/webapps/galaxy/controllers/user.py --- a/lib/galaxy/webapps/galaxy/controllers/user.py +++ b/lib/galaxy/webapps/galaxy/controllers/user.py @@ -28,9 +28,10 @@ from galaxy.web.base.controller import CreatesApiKeysMixin from galaxy.web.form_builder import CheckboxField from galaxy.web.form_builder import build_select_field -from galaxy.web.framework.helpers import time_ago, grids, escape +from galaxy.web.framework.helpers import time_ago, grids from datetime import datetime, timedelta from galaxy.util import hash_util, biostar +from markupsafe import escape log = logging.getLogger( __name__ ) @@ -254,7 +255,7 @@ if not trans.app.config.enable_openid: return trans.show_error_message( 'OpenID authentication is not enabled in this instance of Galaxy' ) use_panels = util.string_as_bool( kwd.get( 'use_panels', False ) ) - message = kwd.get( 'message', '' ) + message = escape( kwd.get( 'message', '' ) ) status = kwd.get( 'status', 'done' ) email = kwd.get( 'email', '' ) username = kwd.get( 'username', '' ) @@ -502,7 +503,7 @@ """ Function validates numerous cases that might happen during the login time. """ - message = kwd.get( 'message', '' ) + message = escape( kwd.get( 'message', '' ) ) status = kwd.get( 'status', 'error' ) email = kwd.get( 'email', '' ) password = kwd.get( 'password', '' ) @@ -719,7 +720,7 @@ email = util.restore_text( kwd.get( 'email', '' ) ) password = kwd.get( 'password', '' ) username = util.restore_text( kwd.get( 'username', '' ) ) - message = kwd.get( 'message', '' ) + message = escape( kwd.get( 'message', '' ) ) status = kwd.get( 'status', 'done' ) is_admin = cntrller == 'admin' and trans.user_is_admin() user = self.create_user( trans=trans, email=email, username=username, password=password ) @@ -1093,7 +1094,7 @@ def reset_password( self, trans, email=None, **kwd ): if trans.app.config.smtp_server is None: return trans.show_error_message( "Mail is not configured for this Galaxy instance. Please contact your local Galaxy administrator." ) - message = util.sanitize_text(util.restore_text( kwd.get( 'message', '' ) )) + message = util.sanitize_text( util.restore_text( kwd.get( 'message', '' ) ) ) status = kwd.get( 'status', 'done' ) if kwd.get( 'reset_password_button', False ): reset_user = trans.sa_session.query( trans.app.model.User ).filter( trans.app.model.User.table.c.email == email ).first() diff -r 0ac7297b58491d542948ae3976732dd2c3450b89 -r e416697be38e66f18be89a4cfca70457c9784294 lib/galaxy/webapps/galaxy/controllers/workflow.py --- a/lib/galaxy/webapps/galaxy/controllers/workflow.py +++ b/lib/galaxy/webapps/galaxy/controllers/workflow.py @@ -22,7 +22,7 @@ from galaxy.web import error, url_for from galaxy.web.base.controller import BaseUIController, SharableMixin, UsesStoredWorkflowMixin from galaxy.web.framework.formbuilder import form -from galaxy.web.framework.helpers import grids, time_ago, to_unicode, escape +from galaxy.web.framework.helpers import grids, time_ago, to_unicode from galaxy.workflow.modules import WorkflowModuleInjector from galaxy.workflow.modules import MissingToolException from galaxy.workflow.modules import module_factory, is_tool_module_type @@ -37,6 +37,7 @@ order_workflow_steps_with_levels, ) from galaxy.workflow.render import WorkflowCanvas, MARGIN, LINE_SPACING +from markupsafe import escape class StoredWorkflowListGrid( grids.Grid ): @@ -1021,7 +1022,7 @@ """ url = kwd.get( 'url', '' ) workflow_text = kwd.get( 'workflow_text', '' ) - message = kwd.get( 'message', '' ) + message = escape( kwd.get( 'message', '' ) ) status = kwd.get( 'status', 'done' ) import_button = kwd.get( 'import_button', False ) # The special Galaxy integration landing page's URL on myExperiment diff -r 0ac7297b58491d542948ae3976732dd2c3450b89 -r e416697be38e66f18be89a4cfca70457c9784294 lib/galaxy/webapps/reports/controllers/users.py --- a/lib/galaxy/webapps/reports/controllers/users.py +++ b/lib/galaxy/webapps/reports/controllers/users.py @@ -9,17 +9,19 @@ pkg_resources.require( "SQLAlchemy >= 0.4" ) import sqlalchemy as sa import logging +from markupsafe import escape + log = logging.getLogger( __name__ ) class Users( BaseUIController ): @web.expose def registered_users( self, trans, **kwd ): - message = util.restore_text( kwd.get( 'message', '' ) ) + message = escape( util.restore_text( kwd.get( 'message', '' ) ) ) num_users = trans.sa_session.query( galaxy.model.User ).count() return trans.fill_template( '/webapps/reports/registered_users.mako', num_users=num_users, message=message ) @web.expose def registered_users_per_month( self, trans, **kwd ): - message = util.restore_text( kwd.get( 'message', '' ) ) + message = escape( util.restore_text( kwd.get( 'message', '' ) ) ) q = sa.select( ( sa.func.date_trunc( 'month', sa.func.date( galaxy.model.User.table.c.create_time ) ).label( 'date' ), sa.func.count( galaxy.model.User.table.c.id ).label( 'num_users' ) ), from_obj = [ galaxy.model.User.table ], @@ -36,7 +38,7 @@ message=message ) @web.expose def specified_month( self, trans, **kwd ): - message = util.restore_text( kwd.get( 'message', '' ) ) + message = escape( util.restore_text( kwd.get( 'message', '' ) ) ) # If specified_date is not received, we'll default to the current month specified_date = kwd.get( 'specified_date', datetime.utcnow().strftime( "%Y-%m-%d" ) ) specified_month = specified_date[ :7 ] @@ -66,7 +68,7 @@ message=message ) @web.expose def specified_date( self, trans, **kwd ): - message = util.restore_text( kwd.get( 'message', '' ) ) + message = escape( util.restore_text( kwd.get( 'message', '' ) ) ) # If specified_date is not received, we'll default to the current month specified_date = kwd.get( 'specified_date', datetime.utcnow().strftime( "%Y-%m-%d" ) ) year, month, day = map( int, specified_date.split( "-" ) ) @@ -95,7 +97,7 @@ message=message ) @web.expose def last_access_date( self, trans, **kwd ): - message = util.restore_text( kwd.get( 'message', '' ) ) + message = escape( util.restore_text( kwd.get( 'message', '' ) ) ) not_logged_in_for_days = kwd.get( 'not_logged_in_for_days', 90 ) if not not_logged_in_for_days: not_logged_in_for_days = 0 @@ -120,7 +122,7 @@ @web.expose def user_disk_usage( self, trans, **kwd ): - message = util.restore_text( kwd.get( 'message', '' ) ) + message = escape( util.restore_text( kwd.get( 'message', '' ) ) ) user_cutoff = int( kwd.get( 'user_cutoff', 60 ) ) # disk_usage isn't indexed users = sorted( trans.sa_session.query( galaxy.model.User ).all(), key=operator.attrgetter( 'disk_usage' ), reverse=True ) diff -r 0ac7297b58491d542948ae3976732dd2c3450b89 -r e416697be38e66f18be89a4cfca70457c9784294 lib/galaxy/webapps/tool_shed/controllers/admin.py --- a/lib/galaxy/webapps/tool_shed/controllers/admin.py +++ b/lib/galaxy/webapps/tool_shed/controllers/admin.py @@ -3,6 +3,7 @@ from galaxy import util from galaxy.util import inflector from galaxy import web +from markupsafe import escape from galaxy.web.base.controller import BaseUIController from galaxy.web.base.controllers.admin import Admin @@ -121,7 +122,7 @@ @web.expose @web.require_admin def create_category( self, trans, **kwd ): - message = kwd.get( 'message', '' ) + message = escape( kwd.get( 'message', '' ) ) status = kwd.get( 'status', 'done' ) name = kwd.get( 'name', '' ).strip() description = kwd.get( 'description', '' ).strip() @@ -154,7 +155,7 @@ @web.expose @web.require_admin def delete_repository( self, trans, **kwd ): - message = kwd.get( 'message', '' ) + message = escape( kwd.get( 'message', '' ) ) status = kwd.get( 'status', 'done' ) id = kwd.get( 'id', None ) if id: @@ -197,7 +198,7 @@ @web.expose @web.require_admin def delete_repository_metadata( self, trans, **kwd ): - message = kwd.get( 'message', '' ) + message = escape( kwd.get( 'message', '' ) ) status = kwd.get( 'status', 'done' ) id = kwd.get( 'id', None ) if id: @@ -221,7 +222,7 @@ @web.expose @web.require_admin def edit_category( self, trans, **kwd ): - message = kwd.get( 'message', '' ) + message = escape( kwd.get( 'message', '' ) ) status = kwd.get( 'status', 'done' ) id = kwd.get( 'id', None ) if not id: @@ -306,7 +307,7 @@ @web.expose @web.require_admin def regenerate_statistics( self, trans, **kwd ): - message = kwd.get( 'message', '' ) + message = escape( kwd.get( 'message', '' ) ) status = kwd.get( 'status', 'done' ) if 'regenerate_statistics_button' in kwd: trans.app.shed_counter.generate_statistics() @@ -352,7 +353,7 @@ if 'reset_metadata_on_selected_repositories_button' in kwd: message, status = rmm.reset_metadata_on_selected_repositories( **kwd ) else: - message = util.restore_text( kwd.get( 'message', '' ) ) + message = escape( util.restore_text( kwd.get( 'message', '' ) ) ) status = kwd.get( 'status', 'done' ) repositories_select_field = rmm.build_repository_ids_select_field( name='repository_ids', multiple=True, @@ -366,7 +367,7 @@ @web.expose @web.require_admin def undelete_repository( self, trans, **kwd ): - message = kwd.get( 'message', '' ) + message = escape( kwd.get( 'message', '' ) ) status = kwd.get( 'status', 'done' ) id = kwd.get( 'id', None ) if id: @@ -417,7 +418,7 @@ # TODO: We should probably eliminate the Category.deleted column since it really makes no # sense to mark a category as deleted (category names and descriptions can be changed instead). # If we do this, and the following 2 methods can be eliminated. - message = kwd.get( 'message', '' ) + message = escape( kwd.get( 'message', '' ) ) status = kwd.get( 'status', 'done' ) id = kwd.get( 'id', None ) if id: @@ -445,7 +446,7 @@ # This method should only be called for a Category that has previously been deleted. # Purging a deleted Category deletes all of the following from the database: # - RepoitoryCategoryAssociations where category_id == Category.id - message = kwd.get( 'message', '' ) + message = escape( kwd.get( 'message', '' ) ) status = kwd.get( 'status', 'done' ) id = kwd.get( 'id', None ) if id: @@ -473,7 +474,7 @@ @web.expose @web.require_admin def undelete_category( self, trans, **kwd ): - message = kwd.get( 'message', '' ) + message = escape( kwd.get( 'message', '' ) ) status = kwd.get( 'status', 'done' ) id = kwd.get( 'id', None ) if id: diff -r 0ac7297b58491d542948ae3976732dd2c3450b89 -r e416697be38e66f18be89a4cfca70457c9784294 lib/galaxy/webapps/tool_shed/controllers/repository.py --- a/lib/galaxy/webapps/tool_shed/controllers/repository.py +++ b/lib/galaxy/webapps/tool_shed/controllers/repository.py @@ -6,6 +6,7 @@ from time import strftime from datetime import date from datetime import datetime +from markupsafe import escape from galaxy import util from galaxy import web @@ -385,7 +386,7 @@ action='reviewed_repositories_i_own' ) ) elif operation == "repositories_by_category": category_id = kwd.get( 'id', None ) - message = kwd.get( 'message', '' ) + message = escape( kwd.get( 'message', '' ) ) status = kwd.get( 'status', 'done' ) return trans.response.send_redirect( web.url_for( controller='repository', action='browse_repositories_in_category', @@ -721,9 +722,9 @@ @web.expose def browse_repository( self, trans, id, **kwd ): - message = kwd.get( 'message', '' ) + message = escape( kwd.get( 'message', '' ) ) status = kwd.get( 'status', 'done' ) - commit_message = kwd.get( 'commit_message', 'Deleted selected files' ) + commit_message = escape( kwd.get( 'commit_message', 'Deleted selected files' ) ) repository = suc.get_repository_in_tool_shed( trans.app, id ) repo = hg_util.get_repo_for_repository( trans.app, repository=repository, repo_path=None, create=False ) # Update repository files for browsing. @@ -891,7 +892,7 @@ @web.expose def check_for_updates( self, trans, **kwd ): """Handle a request from a local Galaxy instance.""" - message = kwd.get( 'message', '' ) + message = escape( kwd.get( 'message', '' ) ) status = kwd.get( 'status', 'done' ) # If the request originated with the UpdateRepositoryManager, it will not include a galaxy_url. galaxy_url = common_util.handle_galaxy_url( trans, **kwd ) @@ -976,7 +977,7 @@ @web.expose def contact_owner( self, trans, id, **kwd ): - message = kwd.get( 'message', '' ) + message = escape( kwd.get( 'message', '' ) ) status = kwd.get( 'status', 'done' ) repository = suc.get_repository_in_tool_shed( trans.app, id ) metadata = metadata_util.get_repository_metadata_by_repository_id_changeset_revision( trans.app, @@ -995,7 +996,7 @@ @web.expose def create_galaxy_docker_image( self, trans, **kwd ): - message = kwd.get( 'message', '' ) + message = escape( kwd.get( 'message', '' ) ) status = kwd.get( 'status', 'done' ) repository_ids = util.listify( kwd.get( 'id', '' ) ) if 'operation' in kwd: @@ -1051,7 +1052,7 @@ @web.expose def create_repository( self, trans, **kwd ): - message = kwd.get( 'message', '' ) + message = escape( kwd.get( 'message', '' ) ) status = kwd.get( 'status', 'done' ) categories = suc.get_categories( trans ) if not categories: @@ -1108,7 +1109,7 @@ # Marking a repository in the tool shed as deprecated has no effect on any downloadable changeset # revisions that may be associated with the repository. Revisions are not marked as not downlaodable # because those that have installed the repository must be allowed to get updates. - message = kwd.get( 'message', '' ) + message = escape( kwd.get( 'message', '' ) ) status = kwd.get( 'status', 'done' ) repository_id = kwd.get( 'id', None ) repository = suc.get_repository_in_tool_shed( trans.app, repository_id ) @@ -1164,7 +1165,7 @@ @web.expose def display_tool( self, trans, repository_id, tool_config, changeset_revision, **kwd ): - message = kwd.get( 'message', '' ) + message = escape( kwd.get( 'message', '' ) ) status = kwd.get( 'status', 'done' ) render_repository_actions_for = kwd.get( 'render_repository_actions_for', 'tool_shed' ) tv = tool_validator.ToolValidator( trans.app ) @@ -1229,7 +1230,7 @@ @web.expose def export( self, trans, repository_id, changeset_revision, **kwd ): - message = kwd.get( 'message', '' ) + message = escape( kwd.get( 'message', '' ) ) status = kwd.get( 'status', 'done' ) export_repository_dependencies = kwd.get( 'export_repository_dependencies', '' ) repository = suc.get_repository_in_tool_shed( trans.app, repository_id ) @@ -1309,7 +1310,7 @@ @web.expose def find_tools( self, trans, **kwd ): - message = kwd.get( 'message', '' ) + message = escape( kwd.get( 'message', '' ) ) status = kwd.get( 'status', 'done' ) galaxy_url = common_util.handle_galaxy_url( trans, **kwd ) if 'operation' in kwd: @@ -1400,7 +1401,7 @@ @web.expose def find_workflows( self, trans, **kwd ): - message = kwd.get( 'message', '' ) + message = escape( kwd.get( 'message', '' ) ) status = kwd.get( 'status', 'done' ) galaxy_url = common_util.handle_galaxy_url( trans, **kwd ) if 'operation' in kwd: @@ -2020,13 +2021,13 @@ @web.expose def help( self, trans, **kwd ): - message = kwd.get( 'message', '' ) + message = escape( kwd.get( 'message', '' ) ) status = kwd.get( 'status', 'done' ) return trans.fill_template( '/webapps/tool_shed/repository/help.mako', message=message, status=status, **kwd ) @web.expose def import_capsule( self, trans, **kwd ): - message = kwd.get( 'message', '' ) + message = escape( kwd.get( 'message', '' ) ) status = kwd.get( 'status', 'done' ) capsule_file_name = kwd.get( 'capsule_file_name', None ) encoded_file_path = kwd.get( 'encoded_file_path', None ) @@ -2069,7 +2070,7 @@ @web.expose def index( self, trans, **kwd ): - message = kwd.get( 'message', '' ) + message = escape( kwd.get( 'message', '' ) ) status = kwd.get( 'status', 'done' ) # See if there are any RepositoryMetadata records since menu items require them. repository_metadata = trans.sa_session.query( trans.model.RepositoryMetadata ).first() @@ -2151,7 +2152,7 @@ @web.expose def load_invalid_tool( self, trans, repository_id, tool_config, changeset_revision, **kwd ): - message = kwd.get( 'message', '' ) + message = escape( kwd.get( 'message', '' ) ) status = kwd.get( 'status', 'error' ) render_repository_actions_for = kwd.get( 'render_repository_actions_for', 'tool_shed' ) tv = tool_validator.ToolValidator( trans.app ) @@ -2203,7 +2204,7 @@ @web.expose @web.require_login( "manage email alerts" ) def manage_email_alerts( self, trans, **kwd ): - message = kwd.get( 'message', '' ) + message = escape( kwd.get( 'message', '' ) ) status = kwd.get( 'status', 'done' ) new_repo_alert = kwd.get( 'new_repo_alert', '' ) new_repo_alert_checked = CheckboxField.is_checked( new_repo_alert ) @@ -2234,7 +2235,7 @@ @web.expose @web.require_login( "manage repository" ) def manage_repository( self, trans, id, **kwd ): - message = kwd.get( 'message', '' ) + message = escape( kwd.get( 'message', '' ) ) status = kwd.get( 'status', 'done' ) repository = suc.get_repository_in_tool_shed( trans.app, id ) repository_type = kwd.get( 'repository_type', str( repository.type ) ) @@ -2500,7 +2501,7 @@ @web.expose @web.require_login( "manage repository administrators" ) def manage_repository_admins( self, trans, id, **kwd ): - message = kwd.get( 'message', '' ) + message = escape( kwd.get( 'message', '' ) ) status = kwd.get( 'status', 'done' ) repository = suc.get_repository_in_tool_shed( trans.app, id ) changeset_revision = kwd.get( 'changeset_revision', repository.tip( trans.app ) ) @@ -2558,7 +2559,7 @@ @web.expose @web.require_login( "multi select email alerts" ) def multi_select_email_alerts( self, trans, **kwd ): - message = kwd.get( 'message', '' ) + message = escape( kwd.get( 'message', '' ) ) status = kwd.get( 'status', 'done' ) if 'operation' in kwd: operation = kwd[ 'operation' ].lower() @@ -2607,7 +2608,7 @@ @web.expose def preview_tools_in_changeset( self, trans, repository_id, **kwd ): - message = kwd.get( 'message', '' ) + message = escape( kwd.get( 'message', '' ) ) status = kwd.get( 'status', 'done' ) repository = suc.get_repository_in_tool_shed( trans.app, repository_id ) repo = hg_util.get_repo_for_repository( trans.app, repository=repository, repo_path=None, create=False ) @@ -2714,7 +2715,7 @@ @web.require_login( "rate repositories" ) def rate_repository( self, trans, **kwd ): """ Rate a repository and return updated rating data. """ - message = kwd.get( 'message', '' ) + message = escape( kwd.get( 'message', '' ) ) status = kwd.get( 'status', 'done' ) id = kwd.get( 'id', None ) if not id: @@ -2787,7 +2788,7 @@ if 'reset_metadata_on_selected_repositories_button' in kwd: message, status = rmm.reset_metadata_on_selected_repositories( **kwd ) else: - message = kwd.get( 'message', '' ) + message = escape( kwd.get( 'message', '' ) ) status = kwd.get( 'status', 'done' ) repositories_select_field = rmm.build_repository_ids_select_field( name='repository_ids', multiple=True, @@ -2800,9 +2801,9 @@ @web.expose def select_files_to_delete( self, trans, id, **kwd ): - message = kwd.get( 'message', '' ) + message = escape( kwd.get( 'message', '' ) ) status = kwd.get( 'status', 'done' ) - commit_message = kwd.get( 'commit_message', 'Deleted selected files' ) + commit_message = escape( kwd.get( 'commit_message', 'Deleted selected files' ) ) repository = suc.get_repository_in_tool_shed( trans.app, id ) repo_dir = repository.repo_path( trans.app ) repo = hg_util.get_repo_for_repository( trans.app, repository=None, repo_path=repo_dir, create=False ) @@ -3145,7 +3146,7 @@ @web.expose def upload_capsule( self, trans, **kwd ): - message = kwd.get( 'message', '' ) + message = escape( kwd.get( 'message', '' ) ) status = kwd.get( 'status', 'done' ) url = kwd.get( 'url', '' ) if 'upload_capsule_button' in kwd: @@ -3175,7 +3176,7 @@ @web.expose def view_changelog( self, trans, id, **kwd ): - message = kwd.get( 'message', '' ) + message = escape( kwd.get( 'message', '' ) ) status = kwd.get( 'status', 'done' ) repository = suc.get_repository_in_tool_shed( trans.app, id ) repo = hg_util.get_repo_for_repository( trans.app, repository=repository, repo_path=None, create=False ) @@ -3210,7 +3211,7 @@ @web.expose def view_changeset( self, trans, id, ctx_str, **kwd ): - message = kwd.get( 'message', '' ) + message = escape( kwd.get( 'message', '' ) ) status = kwd.get( 'status', 'done' ) repository = suc.get_repository_in_tool_shed( trans.app, id ) repo = hg_util.get_repo_for_repository( trans.app, repository=repository, repo_path=None, create=False ) @@ -3302,7 +3303,7 @@ @web.expose def view_repository( self, trans, id, **kwd ): - message = kwd.get( 'message', '' ) + message = escape( kwd.get( 'message', '' ) ) status = kwd.get( 'status', 'done' ) repository = suc.get_repository_in_tool_shed( trans.app, id ) repo = hg_util.get_repo_for_repository( trans.app, repository=repository, repo_path=None, create=False ) @@ -3390,7 +3391,7 @@ @web.expose def view_tool_metadata( self, trans, repository_id, changeset_revision, tool_id, **kwd ): - message = kwd.get( 'message', '' ) + message = escape( kwd.get( 'message', '' ) ) status = kwd.get( 'status', 'done' ) render_repository_actions_for = kwd.get( 'render_repository_actions_for', 'tool_shed' ) repository = suc.get_repository_in_tool_shed( trans.app, repository_id ) @@ -3471,7 +3472,7 @@ @web.expose def view_workflow( self, trans, workflow_name, repository_metadata_id, **kwd ): """Retrieve necessary information about a workflow from the database so that it can be displayed in an svg image.""" - message = kwd.get( 'message', '' ) + message = escape( kwd.get( 'message', '' ) ) status = kwd.get( 'status', 'done' ) render_repository_actions_for = kwd.get( 'render_repository_actions_for', 'tool_shed' ) if workflow_name: diff -r 0ac7297b58491d542948ae3976732dd2c3450b89 -r e416697be38e66f18be89a4cfca70457c9784294 lib/galaxy/webapps/tool_shed/controllers/repository_review.py --- a/lib/galaxy/webapps/tool_shed/controllers/repository_review.py +++ b/lib/galaxy/webapps/tool_shed/controllers/repository_review.py @@ -2,6 +2,7 @@ import os from sqlalchemy.sql.expression import func +from markupsafe import escape from galaxy import util from galaxy import web @@ -40,7 +41,7 @@ @web.require_login( "approve repository review" ) def approve_repository_review( self, trans, **kwd ): # The value of the received id is the encoded review id. - message = kwd.get( 'message', '' ) + message = escape( kwd.get( 'message', '' ) ) status = kwd.get( 'status', 'done' ) encoded_review_id = kwd[ 'id' ] review = review_util.get_review( trans.app, encoded_review_id ) @@ -74,7 +75,7 @@ @web.expose @web.require_login( "browse review" ) def browse_review( self, trans, **kwd ): - message = kwd.get( 'message', '' ) + message = escape( kwd.get( 'message', '' ) ) status = kwd.get( 'status', 'done' ) review = review_util.get_review( trans.app, kwd[ 'id' ] ) repository = review.repository @@ -105,7 +106,7 @@ @web.expose @web.require_login( "create component" ) def create_component( self, trans, **kwd ): - message = kwd.get( 'message', '' ) + message = escape( kwd.get( 'message', '' ) ) status = kwd.get( 'status', 'done' ) name = kwd.get( 'name', '' ) description = kwd.get( 'description', '' ) @@ -136,7 +137,7 @@ @web.require_login( "create review" ) def create_review( self, trans, **kwd ): # The value of the received id is the encoded repository id. - message = kwd.get( 'message', '' ) + message = escape( kwd.get( 'message', '' ) ) status = kwd.get( 'status', 'done' ) repository_id = kwd.get( 'id', None ) changeset_revision = kwd.get( 'changeset_revision', None ) @@ -201,7 +202,7 @@ @web.expose @web.require_login( "edit component" ) def edit_component( self, trans, **kwd ): - message = kwd.get( 'message', '' ) + message = escape( kwd.get( 'message', '' ) ) status = kwd.get( 'status', 'done' ) id = kwd.get( 'id', None ) if not id: @@ -232,7 +233,7 @@ @web.require_login( "edit review" ) def edit_review( self, trans, **kwd ): # The value of the received id is the encoded review id. - message = kwd.get( 'message', '' ) + message = escape( kwd.get( 'message', '' ) ) status = kwd.get( 'status', 'done' ) review_id = kwd.get( 'id', None ) review = review_util.get_review( trans.app, review_id ) @@ -408,7 +409,7 @@ @web.require_login( "manage repositories reviewed by me" ) def manage_repositories_reviewed_by_me( self, trans, **kwd ): # The value of the received id is the encoded repository id. - message = kwd.get( 'message', '' ) + message = escape( kwd.get( 'message', '' ) ) status = kwd.get( 'status', 'done' ) if 'operation' in kwd: kwd[ 'mine' ] = True @@ -475,7 +476,7 @@ @web.require_login( "manage repository reviews" ) def manage_repository_reviews( self, trans, mine=False, **kwd ): # The value of the received id is the encoded repository id. - message = kwd.get( 'message', '' ) + message = escape( kwd.get( 'message', '' ) ) status = kwd.get( 'status', 'done' ) repository_id = kwd.get( 'id', None ) if repository_id: @@ -524,7 +525,7 @@ @web.require_login( "manage repository reviews of revision" ) def manage_repository_reviews_of_revision( self, trans, **kwd ): # The value of the received id is the encoded repository id. - message = kwd.get( 'message', '' ) + message = escape( kwd.get( 'message', '' ) ) status = kwd.get( 'status', 'done' ) repository_id = kwd.get( 'id', None ) changeset_revision = kwd.get( 'changeset_revision', None ) @@ -547,7 +548,7 @@ @web.expose @web.require_login( "repository reviews by user" ) def repository_reviews_by_user( self, trans, **kwd ): - message = kwd.get( 'message', '' ) + message = escape( kwd.get( 'message', '' ) ) status = kwd.get( 'status', 'done' ) if 'operation' in kwd: @@ -573,7 +574,7 @@ @web.expose @web.require_login( "reviewed repositories i own" ) def reviewed_repositories_i_own( self, trans, **kwd ): - message = kwd.get( 'message', '' ) + message = escape( kwd.get( 'message', '' ) ) status = kwd.get( 'status', 'done' ) # The value of the received id is the encoded repository id. if 'operation' in kwd: @@ -592,7 +593,7 @@ @web.require_login( "select previous review" ) def select_previous_review( self, trans, **kwd ): # The value of the received id is the encoded repository id. - message = kwd.get( 'message', '' ) + message = escape( kwd.get( 'message', '' ) ) status = kwd.get( 'status', 'done' ) repository = suc.get_repository_in_tool_shed( trans.app, kwd[ 'id' ] ) changeset_revision = kwd.get( 'changeset_revision', None ) diff -r 0ac7297b58491d542948ae3976732dd2c3450b89 -r e416697be38e66f18be89a4cfca70457c9784294 lib/galaxy/webapps/tool_shed/controllers/upload.py --- a/lib/galaxy/webapps/tool_shed/controllers/upload.py +++ b/lib/galaxy/webapps/tool_shed/controllers/upload.py @@ -9,6 +9,7 @@ from galaxy import web from galaxy.datatypes import checkers from galaxy.web.base.controller import BaseUIController +from markupsafe import escape from tool_shed.dependencies import attribute_handlers from tool_shed.galaxy_install import dependency_display @@ -34,9 +35,9 @@ @web.expose @web.require_login( 'upload', use_panels=True ) def upload( self, trans, **kwd ): - message = kwd.get( 'message', '' ) + message = escape( kwd.get( 'message', '' ) ) status = kwd.get( 'status', 'done' ) - commit_message = kwd.get( 'commit_message', 'Uploaded' ) + commit_message = escape( kwd.get( 'commit_message', 'Uploaded' ) ) category_ids = util.listify( kwd.get( 'category_id', '' ) ) categories = suc.get_categories( trans.app ) repository_id = kwd.get( 'repository_id', '' ) diff -r 0ac7297b58491d542948ae3976732dd2c3450b89 -r e416697be38e66f18be89a4cfca70457c9784294 lib/tool_shed/util/repository_util.py --- a/lib/tool_shed/util/repository_util.py +++ b/lib/tool_shed/util/repository_util.py @@ -7,6 +7,7 @@ from galaxy import web from galaxy.web.form_builder import build_select_field from galaxy.webapps.tool_shed.model import directory_hash_id +from markupsafe import escape from tool_shed.dependencies.repository import relation_builder @@ -256,7 +257,7 @@ def handle_role_associations( app, role, repository, **kwd ): sa_session = app.model.context.current - message = kwd.get( 'message', '' ) + message = escape( kwd.get( 'message', '' ) ) status = kwd.get( 'status', 'done' ) repository_owner = repository.user if kwd.get( 'manage_role_associations_button', False ): Repository URL: https://bitbucket.org/galaxy/galaxy-central/ -- This is a commit notification from bitbucket.org. You are receiving this because you have the service enabled, addressing the recipient of this email.

1 0

commit/galaxy-central: 4 new changesets
by commits-noreply＠bitbucket.org 11 Dec '14

11 Dec '14

4 new commits in galaxy-central: https://bitbucket.org/galaxy/galaxy-central/commits/c2bed0a496f8/ Changeset: c2bed0a496f8 Branch: stable User: davebgx Date: 2014-12-11 16:10:30+00:00 Summary: Escape messages passed in through kwd. Affected #: 14 files diff -r f0f1f78b54c55c8569bd1e3ed7fc15726b0b64a4 -r c2bed0a496f8fee8685977df733b06dfeac763e6 lib/galaxy/web/base/controllers/admin.py --- a/lib/galaxy/web/base/controllers/admin.py +++ b/lib/galaxy/web/base/controllers/admin.py @@ -7,6 +7,7 @@ from galaxy.web.form_builder import CheckboxField from string import punctuation as PUNCTUATION import galaxy.queue_worker +from markupsafe import escape from tool_shed.util import shed_util_common as suc @@ -28,7 +29,7 @@ @web.expose @web.require_admin def index( self, trans, **kwd ): - message = kwd.get( 'message', '' ) + message = escape( kwd.get( 'message', '' ) ) status = kwd.get( 'status', 'done' ) if trans.webapp.name == 'galaxy': installed_repositories = trans.install_model.context.query( trans.install_model.ToolShedRepository ).first() @@ -46,7 +47,7 @@ @web.expose @web.require_admin def center( self, trans, **kwd ): - message = kwd.get( 'message', '' ) + message = escape( kwd.get( 'message', '' ) ) status = kwd.get( 'status', 'done' ) if trans.webapp.name == 'galaxy': return trans.fill_template( '/webapps/galaxy/admin/center.mako', diff -r f0f1f78b54c55c8569bd1e3ed7fc15726b0b64a4 -r c2bed0a496f8fee8685977df733b06dfeac763e6 lib/galaxy/webapps/demo_sequencer/controllers/common.py --- a/lib/galaxy/webapps/demo_sequencer/controllers/common.py +++ b/lib/galaxy/webapps/demo_sequencer/controllers/common.py @@ -4,6 +4,7 @@ import time, socket, urllib, urllib2, base64, copy from galaxy.util.json import * from urllib import quote_plus, unquote_plus +from markupsafe import escape import logging log = logging.getLogger( __name__ ) @@ -16,7 +17,7 @@ titles = util.listify( titles ) JobId = util.restore_text( kwd.get( 'JobId', '' ) ) sample_id = util.restore_text( kwd.get( 'sample_id', '' ) ) - message = util.restore_text( kwd.get( 'message', '' ) ) + message = escape( util.restore_text( kwd.get( 'message', '' ) ) ) status = kwd.get( 'status', 'done' ) redirect_delay = trans.app.sequencer_actions_registry.redirect_delay sequencer_redirects = copy.deepcopy( trans.app.sequencer_actions_registry.sequencer_redirects ) @@ -144,7 +145,7 @@ titles = util.restore_text( kwd.get( 'titles', '' ) ) JobId = util.restore_text( kwd.get( 'JobId', '' ) ) sample_id = util.restore_text( kwd.get( 'sample_id', '' ) ) - message = util.restore_text( kwd.get( 'message', '' ) ) + message = escape( util.restore_text( kwd.get( 'message', '' ) ) ) status = kwd.get( 'status', 'done' ) url, http_method, request_params, response_type = request_tup url = unquote_plus( url ) diff -r f0f1f78b54c55c8569bd1e3ed7fc15726b0b64a4 -r c2bed0a496f8fee8685977df733b06dfeac763e6 lib/galaxy/webapps/galaxy/controllers/admin.py --- a/lib/galaxy/webapps/galaxy/controllers/admin.py +++ b/lib/galaxy/webapps/galaxy/controllers/admin.py @@ -17,6 +17,7 @@ from galaxy.web.params import QuotaParamParser from tool_shed.util import common_util from tool_shed.util import encoding_util +from markupsafe import escape log = logging.getLogger( __name__ ) @@ -838,7 +839,7 @@ @web.expose @web.require_admin def review_tool_migration_stages( self, trans, **kwd ): - message = galaxy.util.restore_text( kwd.get( 'message', '' ) ) + message = escape( galaxy.util.restore_text( kwd.get( 'message', '' ) ) ) status = galaxy.util.restore_text( kwd.get( 'status', 'done' ) ) migration_stages_dict = odict() migration_modules = [] @@ -870,13 +871,13 @@ @web.expose @web.require_admin def view_datatypes_registry( self, trans, **kwd ): - message = galaxy.util.restore_text( kwd.get( 'message', '' ) ) + message = escape( galaxy.util.restore_text( kwd.get( 'message', '' ) ) ) status = galaxy.util.restore_text( kwd.get( 'status', 'done' ) ) return trans.fill_template( 'admin/view_datatypes_registry.mako', message=message, status=status ) @web.expose @web.require_admin def view_tool_data_tables( self, trans, **kwd ): - message = galaxy.util.restore_text( kwd.get( 'message', '' ) ) + message = escape( galaxy.util.restore_text( kwd.get( 'message', '' ) ) ) status = galaxy.util.restore_text( kwd.get( 'status', 'done' ) ) return trans.fill_template( 'admin/view_data_tables_registry.mako', message=message, status=status ) diff -r f0f1f78b54c55c8569bd1e3ed7fc15726b0b64a4 -r c2bed0a496f8fee8685977df733b06dfeac763e6 lib/galaxy/webapps/galaxy/controllers/admin_toolshed.py --- a/lib/galaxy/webapps/galaxy/controllers/admin_toolshed.py +++ b/lib/galaxy/webapps/galaxy/controllers/admin_toolshed.py @@ -8,6 +8,7 @@ from galaxy.web.form_builder import CheckboxField from galaxy.util import json from galaxy.model.orm import or_ +from markupsafe import escape import tool_shed.repository_types.util as rt_util @@ -72,7 +73,7 @@ @web.expose @web.require_admin def browse_repository( self, trans, **kwd ): - message = kwd.get( 'message', '' ) + message = escape( kwd.get( 'message', '' ) ) status = kwd.get( 'status', 'done' ) repository = repository_util.get_installed_tool_shed_repository( trans.app, kwd[ 'id' ] ) return trans.fill_template( '/admin/tool_shed_repository/browse_repository.mako', @@ -169,7 +170,7 @@ @web.expose @web.require_admin def browse_tool_dependency( self, trans, **kwd ): - message = kwd.get( 'message', '' ) + message = escape( kwd.get( 'message', '' ) ) status = kwd.get( 'status', 'done' ) tool_dependency_ids = tool_dependency_util.get_tool_dependency_ids( as_string=False, **kwd ) tool_dependency = tool_dependency_util.get_tool_dependency( trans.app, tool_dependency_ids[ 0 ] ) @@ -197,7 +198,7 @@ @web.expose @web.require_admin def browse_tool_sheds( self, trans, **kwd ): - message = kwd.get( 'message', '' ) + message = escape( kwd.get( 'message', '' ) ) status = kwd.get( 'status', 'done' ) return trans.fill_template( '/webapps/galaxy/admin/tool_sheds.mako', message=message, @@ -230,7 +231,7 @@ require the same entry. For now we'll never delete entries from config.shed_tool_data_table_config, but we may choose to do so in the future if it becomes necessary. """ - message = kwd.get( 'message', '' ) + message = escape( kwd.get( 'message', '' ) ) status = kwd.get( 'status', 'done' ) remove_from_disk = kwd.get( 'remove_from_disk', '' ) remove_from_disk_checked = CheckboxField.is_checked( remove_from_disk ) @@ -442,7 +443,7 @@ @web.require_admin def import_workflow( self, trans, workflow_name, repository_id, **kwd ): """Import a workflow contained in an installed tool shed repository into Galaxy.""" - message = kwd.get( 'message', '' ) + message = escape( kwd.get( 'message', '' ) ) status = kwd.get( 'status', 'done' ) if workflow_name: workflow_name = encoding_util.tool_shed_decode( workflow_name ) @@ -479,7 +480,7 @@ tool shed repository. """ # Get the tool_shed_repository from one of the tool_dependencies. - message = kwd.get( 'message', '' ) + message = escape( kwd.get( 'message', '' ) ) status = kwd.get( 'status', 'done' ) err_msg = '' tool_shed_repository = tool_dependencies[ 0 ].tool_shed_repository @@ -512,7 +513,7 @@ @web.require_admin def install_latest_repository_revision( self, trans, **kwd ): """Install the latest installable revision of a repository that has been previously installed.""" - message = kwd.get( 'message', '' ) + message = escape( kwd.get( 'message', '' ) ) status = kwd.get( 'status', 'done' ) repository_id = kwd.get( 'id', None ) if repository_id is not None: @@ -589,7 +590,7 @@ updating_to_changeset_revision = kwd.get( 'updating_to_changeset_revision', None ) updating_to_ctx_rev = kwd.get( 'updating_to_ctx_rev', None ) encoded_updated_metadata = kwd.get( 'encoded_updated_metadata', None ) - message = kwd.get( 'message', '' ) + message = escape( kwd.get( 'message', '' ) ) status = kwd.get( 'status', 'done' ) install_tool_dependencies = CheckboxField.is_checked( kwd.get( 'install_tool_dependencies', '' ) ) if 'install_tool_dependencies_with_update_button' in kwd: @@ -665,7 +666,7 @@ @web.expose @web.require_admin def manage_repositories( self, trans, **kwd ): - message = kwd.get( 'message', '' ) + message = escape( kwd.get( 'message', '' ) ) status = kwd.get( 'status', 'done' ) tsridslist = common_util.get_tool_shed_repository_ids( **kwd ) if 'operation' in kwd: @@ -744,7 +745,7 @@ @web.expose @web.require_admin def manage_repository( self, trans, **kwd ): - message = kwd.get( 'message', '' ) + message = escape( kwd.get( 'message', '' ) ) status = kwd.get( 'status', 'done' ) repository_id = kwd.get( 'id', None ) if repository_id is None: @@ -808,7 +809,7 @@ @web.expose @web.require_admin def manage_repository_tool_dependencies( self, trans, **kwd ): - message = kwd.get( 'message', '' ) + message = escape( kwd.get( 'message', '' ) ) status = kwd.get( 'status', 'done' ) tool_dependency_ids = tool_dependency_util.get_tool_dependency_ids( as_string=False, **kwd ) if tool_dependency_ids: @@ -890,7 +891,7 @@ def manage_tool_dependencies( self, trans, **kwd ): # This method is called when tool dependencies are being installed. See the related manage_repository_tool_dependencies # method for managing the tool dependencies for a specified installed tool shed repository. - message = kwd.get( 'message', '' ) + message = escape( kwd.get( 'message', '' ) ) status = kwd.get( 'status', 'done' ) tool_dependency_ids = tool_dependency_util.get_tool_dependency_ids( as_string=False, **kwd ) repository_id = kwd.get( 'repository_id', None ) @@ -978,7 +979,7 @@ message += 'of Galaxy Tool Shed repository tools into a local Galaxy instance</a> section of the Galaxy Tool ' message += 'Shed wiki for all of the details.' return trans.show_error_message( message ) - message = kwd.get( 'message', '' ) + message = escape( kwd.get( 'message', '' ) ) status = kwd.get( 'status', 'done' ) shed_tool_conf = kwd.get( 'shed_tool_conf', None ) tool_shed_url = kwd.get( 'tool_shed_url', '' ) @@ -1314,7 +1315,7 @@ and tool dependencies of the repository. """ rdim = repository_dependency_manager.RepositoryDependencyInstallManager( trans.app ) - message = kwd.get( 'message', '' ) + message = escape( kwd.get( 'message', '' ) ) status = kwd.get( 'status', 'done' ) repository_id = kwd[ 'id' ] tool_shed_repository = repository_util.get_installed_tool_shed_repository( trans.app, repository_id ) @@ -1450,7 +1451,7 @@ Inspect the repository dependency hierarchy for a specified repository and attempt to make sure they are all properly installed as well as each repository's tool dependencies. """ - message = kwd.get( 'message', '' ) + message = escape( kwd.get( 'message', '' ) ) status = kwd.get( 'status', 'done' ) repository_id = kwd.get( 'id', None ) if not repository_id: @@ -1715,7 +1716,7 @@ if 'reset_metadata_on_selected_repositories_button' in kwd: message, status = irmm.reset_metadata_on_selected_repositories( trans.user, **kwd ) else: - message = kwd.get( 'message', '' ) + message = escape( kwd.get( 'message', '' ) ) status = kwd.get( 'status', 'done' ) repositories_select_field = irmm.build_repository_ids_select_field() return trans.fill_template( '/admin/tool_shed_repository/reset_metadata_on_selected_repositories.mako', @@ -1852,7 +1853,7 @@ @web.expose @web.require_admin def uninstall_tool_dependencies( self, trans, **kwd ): - message = kwd.get( 'message', '' ) + message = escape( kwd.get( 'message', '' ) ) status = kwd.get( 'status', 'done' ) tool_dependency_ids = tool_dependency_util.get_tool_dependency_ids( as_string=False, **kwd ) if not tool_dependency_ids: @@ -1897,7 +1898,7 @@ @web.require_admin def update_to_changeset_revision( self, trans, **kwd ): """Update a cloned repository to the latest revision possible.""" - message = kwd.get( 'message', '' ) + message = escape( kwd.get( 'message', '' ) ) status = kwd.get( 'status', 'done' ) tool_shed_url = kwd.get( 'tool_shed_url', '' ) # Handle protocol changes over time. @@ -2070,7 +2071,7 @@ @web.expose @web.require_admin def update_tool_shed_status_for_installed_repository( self, trans, all_installed_repositories=False, **kwd ): - message = kwd.get( 'message', '' ) + message = escape( kwd.get( 'message', '' ) ) status = kwd.get( 'status', 'done' ) if all_installed_repositories: success_count = 0 @@ -2112,7 +2113,7 @@ @web.expose @web.require_admin def view_tool_metadata( self, trans, repository_id, tool_id, **kwd ): - message = kwd.get( 'message', '' ) + message = escape( kwd.get( 'message', '' ) ) status = kwd.get( 'status', 'done' ) repository = repository_util.get_installed_tool_shed_repository( trans.app, repository_id ) repository_metadata = repository.metadata @@ -2146,7 +2147,7 @@ @web.require_admin def view_workflow( self, trans, workflow_name=None, repository_id=None, **kwd ): """Retrieve necessary information about a workflow from the database so that it can be displayed in an svg image.""" - message = kwd.get( 'message', '' ) + message = escape( kwd.get( 'message', '' ) ) status = kwd.get( 'status', 'done' ) if workflow_name: workflow_name = encoding_util.tool_shed_decode( workflow_name ) diff -r f0f1f78b54c55c8569bd1e3ed7fc15726b0b64a4 -r c2bed0a496f8fee8685977df733b06dfeac763e6 lib/galaxy/webapps/galaxy/controllers/library_admin.py --- a/lib/galaxy/webapps/galaxy/controllers/library_admin.py +++ b/lib/galaxy/webapps/galaxy/controllers/library_admin.py @@ -5,8 +5,9 @@ from galaxy import web from galaxy.web.base.controller import BaseUIController -from galaxy.web.framework.helpers import escape, grids, time_ago +from galaxy.web.framework.helpers import grids, time_ago from library_common import get_comptypes, lucene_search, whoosh_search +from markupsafe import escape # from galaxy.model.orm import * log = logging.getLogger( __name__ ) @@ -148,7 +149,7 @@ @web.expose @web.require_admin def create_library( self, trans, **kwd ): - message = kwd.get( 'message', '' ) + message = escape( kwd.get( 'message', '' ) ) status = kwd.get( 'status', 'done' ) if kwd.get( 'create_library_button', False ): name = kwd.get( 'name', 'No name' ) diff -r f0f1f78b54c55c8569bd1e3ed7fc15726b0b64a4 -r c2bed0a496f8fee8685977df733b06dfeac763e6 lib/galaxy/webapps/galaxy/controllers/library_common.py --- a/lib/galaxy/webapps/galaxy/controllers/library_common.py +++ b/lib/galaxy/webapps/galaxy/controllers/library_common.py @@ -20,7 +20,7 @@ from galaxy.util.streamball import StreamBall from galaxy.web.base.controller import BaseUIController, UsesFormDefinitionsMixin, UsesExtendedMetadataMixin, UsesLibraryMixinItems from galaxy.web.form_builder import AddressField, CheckboxField, SelectField, build_select_field -from galaxy.web.framework.helpers import escape +from markupsafe import escape from galaxy.model.orm import and_, eagerload_all # Whoosh is compatible with Python 2.5+ Try to import Whoosh and set flag to indicate whether tool search is enabled. @@ -93,7 +93,7 @@ @web.expose def browse_library( self, trans, cntrller='library', **kwd ): - message = kwd.get( 'message', '' ) + message = escape( kwd.get( 'message', '' ) ) status = kwd.get( 'status', 'done' ) # If use_panels is True, the library is being accessed via an external link # which did not originate from within the Galaxy instance, and the library will @@ -121,7 +121,7 @@ hidden_folder_ids = util.listify( kwd.get( 'hidden_folder_ids', '' ) ) if created_ldda_ids and not message: message = "%d datasets are uploading in the background to the library '%s' (each is selected). " % \ - ( len( created_ldda_ids.split( ',' ) ), library.name ) + ( len( created_ldda_ids.split( ',' ) ), escape( library.name ) ) message += "Don't navigate away from Galaxy or use the browser's \"stop\" or \"reload\" buttons (on this tab) until the " message += "message \"This job is running\" is cleared from the \"Information\" column below for each selected dataset." status = "info" @@ -152,7 +152,7 @@ message=escape( message ), status=escape( status ) ) except Exception, e: - message = 'Error attempting to display contents of library (%s): %s.' % ( str( library.name ), str( e ) ) + message = 'Error attempting to display contents of library (%s): %s.' % ( escape( str( library.name ) ), str( e ) ) status = 'error' default_action = kwd.get( 'default_action', None ) @@ -164,7 +164,7 @@ status=status ) ) @web.expose def library_info( self, trans, cntrller, **kwd ): - message = kwd.get( 'message', '' ) + message = escape( kwd.get( 'message', '' ) ) status = kwd.get( 'status', 'done' ) use_panels = util.string_as_bool( kwd.get( 'use_panels', False ) ) show_deleted = util.string_as_bool( kwd.get( 'show_deleted', False ) ) @@ -223,7 +223,7 @@ status=escape( status ) ) @web.expose def library_permissions( self, trans, cntrller, **kwd ): - message = kwd.get( 'message', '' ) + message = escape( kwd.get( 'message', '' ) ) status = kwd.get( 'status', 'done' ) use_panels = util.string_as_bool( kwd.get( 'use_panels', False ) ) show_deleted = util.string_as_bool( kwd.get( 'show_deleted', False ) ) @@ -269,7 +269,7 @@ status=escape( status ) ) @web.expose def create_folder( self, trans, cntrller, parent_id, library_id, **kwd ): - message = kwd.get( 'message', '' ) + message = escape( kwd.get( 'message', '' ) ) status = kwd.get( 'status', 'done' ) show_deleted = util.string_as_bool( kwd.get( 'show_deleted', False ) ) use_panels = util.string_as_bool( kwd.get( 'use_panels', False ) ) @@ -345,7 +345,7 @@ status=escape( status ) ) @web.expose def folder_info( self, trans, cntrller, id, library_id, **kwd ): - message = kwd.get( 'message', '' ) + message = escape( kwd.get( 'message', '' ) ) status = kwd.get( 'status', 'done' ) show_deleted = util.string_as_bool( kwd.get( 'show_deleted', False ) ) use_panels = util.string_as_bool( kwd.get( 'use_panels', False ) ) @@ -401,7 +401,7 @@ status=escape( status ) ) @web.expose def folder_permissions( self, trans, cntrller, id, library_id, **kwd ): - message = kwd.get( 'message', '' ) + message = escape( kwd.get( 'message', '' ) ) status = kwd.get( 'status', 'done' ) show_deleted = util.string_as_bool( kwd.get( 'show_deleted', False ) ) use_panels = util.string_as_bool( kwd.get( 'use_panels', False ) ) @@ -450,7 +450,7 @@ status=escape( status ) ) @web.expose def ldda_edit_info( self, trans, cntrller, library_id, folder_id, id, **kwd ): - message = kwd.get( 'message', '' ) + message = escape( kwd.get( 'message', '' ) ) status = kwd.get( 'status', 'done' ) show_deleted = util.string_as_bool( kwd.get( 'show_deleted', False ) ) use_panels = util.string_as_bool( kwd.get( 'use_panels', False ) ) @@ -505,7 +505,7 @@ old_name = ldda.name new_name = kwd.get( 'name', '' ) new_info = kwd.get( 'info', '' ) - new_message = kwd.get( 'message', '' ) + new_message = escape( kwd.get( 'message', '' ) ) if not new_name: message = 'Enter a valid name' status = 'error' @@ -602,7 +602,7 @@ status=escape( status ) ) @web.expose def ldda_info( self, trans, cntrller, library_id, folder_id, id, **kwd ): - message = kwd.get( 'message', '' ) + message = escape( kwd.get( 'message', '' ) ) status = kwd.get( 'status', 'done' ) show_deleted = util.string_as_bool( kwd.get( 'show_deleted', False ) ) show_associated_hdas_and_lddas = util.string_as_bool( kwd.get( 'show_associated_hdas_and_lddas', False ) ) @@ -650,7 +650,7 @@ status=escape( status ) ) @web.expose def ldda_permissions( self, trans, cntrller, library_id, folder_id, id, **kwd ): - message = kwd.get( 'message', '' ) + message = escape( kwd.get( 'message', '' ) ) status = kwd.get( 'status', 'done' ) show_deleted = util.string_as_bool( kwd.get( 'show_deleted', False ) ) use_panels = util.string_as_bool( kwd.get( 'use_panels', False ) ) @@ -787,9 +787,9 @@ status=escape( status ) ) @web.expose def upload_library_dataset( self, trans, cntrller, library_id, folder_id, **kwd ): - message = kwd.get( 'message', '' ) + message = escape( kwd.get( 'message', '' ) ) status = kwd.get( 'status', 'done' ) - ldda_message = kwd.get( 'ldda_message', '' ) + ldda_message = escape( kwd.get( 'ldda_message', '' ) ) deleted = util.string_as_bool( kwd.get( 'deleted', False ) ) show_deleted = util.string_as_bool( kwd.get( 'show_deleted', False ) ) use_panels = util.string_as_bool( kwd.get( 'use_panels', False ) ) @@ -1046,7 +1046,7 @@ dataset_upload_inputs.append( input ) # Library-specific params show_deleted = util.string_as_bool( kwd.get( 'show_deleted', False ) ) - message = kwd.get( 'message', '' ) + message = escape( kwd.get( 'message', '' ) ) status = kwd.get( 'status', 'done' ) server_dir = kwd.get( 'server_dir', '' ) if replace_dataset not in [ None, 'None' ]: @@ -1256,9 +1256,9 @@ @web.expose def add_history_datasets_to_library( self, trans, cntrller, library_id, folder_id, hda_ids='', **kwd ): - message = kwd.get( 'message', '' ) + message = escape( kwd.get( 'message', '' ) ) status = kwd.get( 'status', 'done' ) - ldda_message = kwd.get( 'ldda_message', '' ) + ldda_message = escape( kwd.get( 'ldda_message', '' ) ) show_deleted = kwd.get( 'show_deleted', False ) use_panels = util.string_as_bool( kwd.get( 'use_panels', False ) ) replace_id = kwd.get( 'replace_id', None ) @@ -1547,7 +1547,7 @@ status='error' ) ) @web.expose def library_dataset_info( self, trans, cntrller, id, library_id, **kwd ): - message = kwd.get( 'message', '' ) + message = escape( kwd.get( 'message', '' ) ) status = kwd.get( 'status', 'done' ) show_deleted = util.string_as_bool( kwd.get( 'show_deleted', False ) ) use_panels = util.string_as_bool( kwd.get( 'use_panels', False ) ) @@ -1595,7 +1595,7 @@ status=escape( status ) ) @web.expose def library_dataset_permissions( self, trans, cntrller, id, library_id, **kwd ): - message = kwd.get( 'message', '' ) + message = escape( kwd.get( 'message', '' ) ) status = kwd.get( 'status', 'done' ) show_deleted = util.string_as_bool( kwd.get( 'show_deleted', False ) ) use_panels = util.string_as_bool( kwd.get( 'use_panels', False ) ) @@ -1642,7 +1642,7 @@ status=escape( status ) ) @web.expose def make_library_item_public( self, trans, cntrller, library_id, item_type, id, **kwd ): - message = kwd.get( 'message', '' ) + message = escape( kwd.get( 'message', '' ) ) status = kwd.get( 'status', 'done' ) show_deleted = util.string_as_bool( kwd.get( 'show_deleted', False ) ) use_panels = util.string_as_bool( kwd.get( 'use_panels', False ) ) @@ -1703,7 +1703,7 @@ rval += '%s %i %s%s %s\r\n' % ( crc, size, self.url_base, quoted_fname, relpath ) return rval # Perform an action on a list of library datasets. - message = kwd.get( 'message', '' ) + message = escape( kwd.get( 'message', '' ) ) status = kwd.get( 'status', 'done' ) show_deleted = util.string_as_bool( kwd.get( 'show_deleted', False ) ) use_panels = util.string_as_bool( kwd.get( 'use_panels', False ) ) @@ -1979,7 +1979,7 @@ # - a select list option for acting on multiple selected datasets within a library # ( ldda_ids is a comma separated string of ldda ids ) # - a menu option for a library dataset search result set ( ldda_ids is a comma separated string of ldda ids ) - message = kwd.get( 'message', '' ) + message = escape( kwd.get( 'message', '' ) ) status = kwd.get( 'status', 'done' ) show_deleted = util.string_as_bool( kwd.get( 'show_deleted', False ) ) use_panels = util.string_as_bool( kwd.get( 'use_panels', False ) ) @@ -2102,7 +2102,7 @@ def manage_template_inheritance( self, trans, cntrller, item_type, library_id, folder_id=None, ldda_id=None, **kwd ): show_deleted = util.string_as_bool( kwd.get( 'show_deleted', False ) ) use_panels = util.string_as_bool( kwd.get( 'use_panels', False ) ) - message = kwd.get( 'message', '' ) + message = escape( kwd.get( 'message', '' ) ) status = kwd.get( 'status', 'done' ) is_admin = ( trans.user_is_admin() and cntrller == 'library_admin' ) current_user_roles = trans.get_current_user_roles() @@ -2152,7 +2152,7 @@ # 'ldda' and item_id is a comma separated string of ldda ids ) # - a menu option for a library dataset search result set ( item_type is 'ldda' and item_id is a # comma separated string of ldda ids ) - message = kwd.get( 'message', '' ) + message = escape( kwd.get( 'message', '' ) ) status = kwd.get( 'status', 'done' ) show_deleted = util.string_as_bool( kwd.get( 'show_deleted', False ) ) use_panels = util.string_as_bool( kwd.get( 'use_panels', False ) ) @@ -2723,7 +2723,7 @@ return map( operator.getitem, intermed, ( -1, ) * len( intermed ) ) def lucene_search( trans, cntrller, search_term, search_url, **kwd ): """Return display of results from a full-text lucene search of data libraries.""" - message = kwd.get( 'message', '' ) + message = escape( kwd.get( 'message', '' ) ) status = kwd.get( 'status', 'done' ) full_url = "%s/find?%s" % ( search_url, urllib.urlencode( { "kwd" : search_term } ) ) response = urllib2.urlopen( full_url ) @@ -2733,7 +2733,7 @@ return status, message, get_sorted_accessible_library_items( trans, cntrller, lddas, 'name' ) def whoosh_search( trans, cntrller, search_term, **kwd ): """Return display of results from a full-text whoosh search of data libraries.""" - message = kwd.get( 'message', '' ) + message = escape( kwd.get( 'message', '' ) ) status = kwd.get( 'status', 'done' ) ok = True if whoosh_search_enabled: diff -r f0f1f78b54c55c8569bd1e3ed7fc15726b0b64a4 -r c2bed0a496f8fee8685977df733b06dfeac763e6 lib/galaxy/webapps/galaxy/controllers/user.py --- a/lib/galaxy/webapps/galaxy/controllers/user.py +++ b/lib/galaxy/webapps/galaxy/controllers/user.py @@ -28,9 +28,10 @@ from galaxy.web.base.controller import CreatesApiKeysMixin from galaxy.web.form_builder import CheckboxField from galaxy.web.form_builder import build_select_field -from galaxy.web.framework.helpers import time_ago, grids, escape +from galaxy.web.framework.helpers import time_ago, grids from datetime import datetime, timedelta from galaxy.util import hash_util, biostar +from markupsafe import escape log = logging.getLogger( __name__ ) @@ -254,7 +255,7 @@ if not trans.app.config.enable_openid: return trans.show_error_message( 'OpenID authentication is not enabled in this instance of Galaxy' ) use_panels = util.string_as_bool( kwd.get( 'use_panels', False ) ) - message = kwd.get( 'message', '' ) + message = escape( kwd.get( 'message', '' ) ) status = kwd.get( 'status', 'done' ) email = kwd.get( 'email', '' ) username = kwd.get( 'username', '' ) @@ -502,7 +503,7 @@ """ Function validates numerous cases that might happen during the login time. """ - message = kwd.get( 'message', '' ) + message = escape( kwd.get( 'message', '' ) ) status = kwd.get( 'status', 'error' ) email = kwd.get( 'email', '' ) password = kwd.get( 'password', '' ) @@ -719,7 +720,7 @@ email = util.restore_text( kwd.get( 'email', '' ) ) password = kwd.get( 'password', '' ) username = util.restore_text( kwd.get( 'username', '' ) ) - message = kwd.get( 'message', '' ) + message = escape( kwd.get( 'message', '' ) ) status = kwd.get( 'status', 'done' ) is_admin = cntrller == 'admin' and trans.user_is_admin() user = self.create_user( trans=trans, email=email, username=username, password=password ) @@ -1093,7 +1094,7 @@ def reset_password( self, trans, email=None, **kwd ): if trans.app.config.smtp_server is None: return trans.show_error_message( "Mail is not configured for this Galaxy instance. Please contact your local Galaxy administrator." ) - message = util.sanitize_text(util.restore_text( kwd.get( 'message', '' ) )) + message = util.sanitize_text( util.restore_text( kwd.get( 'message', '' ) ) ) status = kwd.get( 'status', 'done' ) if kwd.get( 'reset_password_button', False ): reset_user = trans.sa_session.query( trans.app.model.User ).filter( trans.app.model.User.table.c.email == email ).first() diff -r f0f1f78b54c55c8569bd1e3ed7fc15726b0b64a4 -r c2bed0a496f8fee8685977df733b06dfeac763e6 lib/galaxy/webapps/galaxy/controllers/workflow.py --- a/lib/galaxy/webapps/galaxy/controllers/workflow.py +++ b/lib/galaxy/webapps/galaxy/controllers/workflow.py @@ -22,7 +22,7 @@ from galaxy.web import error, url_for from galaxy.web.base.controller import BaseUIController, SharableMixin, UsesStoredWorkflowMixin from galaxy.web.framework.formbuilder import form -from galaxy.web.framework.helpers import grids, time_ago, to_unicode, escape +from galaxy.web.framework.helpers import grids, time_ago, to_unicode from galaxy.workflow.modules import WorkflowModuleInjector from galaxy.workflow.modules import MissingToolException from galaxy.workflow.modules import module_factory, is_tool_module_type @@ -37,6 +37,7 @@ order_workflow_steps_with_levels, ) from galaxy.workflow.render import WorkflowCanvas, MARGIN, LINE_SPACING +from markupsafe import escape class StoredWorkflowListGrid( grids.Grid ): @@ -1021,7 +1022,7 @@ """ url = kwd.get( 'url', '' ) workflow_text = kwd.get( 'workflow_text', '' ) - message = kwd.get( 'message', '' ) + message = escape( kwd.get( 'message', '' ) ) status = kwd.get( 'status', 'done' ) import_button = kwd.get( 'import_button', False ) # The special Galaxy integration landing page's URL on myExperiment diff -r f0f1f78b54c55c8569bd1e3ed7fc15726b0b64a4 -r c2bed0a496f8fee8685977df733b06dfeac763e6 lib/galaxy/webapps/reports/controllers/users.py --- a/lib/galaxy/webapps/reports/controllers/users.py +++ b/lib/galaxy/webapps/reports/controllers/users.py @@ -9,17 +9,19 @@ pkg_resources.require( "SQLAlchemy >= 0.4" ) import sqlalchemy as sa import logging +from markupsafe import escape + log = logging.getLogger( __name__ ) class Users( BaseUIController ): @web.expose def registered_users( self, trans, **kwd ): - message = util.restore_text( kwd.get( 'message', '' ) ) + message = escape( util.restore_text( kwd.get( 'message', '' ) ) ) num_users = trans.sa_session.query( galaxy.model.User ).count() return trans.fill_template( '/webapps/reports/registered_users.mako', num_users=num_users, message=message ) @web.expose def registered_users_per_month( self, trans, **kwd ): - message = util.restore_text( kwd.get( 'message', '' ) ) + message = escape( util.restore_text( kwd.get( 'message', '' ) ) ) q = sa.select( ( sa.func.date_trunc( 'month', sa.func.date( galaxy.model.User.table.c.create_time ) ).label( 'date' ), sa.func.count( galaxy.model.User.table.c.id ).label( 'num_users' ) ), from_obj = [ galaxy.model.User.table ], @@ -36,7 +38,7 @@ message=message ) @web.expose def specified_month( self, trans, **kwd ): - message = util.restore_text( kwd.get( 'message', '' ) ) + message = escape( util.restore_text( kwd.get( 'message', '' ) ) ) # If specified_date is not received, we'll default to the current month specified_date = kwd.get( 'specified_date', datetime.utcnow().strftime( "%Y-%m-%d" ) ) specified_month = specified_date[ :7 ] @@ -66,7 +68,7 @@ message=message ) @web.expose def specified_date( self, trans, **kwd ): - message = util.restore_text( kwd.get( 'message', '' ) ) + message = escape( util.restore_text( kwd.get( 'message', '' ) ) ) # If specified_date is not received, we'll default to the current month specified_date = kwd.get( 'specified_date', datetime.utcnow().strftime( "%Y-%m-%d" ) ) year, month, day = map( int, specified_date.split( "-" ) ) @@ -95,7 +97,7 @@ message=message ) @web.expose def last_access_date( self, trans, **kwd ): - message = util.restore_text( kwd.get( 'message', '' ) ) + message = escape( util.restore_text( kwd.get( 'message', '' ) ) ) not_logged_in_for_days = kwd.get( 'not_logged_in_for_days', 90 ) if not not_logged_in_for_days: not_logged_in_for_days = 0 @@ -120,7 +122,7 @@ @web.expose def user_disk_usage( self, trans, **kwd ): - message = util.restore_text( kwd.get( 'message', '' ) ) + message = escape( util.restore_text( kwd.get( 'message', '' ) ) ) user_cutoff = int( kwd.get( 'user_cutoff', 60 ) ) # disk_usage isn't indexed users = sorted( trans.sa_session.query( galaxy.model.User ).all(), key=operator.attrgetter( 'disk_usage' ), reverse=True ) diff -r f0f1f78b54c55c8569bd1e3ed7fc15726b0b64a4 -r c2bed0a496f8fee8685977df733b06dfeac763e6 lib/galaxy/webapps/tool_shed/controllers/admin.py --- a/lib/galaxy/webapps/tool_shed/controllers/admin.py +++ b/lib/galaxy/webapps/tool_shed/controllers/admin.py @@ -3,6 +3,7 @@ from galaxy import util from galaxy.util import inflector from galaxy import web +from markupsafe import escape from galaxy.web.base.controller import BaseUIController from galaxy.web.base.controllers.admin import Admin @@ -121,7 +122,7 @@ @web.expose @web.require_admin def create_category( self, trans, **kwd ): - message = kwd.get( 'message', '' ) + message = escape( kwd.get( 'message', '' ) ) status = kwd.get( 'status', 'done' ) name = kwd.get( 'name', '' ).strip() description = kwd.get( 'description', '' ).strip() @@ -154,7 +155,7 @@ @web.expose @web.require_admin def delete_repository( self, trans, **kwd ): - message = kwd.get( 'message', '' ) + message = escape( kwd.get( 'message', '' ) ) status = kwd.get( 'status', 'done' ) id = kwd.get( 'id', None ) if id: @@ -197,7 +198,7 @@ @web.expose @web.require_admin def delete_repository_metadata( self, trans, **kwd ): - message = kwd.get( 'message', '' ) + message = escape( kwd.get( 'message', '' ) ) status = kwd.get( 'status', 'done' ) id = kwd.get( 'id', None ) if id: @@ -221,7 +222,7 @@ @web.expose @web.require_admin def edit_category( self, trans, **kwd ): - message = kwd.get( 'message', '' ) + message = escape( kwd.get( 'message', '' ) ) status = kwd.get( 'status', 'done' ) id = kwd.get( 'id', None ) if not id: @@ -306,7 +307,7 @@ @web.expose @web.require_admin def regenerate_statistics( self, trans, **kwd ): - message = kwd.get( 'message', '' ) + message = escape( kwd.get( 'message', '' ) ) status = kwd.get( 'status', 'done' ) if 'regenerate_statistics_button' in kwd: trans.app.shed_counter.generate_statistics() @@ -352,7 +353,7 @@ if 'reset_metadata_on_selected_repositories_button' in kwd: message, status = rmm.reset_metadata_on_selected_repositories( **kwd ) else: - message = util.restore_text( kwd.get( 'message', '' ) ) + message = escape( util.restore_text( kwd.get( 'message', '' ) ) ) status = kwd.get( 'status', 'done' ) repositories_select_field = rmm.build_repository_ids_select_field( name='repository_ids', multiple=True, @@ -366,7 +367,7 @@ @web.expose @web.require_admin def undelete_repository( self, trans, **kwd ): - message = kwd.get( 'message', '' ) + message = escape( kwd.get( 'message', '' ) ) status = kwd.get( 'status', 'done' ) id = kwd.get( 'id', None ) if id: @@ -417,7 +418,7 @@ # TODO: We should probably eliminate the Category.deleted column since it really makes no # sense to mark a category as deleted (category names and descriptions can be changed instead). # If we do this, and the following 2 methods can be eliminated. - message = kwd.get( 'message', '' ) + message = escape( kwd.get( 'message', '' ) ) status = kwd.get( 'status', 'done' ) id = kwd.get( 'id', None ) if id: @@ -445,7 +446,7 @@ # This method should only be called for a Category that has previously been deleted. # Purging a deleted Category deletes all of the following from the database: # - RepoitoryCategoryAssociations where category_id == Category.id - message = kwd.get( 'message', '' ) + message = escape( kwd.get( 'message', '' ) ) status = kwd.get( 'status', 'done' ) id = kwd.get( 'id', None ) if id: @@ -473,7 +474,7 @@ @web.expose @web.require_admin def undelete_category( self, trans, **kwd ): - message = kwd.get( 'message', '' ) + message = escape( kwd.get( 'message', '' ) ) status = kwd.get( 'status', 'done' ) id = kwd.get( 'id', None ) if id: diff -r f0f1f78b54c55c8569bd1e3ed7fc15726b0b64a4 -r c2bed0a496f8fee8685977df733b06dfeac763e6 lib/galaxy/webapps/tool_shed/controllers/repository.py --- a/lib/galaxy/webapps/tool_shed/controllers/repository.py +++ b/lib/galaxy/webapps/tool_shed/controllers/repository.py @@ -6,6 +6,7 @@ from time import strftime from datetime import date from datetime import datetime +from markupsafe import escape from galaxy import util from galaxy import web @@ -385,7 +386,7 @@ action='reviewed_repositories_i_own' ) ) elif operation == "repositories_by_category": category_id = kwd.get( 'id', None ) - message = kwd.get( 'message', '' ) + message = escape( kwd.get( 'message', '' ) ) status = kwd.get( 'status', 'done' ) return trans.response.send_redirect( web.url_for( controller='repository', action='browse_repositories_in_category', @@ -721,9 +722,9 @@ @web.expose def browse_repository( self, trans, id, **kwd ): - message = kwd.get( 'message', '' ) + message = escape( kwd.get( 'message', '' ) ) status = kwd.get( 'status', 'done' ) - commit_message = kwd.get( 'commit_message', 'Deleted selected files' ) + commit_message = escape( kwd.get( 'commit_message', 'Deleted selected files' ) ) repository = suc.get_repository_in_tool_shed( trans.app, id ) repo = hg_util.get_repo_for_repository( trans.app, repository=repository, repo_path=None, create=False ) # Update repository files for browsing. @@ -891,7 +892,7 @@ @web.expose def check_for_updates( self, trans, **kwd ): """Handle a request from a local Galaxy instance.""" - message = kwd.get( 'message', '' ) + message = escape( kwd.get( 'message', '' ) ) status = kwd.get( 'status', 'done' ) # If the request originated with the UpdateRepositoryManager, it will not include a galaxy_url. galaxy_url = common_util.handle_galaxy_url( trans, **kwd ) @@ -976,7 +977,7 @@ @web.expose def contact_owner( self, trans, id, **kwd ): - message = kwd.get( 'message', '' ) + message = escape( kwd.get( 'message', '' ) ) status = kwd.get( 'status', 'done' ) repository = suc.get_repository_in_tool_shed( trans.app, id ) metadata = metadata_util.get_repository_metadata_by_repository_id_changeset_revision( trans.app, @@ -995,7 +996,7 @@ @web.expose def create_galaxy_docker_image( self, trans, **kwd ): - message = kwd.get( 'message', '' ) + message = escape( kwd.get( 'message', '' ) ) status = kwd.get( 'status', 'done' ) repository_ids = util.listify( kwd.get( 'id', '' ) ) if 'operation' in kwd: @@ -1051,7 +1052,7 @@ @web.expose def create_repository( self, trans, **kwd ): - message = kwd.get( 'message', '' ) + message = escape( kwd.get( 'message', '' ) ) status = kwd.get( 'status', 'done' ) categories = suc.get_categories( trans ) if not categories: @@ -1108,7 +1109,7 @@ # Marking a repository in the tool shed as deprecated has no effect on any downloadable changeset # revisions that may be associated with the repository. Revisions are not marked as not downlaodable # because those that have installed the repository must be allowed to get updates. - message = kwd.get( 'message', '' ) + message = escape( kwd.get( 'message', '' ) ) status = kwd.get( 'status', 'done' ) repository_id = kwd.get( 'id', None ) repository = suc.get_repository_in_tool_shed( trans.app, repository_id ) @@ -1164,7 +1165,7 @@ @web.expose def display_tool( self, trans, repository_id, tool_config, changeset_revision, **kwd ): - message = kwd.get( 'message', '' ) + message = escape( kwd.get( 'message', '' ) ) status = kwd.get( 'status', 'done' ) render_repository_actions_for = kwd.get( 'render_repository_actions_for', 'tool_shed' ) tv = tool_validator.ToolValidator( trans.app ) @@ -1229,7 +1230,7 @@ @web.expose def export( self, trans, repository_id, changeset_revision, **kwd ): - message = kwd.get( 'message', '' ) + message = escape( kwd.get( 'message', '' ) ) status = kwd.get( 'status', 'done' ) export_repository_dependencies = kwd.get( 'export_repository_dependencies', '' ) repository = suc.get_repository_in_tool_shed( trans.app, repository_id ) @@ -1309,7 +1310,7 @@ @web.expose def find_tools( self, trans, **kwd ): - message = kwd.get( 'message', '' ) + message = escape( kwd.get( 'message', '' ) ) status = kwd.get( 'status', 'done' ) galaxy_url = common_util.handle_galaxy_url( trans, **kwd ) if 'operation' in kwd: @@ -1400,7 +1401,7 @@ @web.expose def find_workflows( self, trans, **kwd ): - message = kwd.get( 'message', '' ) + message = escape( kwd.get( 'message', '' ) ) status = kwd.get( 'status', 'done' ) galaxy_url = common_util.handle_galaxy_url( trans, **kwd ) if 'operation' in kwd: @@ -2020,13 +2021,13 @@ @web.expose def help( self, trans, **kwd ): - message = kwd.get( 'message', '' ) + message = escape( kwd.get( 'message', '' ) ) status = kwd.get( 'status', 'done' ) return trans.fill_template( '/webapps/tool_shed/repository/help.mako', message=message, status=status, **kwd ) @web.expose def import_capsule( self, trans, **kwd ): - message = kwd.get( 'message', '' ) + message = escape( kwd.get( 'message', '' ) ) status = kwd.get( 'status', 'done' ) capsule_file_name = kwd.get( 'capsule_file_name', None ) encoded_file_path = kwd.get( 'encoded_file_path', None ) @@ -2069,7 +2070,7 @@ @web.expose def index( self, trans, **kwd ): - message = kwd.get( 'message', '' ) + message = escape( kwd.get( 'message', '' ) ) status = kwd.get( 'status', 'done' ) # See if there are any RepositoryMetadata records since menu items require them. repository_metadata = trans.sa_session.query( trans.model.RepositoryMetadata ).first() @@ -2151,7 +2152,7 @@ @web.expose def load_invalid_tool( self, trans, repository_id, tool_config, changeset_revision, **kwd ): - message = kwd.get( 'message', '' ) + message = escape( kwd.get( 'message', '' ) ) status = kwd.get( 'status', 'error' ) render_repository_actions_for = kwd.get( 'render_repository_actions_for', 'tool_shed' ) tv = tool_validator.ToolValidator( trans.app ) @@ -2203,7 +2204,7 @@ @web.expose @web.require_login( "manage email alerts" ) def manage_email_alerts( self, trans, **kwd ): - message = kwd.get( 'message', '' ) + message = escape( kwd.get( 'message', '' ) ) status = kwd.get( 'status', 'done' ) new_repo_alert = kwd.get( 'new_repo_alert', '' ) new_repo_alert_checked = CheckboxField.is_checked( new_repo_alert ) @@ -2234,7 +2235,7 @@ @web.expose @web.require_login( "manage repository" ) def manage_repository( self, trans, id, **kwd ): - message = kwd.get( 'message', '' ) + message = escape( kwd.get( 'message', '' ) ) status = kwd.get( 'status', 'done' ) repository = suc.get_repository_in_tool_shed( trans.app, id ) repository_type = kwd.get( 'repository_type', str( repository.type ) ) @@ -2500,7 +2501,7 @@ @web.expose @web.require_login( "manage repository administrators" ) def manage_repository_admins( self, trans, id, **kwd ): - message = kwd.get( 'message', '' ) + message = escape( kwd.get( 'message', '' ) ) status = kwd.get( 'status', 'done' ) repository = suc.get_repository_in_tool_shed( trans.app, id ) changeset_revision = kwd.get( 'changeset_revision', repository.tip( trans.app ) ) @@ -2558,7 +2559,7 @@ @web.expose @web.require_login( "multi select email alerts" ) def multi_select_email_alerts( self, trans, **kwd ): - message = kwd.get( 'message', '' ) + message = escape( kwd.get( 'message', '' ) ) status = kwd.get( 'status', 'done' ) if 'operation' in kwd: operation = kwd[ 'operation' ].lower() @@ -2607,7 +2608,7 @@ @web.expose def preview_tools_in_changeset( self, trans, repository_id, **kwd ): - message = kwd.get( 'message', '' ) + message = escape( kwd.get( 'message', '' ) ) status = kwd.get( 'status', 'done' ) repository = suc.get_repository_in_tool_shed( trans.app, repository_id ) repo = hg_util.get_repo_for_repository( trans.app, repository=repository, repo_path=None, create=False ) @@ -2714,7 +2715,7 @@ @web.require_login( "rate repositories" ) def rate_repository( self, trans, **kwd ): """ Rate a repository and return updated rating data. """ - message = kwd.get( 'message', '' ) + message = escape( kwd.get( 'message', '' ) ) status = kwd.get( 'status', 'done' ) id = kwd.get( 'id', None ) if not id: @@ -2787,7 +2788,7 @@ if 'reset_metadata_on_selected_repositories_button' in kwd: message, status = rmm.reset_metadata_on_selected_repositories( **kwd ) else: - message = kwd.get( 'message', '' ) + message = escape( kwd.get( 'message', '' ) ) status = kwd.get( 'status', 'done' ) repositories_select_field = rmm.build_repository_ids_select_field( name='repository_ids', multiple=True, @@ -2800,9 +2801,9 @@ @web.expose def select_files_to_delete( self, trans, id, **kwd ): - message = kwd.get( 'message', '' ) + message = escape( kwd.get( 'message', '' ) ) status = kwd.get( 'status', 'done' ) - commit_message = kwd.get( 'commit_message', 'Deleted selected files' ) + commit_message = escape( kwd.get( 'commit_message', 'Deleted selected files' ) ) repository = suc.get_repository_in_tool_shed( trans.app, id ) repo_dir = repository.repo_path( trans.app ) repo = hg_util.get_repo_for_repository( trans.app, repository=None, repo_path=repo_dir, create=False ) @@ -3145,7 +3146,7 @@ @web.expose def upload_capsule( self, trans, **kwd ): - message = kwd.get( 'message', '' ) + message = escape( kwd.get( 'message', '' ) ) status = kwd.get( 'status', 'done' ) url = kwd.get( 'url', '' ) if 'upload_capsule_button' in kwd: @@ -3175,7 +3176,7 @@ @web.expose def view_changelog( self, trans, id, **kwd ): - message = kwd.get( 'message', '' ) + message = escape( kwd.get( 'message', '' ) ) status = kwd.get( 'status', 'done' ) repository = suc.get_repository_in_tool_shed( trans.app, id ) repo = hg_util.get_repo_for_repository( trans.app, repository=repository, repo_path=None, create=False ) @@ -3210,7 +3211,7 @@ @web.expose def view_changeset( self, trans, id, ctx_str, **kwd ): - message = kwd.get( 'message', '' ) + message = escape( kwd.get( 'message', '' ) ) status = kwd.get( 'status', 'done' ) repository = suc.get_repository_in_tool_shed( trans.app, id ) repo = hg_util.get_repo_for_repository( trans.app, repository=repository, repo_path=None, create=False ) @@ -3302,7 +3303,7 @@ @web.expose def view_repository( self, trans, id, **kwd ): - message = kwd.get( 'message', '' ) + message = escape( kwd.get( 'message', '' ) ) status = kwd.get( 'status', 'done' ) repository = suc.get_repository_in_tool_shed( trans.app, id ) repo = hg_util.get_repo_for_repository( trans.app, repository=repository, repo_path=None, create=False ) @@ -3390,7 +3391,7 @@ @web.expose def view_tool_metadata( self, trans, repository_id, changeset_revision, tool_id, **kwd ): - message = kwd.get( 'message', '' ) + message = escape( kwd.get( 'message', '' ) ) status = kwd.get( 'status', 'done' ) render_repository_actions_for = kwd.get( 'render_repository_actions_for', 'tool_shed' ) repository = suc.get_repository_in_tool_shed( trans.app, repository_id ) @@ -3471,7 +3472,7 @@ @web.expose def view_workflow( self, trans, workflow_name, repository_metadata_id, **kwd ): """Retrieve necessary information about a workflow from the database so that it can be displayed in an svg image.""" - message = kwd.get( 'message', '' ) + message = escape( kwd.get( 'message', '' ) ) status = kwd.get( 'status', 'done' ) render_repository_actions_for = kwd.get( 'render_repository_actions_for', 'tool_shed' ) if workflow_name: diff -r f0f1f78b54c55c8569bd1e3ed7fc15726b0b64a4 -r c2bed0a496f8fee8685977df733b06dfeac763e6 lib/galaxy/webapps/tool_shed/controllers/repository_review.py --- a/lib/galaxy/webapps/tool_shed/controllers/repository_review.py +++ b/lib/galaxy/webapps/tool_shed/controllers/repository_review.py @@ -2,6 +2,7 @@ import os from sqlalchemy.sql.expression import func +from markupsafe import escape from galaxy import util from galaxy import web @@ -40,7 +41,7 @@ @web.require_login( "approve repository review" ) def approve_repository_review( self, trans, **kwd ): # The value of the received id is the encoded review id. - message = kwd.get( 'message', '' ) + message = escape( kwd.get( 'message', '' ) ) status = kwd.get( 'status', 'done' ) encoded_review_id = kwd[ 'id' ] review = review_util.get_review( trans.app, encoded_review_id ) @@ -74,7 +75,7 @@ @web.expose @web.require_login( "browse review" ) def browse_review( self, trans, **kwd ): - message = kwd.get( 'message', '' ) + message = escape( kwd.get( 'message', '' ) ) status = kwd.get( 'status', 'done' ) review = review_util.get_review( trans.app, kwd[ 'id' ] ) repository = review.repository @@ -105,7 +106,7 @@ @web.expose @web.require_login( "create component" ) def create_component( self, trans, **kwd ): - message = kwd.get( 'message', '' ) + message = escape( kwd.get( 'message', '' ) ) status = kwd.get( 'status', 'done' ) name = kwd.get( 'name', '' ) description = kwd.get( 'description', '' ) @@ -136,7 +137,7 @@ @web.require_login( "create review" ) def create_review( self, trans, **kwd ): # The value of the received id is the encoded repository id. - message = kwd.get( 'message', '' ) + message = escape( kwd.get( 'message', '' ) ) status = kwd.get( 'status', 'done' ) repository_id = kwd.get( 'id', None ) changeset_revision = kwd.get( 'changeset_revision', None ) @@ -201,7 +202,7 @@ @web.expose @web.require_login( "edit component" ) def edit_component( self, trans, **kwd ): - message = kwd.get( 'message', '' ) + message = escape( kwd.get( 'message', '' ) ) status = kwd.get( 'status', 'done' ) id = kwd.get( 'id', None ) if not id: @@ -232,7 +233,7 @@ @web.require_login( "edit review" ) def edit_review( self, trans, **kwd ): # The value of the received id is the encoded review id. - message = kwd.get( 'message', '' ) + message = escape( kwd.get( 'message', '' ) ) status = kwd.get( 'status', 'done' ) review_id = kwd.get( 'id', None ) review = review_util.get_review( trans.app, review_id ) @@ -408,7 +409,7 @@ @web.require_login( "manage repositories reviewed by me" ) def manage_repositories_reviewed_by_me( self, trans, **kwd ): # The value of the received id is the encoded repository id. - message = kwd.get( 'message', '' ) + message = escape( kwd.get( 'message', '' ) ) status = kwd.get( 'status', 'done' ) if 'operation' in kwd: kwd[ 'mine' ] = True @@ -475,7 +476,7 @@ @web.require_login( "manage repository reviews" ) def manage_repository_reviews( self, trans, mine=False, **kwd ): # The value of the received id is the encoded repository id. - message = kwd.get( 'message', '' ) + message = escape( kwd.get( 'message', '' ) ) status = kwd.get( 'status', 'done' ) repository_id = kwd.get( 'id', None ) if repository_id: @@ -524,7 +525,7 @@ @web.require_login( "manage repository reviews of revision" ) def manage_repository_reviews_of_revision( self, trans, **kwd ): # The value of the received id is the encoded repository id. - message = kwd.get( 'message', '' ) + message = escape( kwd.get( 'message', '' ) ) status = kwd.get( 'status', 'done' ) repository_id = kwd.get( 'id', None ) changeset_revision = kwd.get( 'changeset_revision', None ) @@ -547,7 +548,7 @@ @web.expose @web.require_login( "repository reviews by user" ) def repository_reviews_by_user( self, trans, **kwd ): - message = kwd.get( 'message', '' ) + message = escape( kwd.get( 'message', '' ) ) status = kwd.get( 'status', 'done' ) if 'operation' in kwd: @@ -573,7 +574,7 @@ @web.expose @web.require_login( "reviewed repositories i own" ) def reviewed_repositories_i_own( self, trans, **kwd ): - message = kwd.get( 'message', '' ) + message = escape( kwd.get( 'message', '' ) ) status = kwd.get( 'status', 'done' ) # The value of the received id is the encoded repository id. if 'operation' in kwd: @@ -592,7 +593,7 @@ @web.require_login( "select previous review" ) def select_previous_review( self, trans, **kwd ): # The value of the received id is the encoded repository id. - message = kwd.get( 'message', '' ) + message = escape( kwd.get( 'message', '' ) ) status = kwd.get( 'status', 'done' ) repository = suc.get_repository_in_tool_shed( trans.app, kwd[ 'id' ] ) changeset_revision = kwd.get( 'changeset_revision', None ) diff -r f0f1f78b54c55c8569bd1e3ed7fc15726b0b64a4 -r c2bed0a496f8fee8685977df733b06dfeac763e6 lib/galaxy/webapps/tool_shed/controllers/upload.py --- a/lib/galaxy/webapps/tool_shed/controllers/upload.py +++ b/lib/galaxy/webapps/tool_shed/controllers/upload.py @@ -9,6 +9,7 @@ from galaxy import web from galaxy.datatypes import checkers from galaxy.web.base.controller import BaseUIController +from markupsafe import escape from tool_shed.dependencies import attribute_handlers from tool_shed.galaxy_install import dependency_display @@ -34,9 +35,9 @@ @web.expose @web.require_login( 'upload', use_panels=True ) def upload( self, trans, **kwd ): - message = kwd.get( 'message', '' ) + message = escape( kwd.get( 'message', '' ) ) status = kwd.get( 'status', 'done' ) - commit_message = kwd.get( 'commit_message', 'Uploaded' ) + commit_message = escape( kwd.get( 'commit_message', 'Uploaded' ) ) category_ids = util.listify( kwd.get( 'category_id', '' ) ) categories = suc.get_categories( trans.app ) repository_id = kwd.get( 'repository_id', '' ) diff -r f0f1f78b54c55c8569bd1e3ed7fc15726b0b64a4 -r c2bed0a496f8fee8685977df733b06dfeac763e6 lib/tool_shed/util/repository_util.py --- a/lib/tool_shed/util/repository_util.py +++ b/lib/tool_shed/util/repository_util.py @@ -7,6 +7,7 @@ from galaxy import web from galaxy.web.form_builder import build_select_field from galaxy.webapps.tool_shed.model import directory_hash_id +from markupsafe import escape from tool_shed.dependencies.repository import relation_builder @@ -256,7 +257,7 @@ def handle_role_associations( app, role, repository, **kwd ): sa_session = app.model.context.current - message = kwd.get( 'message', '' ) + message = escape( kwd.get( 'message', '' ) ) status = kwd.get( 'status', 'done' ) repository_owner = repository.user if kwd.get( 'manage_role_associations_button', False ): https://bitbucket.org/galaxy/galaxy-central/commits/8d371e7b28dc/ Changeset: 8d371e7b28dc Branch: stable User: davebgx Date: 2014-12-11 16:36:55+00:00 Summary: Also escape repository names, just in case. Affected #: 1 file diff -r c2bed0a496f8fee8685977df733b06dfeac763e6 -r 8d371e7b28dc02d732d59f6477adb48d651a97ac lib/galaxy/webapps/galaxy/controllers/admin_toolshed.py --- a/lib/galaxy/webapps/galaxy/controllers/admin_toolshed.py +++ b/lib/galaxy/webapps/galaxy/controllers/admin_toolshed.py @@ -53,7 +53,7 @@ try: trans.app.installed_repository_manager.activate_repository( repository ) except Exception, e: - error_message = "Error activating repository %s: %s" % ( repository.name, str( e ) ) + error_message = "Error activating repository %s: %s" % ( escape( repository.name ), str( e ) ) log.exception( error_message ) message = '%s.<br/>You may be able to resolve this by uninstalling and then reinstalling the repository. Click <a href="%s">here</a> to uninstall the repository.' \ % ( error_message, web.url_for( controller='admin_toolshed', action='deactivate_or_uninstall_repository', id=trans.security.encode_id( repository.id ) ) ) @@ -63,7 +63,7 @@ id=repository_id, message=message, status=status ) ) - message = 'The <b>%s</b> repository has been activated.' % repository.name + message = 'The <b>%s</b> repository has been activated.' % escape( repository.name ) status = 'done' return trans.response.send_redirect( web.url_for( controller='admin_toolshed', action='browse_repositories', @@ -142,7 +142,7 @@ action='reselect_tool_panel_section', **kwd ) ) else: - message = "Unable to get latest revision for repository <b>%s</b> from " % str( repository.name ) + message = "Unable to get latest revision for repository <b>%s</b> from " % escape( str( repository.name ) ) message += "the Tool Shed, so repository re-installation is not possible at this time." status = "error" return trans.response.send_redirect( web.url_for( controller='admin_toolshed', @@ -304,14 +304,14 @@ trans.install_model.context.add( tool_shed_repository ) trans.install_model.context.flush() if remove_from_disk_checked: - message = 'The repository named <b>%s</b> has been uninstalled. ' % tool_shed_repository.name + message = 'The repository named <b>%s</b> has been uninstalled. ' % escape( tool_shed_repository.name ) if errors: message += 'Attempting to uninstall tool dependencies resulted in errors: %s' % errors status = 'error' else: status = 'done' else: - message = 'The repository named <b>%s</b> has been deactivated. ' % tool_shed_repository.name + message = 'The repository named <b>%s</b> has been deactivated. ' % escape( tool_shed_repository.name ) status = 'done' return trans.response.send_redirect( web.url_for( controller='admin_toolshed', action='browse_repositories', @@ -454,7 +454,7 @@ workflow_name = encoding_util.tool_shed_encode( str( workflow.name ) ) else: message += 'Unable to locate a workflow named <b>%s</b> within the installed tool shed repository named <b>%s</b>' % \ - ( str( workflow_name ), str( repository.name ) ) + ( escape( str( workflow_name ) ), escape( str( repository.name ) ) ) status = 'error' else: message = 'Invalid repository id <b>%s</b> received.' % str( repository_id ) @@ -610,7 +610,7 @@ relative_install_dir, set_status=False ) message = "The installed repository named '%s' has been updated to change set revision '%s'. " % \ - ( str( repository.name ), updating_to_changeset_revision ) + ( escape( str( repository.name ) ), updating_to_changeset_revision ) self.initiate_tool_dependency_installation( trans, tool_dependencies, message=message, status=status ) # Handle tool dependencies check box. if trans.app.config.tool_dependency_dir is None: @@ -903,7 +903,7 @@ # The user must be on the manage_repository_tool_dependencies page and clicked the button to either install or uninstall a # tool dependency, but they didn't check any of the available tool dependencies on which to perform the action. tool_shed_repository = suc.get_tool_shed_repository_by_id( trans.app, repository_id ) - self.tool_dependency_grid.title = "Tool shed repository '%s' tool dependencies" % tool_shed_repository.name + self.tool_dependency_grid.title = "Tool shed repository '%s' tool dependencies" % escape( tool_shed_repository.name ) if 'operation' in kwd: operation = kwd[ 'operation' ].lower() if not tool_dependency_ids: @@ -1031,7 +1031,7 @@ # The Tool Shed cannot handle the get_repository_id request, so the code must be older than the # 04/2014 Galaxy release when it was introduced. It will be safest to error out and let the # Tool Shed admin update the Tool Shed to a later release. - message = 'The updates available for the repository <b>%s</b> ' % str( repository.name ) + message = 'The updates available for the repository <b>%s</b> ' % escape( str( repository.name ) ) message += 'include newly defined repository or tool dependency definitions, and attempting ' message += 'to update the repository resulted in the following error. Contact the Tool Shed ' message += 'administrator if necessary.<br/>%s' % str( e ) @@ -1649,12 +1649,12 @@ no_changes_check_box = CheckboxField( 'no_changes', checked=True ) if original_section_name: message += "The tools contained in your <b>%s</b> repository were last loaded into the tool panel section <b>%s</b>. " \ - % ( tool_shed_repository.name, original_section_name ) + % ( escape( tool_shed_repository.name ), original_section_name ) message += "Uncheck the <b>No changes</b> check box and select a different tool panel section to load the tools in a " message += "different section in the tool panel. " status = 'warning' else: - message += "The tools contained in your <b>%s</b> repository were last loaded into the tool panel outside of any sections. " % tool_shed_repository.name + message += "The tools contained in your <b>%s</b> repository were last loaded into the tool panel outside of any sections. " % escape( tool_shed_repository.name ) message += "Uncheck the <b>No changes</b> check box and select a tool panel section to load the tools into that section. " status = 'warning' else: @@ -1750,13 +1750,13 @@ irmm.update_in_shed_tool_config() trans.install_model.context.add( repository ) trans.install_model.context.flush() - message = 'Metadata has been reset on repository <b>%s</b>.' % repository.name + message = 'Metadata has been reset on repository <b>%s</b>.' % escape( repository.name ) status = 'done' else: - message = 'Metadata did not need to be reset on repository <b>%s</b>.' % repository.name + message = 'Metadata did not need to be reset on repository <b>%s</b>.' % escape( repository.name ) status = 'done' else: - message = 'Error locating installation directory for repository <b>%s</b>.' % repository.name + message = 'Error locating installation directory for repository <b>%s</b>.' % escape( repository.name ) status = 'error' return trans.response.send_redirect( web.url_for( controller='admin_toolshed', action='manage_repository', @@ -1778,7 +1778,7 @@ uninstalled=False, remove_from_disk=True ) new_kwd = {} - new_kwd[ 'message' ] = "You can now attempt to install the repository named <b>%s</b> again." % str( repository.name ) + new_kwd[ 'message' ] = "You can now attempt to install the repository named <b>%s</b> again." % escape( str( repository.name ) ) new_kwd[ 'status' ] = "done" return trans.response.send_redirect( web.url_for( controller='admin_toolshed', action='browse_repositories', @@ -1809,7 +1809,7 @@ message = "Tool versions have been set for all included tools." status = 'done' else: - message = "Version information for the tools included in the <b>%s</b> repository is missing. " % repository.name + message = "Version information for the tools included in the <b>%s</b> repository is missing. " % escape( repository.name ) message += "Reset all of this reppository's metadata in the tool shed, then set the installed tool versions " message ++ "from the installed repository's <b>Repository Actions</b> menu. " status = 'error' @@ -2084,7 +2084,7 @@ if ok: success_count += 1 else: - repository_names_not_updated.append( '<b>%s</b>' % str( repository.name ) ) + repository_names_not_updated.append( '<b>%s</b>' % escape( str( repository.name ) ) ) if updated: updated_count += 1 message = "Checked the status in the tool shed for %d repositories. " % success_count @@ -2099,11 +2099,11 @@ repository_util.check_or_update_tool_shed_status_for_installed_repository( trans.app, repository ) if ok: if updated: - message = "The tool shed status for repository <b>%s</b> has been updated." % str( repository.name ) + message = "The tool shed status for repository <b>%s</b> has been updated." % escape( str( repository.name ) ) else: - message = "The status has not changed in the tool shed for repository <b>%s</b>." % str( repository.name ) + message = "The status has not changed in the tool shed for repository <b>%s</b>." % escape( str( repository.name ) ) else: - message = "Unable to retrieve status from the tool shed for repository <b>%s</b>." % str( repository.name ) + message = "Unable to retrieve status from the tool shed for repository <b>%s</b>." % escape( str( repository.name ) ) status = 'error' return trans.response.send_redirect( web.url_for( controller='admin_toolshed', action='browse_repositories', https://bitbucket.org/galaxy/galaxy-central/commits/77528372d36c/ Changeset: 77528372d36c Branch: stable User: davebgx Date: 2014-12-11 16:39:50+00:00 Summary: One message was left unescaped. Affected #: 1 file diff -r 8d371e7b28dc02d732d59f6477adb48d651a97ac -r 77528372d36c367e5af62f2185d0b332cb901d97 lib/galaxy/webapps/galaxy/controllers/library_admin.py --- a/lib/galaxy/webapps/galaxy/controllers/library_admin.py +++ b/lib/galaxy/webapps/galaxy/controllers/library_admin.py @@ -162,12 +162,12 @@ library.root_folder = root_folder trans.sa_session.add_all( ( library, root_folder ) ) trans.sa_session.flush() - message = "The new library named '%s' has been created" % library.name + message = "The new library named '%s' has been created" return trans.response.send_redirect( web.url_for( controller='library_common', action='browse_library', cntrller='library_admin', id=trans.security.encode_id( library.id ), - message=message, + message=escape( message ), status='done' ) ) return trans.fill_template( '/admin/library/new_library.mako', message=escape( message ), status=escape( status ) ) @web.expose https://bitbucket.org/galaxy/galaxy-central/commits/e416697be38e/ Changeset: e416697be38e Branch: stable User: martenson Date: 2014-12-11 18:08:35+00:00 Summary: Merged in davebgx/galaxy-central/stable (pull request #606) [STABLE] Escape instances of message passed in through kwd before pushing them back out to mako. Affected #: 14 files diff -r 0ac7297b58491d542948ae3976732dd2c3450b89 -r e416697be38e66f18be89a4cfca70457c9784294 lib/galaxy/web/base/controllers/admin.py --- a/lib/galaxy/web/base/controllers/admin.py +++ b/lib/galaxy/web/base/controllers/admin.py @@ -7,6 +7,7 @@ from galaxy.web.form_builder import CheckboxField from string import punctuation as PUNCTUATION import galaxy.queue_worker +from markupsafe import escape from tool_shed.util import shed_util_common as suc @@ -28,7 +29,7 @@ @web.expose @web.require_admin def index( self, trans, **kwd ): - message = kwd.get( 'message', '' ) + message = escape( kwd.get( 'message', '' ) ) status = kwd.get( 'status', 'done' ) if trans.webapp.name == 'galaxy': installed_repositories = trans.install_model.context.query( trans.install_model.ToolShedRepository ).first() @@ -46,7 +47,7 @@ @web.expose @web.require_admin def center( self, trans, **kwd ): - message = kwd.get( 'message', '' ) + message = escape( kwd.get( 'message', '' ) ) status = kwd.get( 'status', 'done' ) if trans.webapp.name == 'galaxy': return trans.fill_template( '/webapps/galaxy/admin/center.mako', diff -r 0ac7297b58491d542948ae3976732dd2c3450b89 -r e416697be38e66f18be89a4cfca70457c9784294 lib/galaxy/webapps/demo_sequencer/controllers/common.py --- a/lib/galaxy/webapps/demo_sequencer/controllers/common.py +++ b/lib/galaxy/webapps/demo_sequencer/controllers/common.py @@ -4,6 +4,7 @@ import time, socket, urllib, urllib2, base64, copy from galaxy.util.json import * from urllib import quote_plus, unquote_plus +from markupsafe import escape import logging log = logging.getLogger( __name__ ) @@ -16,7 +17,7 @@ titles = util.listify( titles ) JobId = util.restore_text( kwd.get( 'JobId', '' ) ) sample_id = util.restore_text( kwd.get( 'sample_id', '' ) ) - message = util.restore_text( kwd.get( 'message', '' ) ) + message = escape( util.restore_text( kwd.get( 'message', '' ) ) ) status = kwd.get( 'status', 'done' ) redirect_delay = trans.app.sequencer_actions_registry.redirect_delay sequencer_redirects = copy.deepcopy( trans.app.sequencer_actions_registry.sequencer_redirects ) @@ -144,7 +145,7 @@ titles = util.restore_text( kwd.get( 'titles', '' ) ) JobId = util.restore_text( kwd.get( 'JobId', '' ) ) sample_id = util.restore_text( kwd.get( 'sample_id', '' ) ) - message = util.restore_text( kwd.get( 'message', '' ) ) + message = escape( util.restore_text( kwd.get( 'message', '' ) ) ) status = kwd.get( 'status', 'done' ) url, http_method, request_params, response_type = request_tup url = unquote_plus( url ) diff -r 0ac7297b58491d542948ae3976732dd2c3450b89 -r e416697be38e66f18be89a4cfca70457c9784294 lib/galaxy/webapps/galaxy/controllers/admin.py --- a/lib/galaxy/webapps/galaxy/controllers/admin.py +++ b/lib/galaxy/webapps/galaxy/controllers/admin.py @@ -17,6 +17,7 @@ from galaxy.web.params import QuotaParamParser from tool_shed.util import common_util from tool_shed.util import encoding_util +from markupsafe import escape log = logging.getLogger( __name__ ) @@ -838,7 +839,7 @@ @web.expose @web.require_admin def review_tool_migration_stages( self, trans, **kwd ): - message = galaxy.util.restore_text( kwd.get( 'message', '' ) ) + message = escape( galaxy.util.restore_text( kwd.get( 'message', '' ) ) ) status = galaxy.util.restore_text( kwd.get( 'status', 'done' ) ) migration_stages_dict = odict() migration_modules = [] @@ -870,13 +871,13 @@ @web.expose @web.require_admin def view_datatypes_registry( self, trans, **kwd ): - message = galaxy.util.restore_text( kwd.get( 'message', '' ) ) + message = escape( galaxy.util.restore_text( kwd.get( 'message', '' ) ) ) status = galaxy.util.restore_text( kwd.get( 'status', 'done' ) ) return trans.fill_template( 'admin/view_datatypes_registry.mako', message=message, status=status ) @web.expose @web.require_admin def view_tool_data_tables( self, trans, **kwd ): - message = galaxy.util.restore_text( kwd.get( 'message', '' ) ) + message = escape( galaxy.util.restore_text( kwd.get( 'message', '' ) ) ) status = galaxy.util.restore_text( kwd.get( 'status', 'done' ) ) return trans.fill_template( 'admin/view_data_tables_registry.mako', message=message, status=status ) diff -r 0ac7297b58491d542948ae3976732dd2c3450b89 -r e416697be38e66f18be89a4cfca70457c9784294 lib/galaxy/webapps/galaxy/controllers/admin_toolshed.py --- a/lib/galaxy/webapps/galaxy/controllers/admin_toolshed.py +++ b/lib/galaxy/webapps/galaxy/controllers/admin_toolshed.py @@ -8,6 +8,7 @@ from galaxy.web.form_builder import CheckboxField from galaxy.util import json from galaxy.model.orm import or_ +from markupsafe import escape import tool_shed.repository_types.util as rt_util @@ -52,7 +53,7 @@ try: trans.app.installed_repository_manager.activate_repository( repository ) except Exception, e: - error_message = "Error activating repository %s: %s" % ( repository.name, str( e ) ) + error_message = "Error activating repository %s: %s" % ( escape( repository.name ), str( e ) ) log.exception( error_message ) message = '%s.<br/>You may be able to resolve this by uninstalling and then reinstalling the repository. Click <a href="%s">here</a> to uninstall the repository.' \ % ( error_message, web.url_for( controller='admin_toolshed', action='deactivate_or_uninstall_repository', id=trans.security.encode_id( repository.id ) ) ) @@ -62,7 +63,7 @@ id=repository_id, message=message, status=status ) ) - message = 'The <b>%s</b> repository has been activated.' % repository.name + message = 'The <b>%s</b> repository has been activated.' % escape( repository.name ) status = 'done' return trans.response.send_redirect( web.url_for( controller='admin_toolshed', action='browse_repositories', @@ -72,7 +73,7 @@ @web.expose @web.require_admin def browse_repository( self, trans, **kwd ): - message = kwd.get( 'message', '' ) + message = escape( kwd.get( 'message', '' ) ) status = kwd.get( 'status', 'done' ) repository = repository_util.get_installed_tool_shed_repository( trans.app, kwd[ 'id' ] ) return trans.fill_template( '/admin/tool_shed_repository/browse_repository.mako', @@ -141,7 +142,7 @@ action='reselect_tool_panel_section', **kwd ) ) else: - message = "Unable to get latest revision for repository <b>%s</b> from " % str( repository.name ) + message = "Unable to get latest revision for repository <b>%s</b> from " % escape( str( repository.name ) ) message += "the Tool Shed, so repository re-installation is not possible at this time." status = "error" return trans.response.send_redirect( web.url_for( controller='admin_toolshed', @@ -169,7 +170,7 @@ @web.expose @web.require_admin def browse_tool_dependency( self, trans, **kwd ): - message = kwd.get( 'message', '' ) + message = escape( kwd.get( 'message', '' ) ) status = kwd.get( 'status', 'done' ) tool_dependency_ids = tool_dependency_util.get_tool_dependency_ids( as_string=False, **kwd ) tool_dependency = tool_dependency_util.get_tool_dependency( trans.app, tool_dependency_ids[ 0 ] ) @@ -197,7 +198,7 @@ @web.expose @web.require_admin def browse_tool_sheds( self, trans, **kwd ): - message = kwd.get( 'message', '' ) + message = escape( kwd.get( 'message', '' ) ) status = kwd.get( 'status', 'done' ) return trans.fill_template( '/webapps/galaxy/admin/tool_sheds.mako', message=message, @@ -230,7 +231,7 @@ require the same entry. For now we'll never delete entries from config.shed_tool_data_table_config, but we may choose to do so in the future if it becomes necessary. """ - message = kwd.get( 'message', '' ) + message = escape( kwd.get( 'message', '' ) ) status = kwd.get( 'status', 'done' ) remove_from_disk = kwd.get( 'remove_from_disk', '' ) remove_from_disk_checked = CheckboxField.is_checked( remove_from_disk ) @@ -303,14 +304,14 @@ trans.install_model.context.add( tool_shed_repository ) trans.install_model.context.flush() if remove_from_disk_checked: - message = 'The repository named <b>%s</b> has been uninstalled. ' % tool_shed_repository.name + message = 'The repository named <b>%s</b> has been uninstalled. ' % escape( tool_shed_repository.name ) if errors: message += 'Attempting to uninstall tool dependencies resulted in errors: %s' % errors status = 'error' else: status = 'done' else: - message = 'The repository named <b>%s</b> has been deactivated. ' % tool_shed_repository.name + message = 'The repository named <b>%s</b> has been deactivated. ' % escape( tool_shed_repository.name ) status = 'done' return trans.response.send_redirect( web.url_for( controller='admin_toolshed', action='browse_repositories', @@ -442,7 +443,7 @@ @web.require_admin def import_workflow( self, trans, workflow_name, repository_id, **kwd ): """Import a workflow contained in an installed tool shed repository into Galaxy.""" - message = kwd.get( 'message', '' ) + message = escape( kwd.get( 'message', '' ) ) status = kwd.get( 'status', 'done' ) if workflow_name: workflow_name = encoding_util.tool_shed_decode( workflow_name ) @@ -453,7 +454,7 @@ workflow_name = encoding_util.tool_shed_encode( str( workflow.name ) ) else: message += 'Unable to locate a workflow named <b>%s</b> within the installed tool shed repository named <b>%s</b>' % \ - ( str( workflow_name ), str( repository.name ) ) + ( escape( str( workflow_name ) ), escape( str( repository.name ) ) ) status = 'error' else: message = 'Invalid repository id <b>%s</b> received.' % str( repository_id ) @@ -479,7 +480,7 @@ tool shed repository. """ # Get the tool_shed_repository from one of the tool_dependencies. - message = kwd.get( 'message', '' ) + message = escape( kwd.get( 'message', '' ) ) status = kwd.get( 'status', 'done' ) err_msg = '' tool_shed_repository = tool_dependencies[ 0 ].tool_shed_repository @@ -512,7 +513,7 @@ @web.require_admin def install_latest_repository_revision( self, trans, **kwd ): """Install the latest installable revision of a repository that has been previously installed.""" - message = kwd.get( 'message', '' ) + message = escape( kwd.get( 'message', '' ) ) status = kwd.get( 'status', 'done' ) repository_id = kwd.get( 'id', None ) if repository_id is not None: @@ -589,7 +590,7 @@ updating_to_changeset_revision = kwd.get( 'updating_to_changeset_revision', None ) updating_to_ctx_rev = kwd.get( 'updating_to_ctx_rev', None ) encoded_updated_metadata = kwd.get( 'encoded_updated_metadata', None ) - message = kwd.get( 'message', '' ) + message = escape( kwd.get( 'message', '' ) ) status = kwd.get( 'status', 'done' ) install_tool_dependencies = CheckboxField.is_checked( kwd.get( 'install_tool_dependencies', '' ) ) if 'install_tool_dependencies_with_update_button' in kwd: @@ -609,7 +610,7 @@ relative_install_dir, set_status=False ) message = "The installed repository named '%s' has been updated to change set revision '%s'. " % \ - ( str( repository.name ), updating_to_changeset_revision ) + ( escape( str( repository.name ) ), updating_to_changeset_revision ) self.initiate_tool_dependency_installation( trans, tool_dependencies, message=message, status=status ) # Handle tool dependencies check box. if trans.app.config.tool_dependency_dir is None: @@ -665,7 +666,7 @@ @web.expose @web.require_admin def manage_repositories( self, trans, **kwd ): - message = kwd.get( 'message', '' ) + message = escape( kwd.get( 'message', '' ) ) status = kwd.get( 'status', 'done' ) tsridslist = common_util.get_tool_shed_repository_ids( **kwd ) if 'operation' in kwd: @@ -744,7 +745,7 @@ @web.expose @web.require_admin def manage_repository( self, trans, **kwd ): - message = kwd.get( 'message', '' ) + message = escape( kwd.get( 'message', '' ) ) status = kwd.get( 'status', 'done' ) repository_id = kwd.get( 'id', None ) if repository_id is None: @@ -808,7 +809,7 @@ @web.expose @web.require_admin def manage_repository_tool_dependencies( self, trans, **kwd ): - message = kwd.get( 'message', '' ) + message = escape( kwd.get( 'message', '' ) ) status = kwd.get( 'status', 'done' ) tool_dependency_ids = tool_dependency_util.get_tool_dependency_ids( as_string=False, **kwd ) if tool_dependency_ids: @@ -890,7 +891,7 @@ def manage_tool_dependencies( self, trans, **kwd ): # This method is called when tool dependencies are being installed. See the related manage_repository_tool_dependencies # method for managing the tool dependencies for a specified installed tool shed repository. - message = kwd.get( 'message', '' ) + message = escape( kwd.get( 'message', '' ) ) status = kwd.get( 'status', 'done' ) tool_dependency_ids = tool_dependency_util.get_tool_dependency_ids( as_string=False, **kwd ) repository_id = kwd.get( 'repository_id', None ) @@ -902,7 +903,7 @@ # The user must be on the manage_repository_tool_dependencies page and clicked the button to either install or uninstall a # tool dependency, but they didn't check any of the available tool dependencies on which to perform the action. tool_shed_repository = suc.get_tool_shed_repository_by_id( trans.app, repository_id ) - self.tool_dependency_grid.title = "Tool shed repository '%s' tool dependencies" % tool_shed_repository.name + self.tool_dependency_grid.title = "Tool shed repository '%s' tool dependencies" % escape( tool_shed_repository.name ) if 'operation' in kwd: operation = kwd[ 'operation' ].lower() if not tool_dependency_ids: @@ -978,7 +979,7 @@ message += 'of Galaxy Tool Shed repository tools into a local Galaxy instance</a> section of the Galaxy Tool ' message += 'Shed wiki for all of the details.' return trans.show_error_message( message ) - message = kwd.get( 'message', '' ) + message = escape( kwd.get( 'message', '' ) ) status = kwd.get( 'status', 'done' ) shed_tool_conf = kwd.get( 'shed_tool_conf', None ) tool_shed_url = kwd.get( 'tool_shed_url', '' ) @@ -1030,7 +1031,7 @@ # The Tool Shed cannot handle the get_repository_id request, so the code must be older than the # 04/2014 Galaxy release when it was introduced. It will be safest to error out and let the # Tool Shed admin update the Tool Shed to a later release. - message = 'The updates available for the repository <b>%s</b> ' % str( repository.name ) + message = 'The updates available for the repository <b>%s</b> ' % escape( str( repository.name ) ) message += 'include newly defined repository or tool dependency definitions, and attempting ' message += 'to update the repository resulted in the following error. Contact the Tool Shed ' message += 'administrator if necessary.<br/>%s' % str( e ) @@ -1314,7 +1315,7 @@ and tool dependencies of the repository. """ rdim = repository_dependency_manager.RepositoryDependencyInstallManager( trans.app ) - message = kwd.get( 'message', '' ) + message = escape( kwd.get( 'message', '' ) ) status = kwd.get( 'status', 'done' ) repository_id = kwd[ 'id' ] tool_shed_repository = repository_util.get_installed_tool_shed_repository( trans.app, repository_id ) @@ -1450,7 +1451,7 @@ Inspect the repository dependency hierarchy for a specified repository and attempt to make sure they are all properly installed as well as each repository's tool dependencies. """ - message = kwd.get( 'message', '' ) + message = escape( kwd.get( 'message', '' ) ) status = kwd.get( 'status', 'done' ) repository_id = kwd.get( 'id', None ) if not repository_id: @@ -1648,12 +1649,12 @@ no_changes_check_box = CheckboxField( 'no_changes', checked=True ) if original_section_name: message += "The tools contained in your <b>%s</b> repository were last loaded into the tool panel section <b>%s</b>. " \ - % ( tool_shed_repository.name, original_section_name ) + % ( escape( tool_shed_repository.name ), original_section_name ) message += "Uncheck the <b>No changes</b> check box and select a different tool panel section to load the tools in a " message += "different section in the tool panel. " status = 'warning' else: - message += "The tools contained in your <b>%s</b> repository were last loaded into the tool panel outside of any sections. " % tool_shed_repository.name + message += "The tools contained in your <b>%s</b> repository were last loaded into the tool panel outside of any sections. " % escape( tool_shed_repository.name ) message += "Uncheck the <b>No changes</b> check box and select a tool panel section to load the tools into that section. " status = 'warning' else: @@ -1715,7 +1716,7 @@ if 'reset_metadata_on_selected_repositories_button' in kwd: message, status = irmm.reset_metadata_on_selected_repositories( trans.user, **kwd ) else: - message = kwd.get( 'message', '' ) + message = escape( kwd.get( 'message', '' ) ) status = kwd.get( 'status', 'done' ) repositories_select_field = irmm.build_repository_ids_select_field() return trans.fill_template( '/admin/tool_shed_repository/reset_metadata_on_selected_repositories.mako', @@ -1749,13 +1750,13 @@ irmm.update_in_shed_tool_config() trans.install_model.context.add( repository ) trans.install_model.context.flush() - message = 'Metadata has been reset on repository <b>%s</b>.' % repository.name + message = 'Metadata has been reset on repository <b>%s</b>.' % escape( repository.name ) status = 'done' else: - message = 'Metadata did not need to be reset on repository <b>%s</b>.' % repository.name + message = 'Metadata did not need to be reset on repository <b>%s</b>.' % escape( repository.name ) status = 'done' else: - message = 'Error locating installation directory for repository <b>%s</b>.' % repository.name + message = 'Error locating installation directory for repository <b>%s</b>.' % escape( repository.name ) status = 'error' return trans.response.send_redirect( web.url_for( controller='admin_toolshed', action='manage_repository', @@ -1777,7 +1778,7 @@ uninstalled=False, remove_from_disk=True ) new_kwd = {} - new_kwd[ 'message' ] = "You can now attempt to install the repository named <b>%s</b> again." % str( repository.name ) + new_kwd[ 'message' ] = "You can now attempt to install the repository named <b>%s</b> again." % escape( str( repository.name ) ) new_kwd[ 'status' ] = "done" return trans.response.send_redirect( web.url_for( controller='admin_toolshed', action='browse_repositories', @@ -1808,7 +1809,7 @@ message = "Tool versions have been set for all included tools." status = 'done' else: - message = "Version information for the tools included in the <b>%s</b> repository is missing. " % repository.name + message = "Version information for the tools included in the <b>%s</b> repository is missing. " % escape( repository.name ) message += "Reset all of this reppository's metadata in the tool shed, then set the installed tool versions " message ++ "from the installed repository's <b>Repository Actions</b> menu. " status = 'error' @@ -1852,7 +1853,7 @@ @web.expose @web.require_admin def uninstall_tool_dependencies( self, trans, **kwd ): - message = kwd.get( 'message', '' ) + message = escape( kwd.get( 'message', '' ) ) status = kwd.get( 'status', 'done' ) tool_dependency_ids = tool_dependency_util.get_tool_dependency_ids( as_string=False, **kwd ) if not tool_dependency_ids: @@ -1897,7 +1898,7 @@ @web.require_admin def update_to_changeset_revision( self, trans, **kwd ): """Update a cloned repository to the latest revision possible.""" - message = kwd.get( 'message', '' ) + message = escape( kwd.get( 'message', '' ) ) status = kwd.get( 'status', 'done' ) tool_shed_url = kwd.get( 'tool_shed_url', '' ) # Handle protocol changes over time. @@ -2070,7 +2071,7 @@ @web.expose @web.require_admin def update_tool_shed_status_for_installed_repository( self, trans, all_installed_repositories=False, **kwd ): - message = kwd.get( 'message', '' ) + message = escape( kwd.get( 'message', '' ) ) status = kwd.get( 'status', 'done' ) if all_installed_repositories: success_count = 0 @@ -2083,7 +2084,7 @@ if ok: success_count += 1 else: - repository_names_not_updated.append( '<b>%s</b>' % str( repository.name ) ) + repository_names_not_updated.append( '<b>%s</b>' % escape( str( repository.name ) ) ) if updated: updated_count += 1 message = "Checked the status in the tool shed for %d repositories. " % success_count @@ -2098,11 +2099,11 @@ repository_util.check_or_update_tool_shed_status_for_installed_repository( trans.app, repository ) if ok: if updated: - message = "The tool shed status for repository <b>%s</b> has been updated." % str( repository.name ) + message = "The tool shed status for repository <b>%s</b> has been updated." % escape( str( repository.name ) ) else: - message = "The status has not changed in the tool shed for repository <b>%s</b>." % str( repository.name ) + message = "The status has not changed in the tool shed for repository <b>%s</b>." % escape( str( repository.name ) ) else: - message = "Unable to retrieve status from the tool shed for repository <b>%s</b>." % str( repository.name ) + message = "Unable to retrieve status from the tool shed for repository <b>%s</b>." % escape( str( repository.name ) ) status = 'error' return trans.response.send_redirect( web.url_for( controller='admin_toolshed', action='browse_repositories', @@ -2112,7 +2113,7 @@ @web.expose @web.require_admin def view_tool_metadata( self, trans, repository_id, tool_id, **kwd ): - message = kwd.get( 'message', '' ) + message = escape( kwd.get( 'message', '' ) ) status = kwd.get( 'status', 'done' ) repository = repository_util.get_installed_tool_shed_repository( trans.app, repository_id ) repository_metadata = repository.metadata @@ -2146,7 +2147,7 @@ @web.require_admin def view_workflow( self, trans, workflow_name=None, repository_id=None, **kwd ): """Retrieve necessary information about a workflow from the database so that it can be displayed in an svg image.""" - message = kwd.get( 'message', '' ) + message = escape( kwd.get( 'message', '' ) ) status = kwd.get( 'status', 'done' ) if workflow_name: workflow_name = encoding_util.tool_shed_decode( workflow_name ) diff -r 0ac7297b58491d542948ae3976732dd2c3450b89 -r e416697be38e66f18be89a4cfca70457c9784294 lib/galaxy/webapps/galaxy/controllers/library_admin.py --- a/lib/galaxy/webapps/galaxy/controllers/library_admin.py +++ b/lib/galaxy/webapps/galaxy/controllers/library_admin.py @@ -5,8 +5,9 @@ from galaxy import web from galaxy.web.base.controller import BaseUIController -from galaxy.web.framework.helpers import escape, grids, time_ago +from galaxy.web.framework.helpers import grids, time_ago from library_common import get_comptypes, lucene_search, whoosh_search +from markupsafe import escape # from galaxy.model.orm import * log = logging.getLogger( __name__ ) @@ -148,7 +149,7 @@ @web.expose @web.require_admin def create_library( self, trans, **kwd ): - message = kwd.get( 'message', '' ) + message = escape( kwd.get( 'message', '' ) ) status = kwd.get( 'status', 'done' ) if kwd.get( 'create_library_button', False ): name = kwd.get( 'name', 'No name' ) @@ -161,12 +162,12 @@ library.root_folder = root_folder trans.sa_session.add_all( ( library, root_folder ) ) trans.sa_session.flush() - message = "The new library named '%s' has been created" % library.name + message = "The new library named '%s' has been created" return trans.response.send_redirect( web.url_for( controller='library_common', action='browse_library', cntrller='library_admin', id=trans.security.encode_id( library.id ), - message=message, + message=escape( message ), status='done' ) ) return trans.fill_template( '/admin/library/new_library.mako', message=escape( message ), status=escape( status ) ) @web.expose diff -r 0ac7297b58491d542948ae3976732dd2c3450b89 -r e416697be38e66f18be89a4cfca70457c9784294 lib/galaxy/webapps/galaxy/controllers/library_common.py --- a/lib/galaxy/webapps/galaxy/controllers/library_common.py +++ b/lib/galaxy/webapps/galaxy/controllers/library_common.py @@ -20,7 +20,7 @@ from galaxy.util.streamball import StreamBall from galaxy.web.base.controller import BaseUIController, UsesFormDefinitionsMixin, UsesExtendedMetadataMixin, UsesLibraryMixinItems from galaxy.web.form_builder import AddressField, CheckboxField, SelectField, build_select_field -from galaxy.web.framework.helpers import escape +from markupsafe import escape from galaxy.model.orm import and_, eagerload_all # Whoosh is compatible with Python 2.5+ Try to import Whoosh and set flag to indicate whether tool search is enabled. @@ -93,7 +93,7 @@ @web.expose def browse_library( self, trans, cntrller='library', **kwd ): - message = kwd.get( 'message', '' ) + message = escape( kwd.get( 'message', '' ) ) status = kwd.get( 'status', 'done' ) # If use_panels is True, the library is being accessed via an external link # which did not originate from within the Galaxy instance, and the library will @@ -121,7 +121,7 @@ hidden_folder_ids = util.listify( kwd.get( 'hidden_folder_ids', '' ) ) if created_ldda_ids and not message: message = "%d datasets are uploading in the background to the library '%s' (each is selected). " % \ - ( len( created_ldda_ids.split( ',' ) ), library.name ) + ( len( created_ldda_ids.split( ',' ) ), escape( library.name ) ) message += "Don't navigate away from Galaxy or use the browser's \"stop\" or \"reload\" buttons (on this tab) until the " message += "message \"This job is running\" is cleared from the \"Information\" column below for each selected dataset." status = "info" @@ -152,7 +152,7 @@ message=escape( message ), status=escape( status ) ) except Exception, e: - message = 'Error attempting to display contents of library (%s): %s.' % ( str( library.name ), str( e ) ) + message = 'Error attempting to display contents of library (%s): %s.' % ( escape( str( library.name ) ), str( e ) ) status = 'error' default_action = kwd.get( 'default_action', None ) @@ -164,7 +164,7 @@ status=status ) ) @web.expose def library_info( self, trans, cntrller, **kwd ): - message = kwd.get( 'message', '' ) + message = escape( kwd.get( 'message', '' ) ) status = kwd.get( 'status', 'done' ) use_panels = util.string_as_bool( kwd.get( 'use_panels', False ) ) show_deleted = util.string_as_bool( kwd.get( 'show_deleted', False ) ) @@ -223,7 +223,7 @@ status=escape( status ) ) @web.expose def library_permissions( self, trans, cntrller, **kwd ): - message = kwd.get( 'message', '' ) + message = escape( kwd.get( 'message', '' ) ) status = kwd.get( 'status', 'done' ) use_panels = util.string_as_bool( kwd.get( 'use_panels', False ) ) show_deleted = util.string_as_bool( kwd.get( 'show_deleted', False ) ) @@ -269,7 +269,7 @@ status=escape( status ) ) @web.expose def create_folder( self, trans, cntrller, parent_id, library_id, **kwd ): - message = kwd.get( 'message', '' ) + message = escape( kwd.get( 'message', '' ) ) status = kwd.get( 'status', 'done' ) show_deleted = util.string_as_bool( kwd.get( 'show_deleted', False ) ) use_panels = util.string_as_bool( kwd.get( 'use_panels', False ) ) @@ -345,7 +345,7 @@ status=escape( status ) ) @web.expose def folder_info( self, trans, cntrller, id, library_id, **kwd ): - message = kwd.get( 'message', '' ) + message = escape( kwd.get( 'message', '' ) ) status = kwd.get( 'status', 'done' ) show_deleted = util.string_as_bool( kwd.get( 'show_deleted', False ) ) use_panels = util.string_as_bool( kwd.get( 'use_panels', False ) ) @@ -401,7 +401,7 @@ status=escape( status ) ) @web.expose def folder_permissions( self, trans, cntrller, id, library_id, **kwd ): - message = kwd.get( 'message', '' ) + message = escape( kwd.get( 'message', '' ) ) status = kwd.get( 'status', 'done' ) show_deleted = util.string_as_bool( kwd.get( 'show_deleted', False ) ) use_panels = util.string_as_bool( kwd.get( 'use_panels', False ) ) @@ -450,7 +450,7 @@ status=escape( status ) ) @web.expose def ldda_edit_info( self, trans, cntrller, library_id, folder_id, id, **kwd ): - message = kwd.get( 'message', '' ) + message = escape( kwd.get( 'message', '' ) ) status = kwd.get( 'status', 'done' ) show_deleted = util.string_as_bool( kwd.get( 'show_deleted', False ) ) use_panels = util.string_as_bool( kwd.get( 'use_panels', False ) ) @@ -505,7 +505,7 @@ old_name = ldda.name new_name = kwd.get( 'name', '' ) new_info = kwd.get( 'info', '' ) - new_message = kwd.get( 'message', '' ) + new_message = escape( kwd.get( 'message', '' ) ) if not new_name: message = 'Enter a valid name' status = 'error' @@ -602,7 +602,7 @@ status=escape( status ) ) @web.expose def ldda_info( self, trans, cntrller, library_id, folder_id, id, **kwd ): - message = kwd.get( 'message', '' ) + message = escape( kwd.get( 'message', '' ) ) status = kwd.get( 'status', 'done' ) show_deleted = util.string_as_bool( kwd.get( 'show_deleted', False ) ) show_associated_hdas_and_lddas = util.string_as_bool( kwd.get( 'show_associated_hdas_and_lddas', False ) ) @@ -650,7 +650,7 @@ status=escape( status ) ) @web.expose def ldda_permissions( self, trans, cntrller, library_id, folder_id, id, **kwd ): - message = kwd.get( 'message', '' ) + message = escape( kwd.get( 'message', '' ) ) status = kwd.get( 'status', 'done' ) show_deleted = util.string_as_bool( kwd.get( 'show_deleted', False ) ) use_panels = util.string_as_bool( kwd.get( 'use_panels', False ) ) @@ -787,9 +787,9 @@ status=escape( status ) ) @web.expose def upload_library_dataset( self, trans, cntrller, library_id, folder_id, **kwd ): - message = kwd.get( 'message', '' ) + message = escape( kwd.get( 'message', '' ) ) status = kwd.get( 'status', 'done' ) - ldda_message = kwd.get( 'ldda_message', '' ) + ldda_message = escape( kwd.get( 'ldda_message', '' ) ) deleted = util.string_as_bool( kwd.get( 'deleted', False ) ) show_deleted = util.string_as_bool( kwd.get( 'show_deleted', False ) ) use_panels = util.string_as_bool( kwd.get( 'use_panels', False ) ) @@ -1046,7 +1046,7 @@ dataset_upload_inputs.append( input ) # Library-specific params show_deleted = util.string_as_bool( kwd.get( 'show_deleted', False ) ) - message = kwd.get( 'message', '' ) + message = escape( kwd.get( 'message', '' ) ) status = kwd.get( 'status', 'done' ) server_dir = kwd.get( 'server_dir', '' ) if replace_dataset not in [ None, 'None' ]: @@ -1256,9 +1256,9 @@ @web.expose def add_history_datasets_to_library( self, trans, cntrller, library_id, folder_id, hda_ids='', **kwd ): - message = kwd.get( 'message', '' ) + message = escape( kwd.get( 'message', '' ) ) status = kwd.get( 'status', 'done' ) - ldda_message = kwd.get( 'ldda_message', '' ) + ldda_message = escape( kwd.get( 'ldda_message', '' ) ) show_deleted = kwd.get( 'show_deleted', False ) use_panels = util.string_as_bool( kwd.get( 'use_panels', False ) ) replace_id = kwd.get( 'replace_id', None ) @@ -1547,7 +1547,7 @@ status='error' ) ) @web.expose def library_dataset_info( self, trans, cntrller, id, library_id, **kwd ): - message = kwd.get( 'message', '' ) + message = escape( kwd.get( 'message', '' ) ) status = kwd.get( 'status', 'done' ) show_deleted = util.string_as_bool( kwd.get( 'show_deleted', False ) ) use_panels = util.string_as_bool( kwd.get( 'use_panels', False ) ) @@ -1595,7 +1595,7 @@ status=escape( status ) ) @web.expose def library_dataset_permissions( self, trans, cntrller, id, library_id, **kwd ): - message = kwd.get( 'message', '' ) + message = escape( kwd.get( 'message', '' ) ) status = kwd.get( 'status', 'done' ) show_deleted = util.string_as_bool( kwd.get( 'show_deleted', False ) ) use_panels = util.string_as_bool( kwd.get( 'use_panels', False ) ) @@ -1642,7 +1642,7 @@ status=escape( status ) ) @web.expose def make_library_item_public( self, trans, cntrller, library_id, item_type, id, **kwd ): - message = kwd.get( 'message', '' ) + message = escape( kwd.get( 'message', '' ) ) status = kwd.get( 'status', 'done' ) show_deleted = util.string_as_bool( kwd.get( 'show_deleted', False ) ) use_panels = util.string_as_bool( kwd.get( 'use_panels', False ) ) @@ -1703,7 +1703,7 @@ rval += '%s %i %s%s %s\r\n' % ( crc, size, self.url_base, quoted_fname, relpath ) return rval # Perform an action on a list of library datasets. - message = kwd.get( 'message', '' ) + message = escape( kwd.get( 'message', '' ) ) status = kwd.get( 'status', 'done' ) show_deleted = util.string_as_bool( kwd.get( 'show_deleted', False ) ) use_panels = util.string_as_bool( kwd.get( 'use_panels', False ) ) @@ -1979,7 +1979,7 @@ # - a select list option for acting on multiple selected datasets within a library # ( ldda_ids is a comma separated string of ldda ids ) # - a menu option for a library dataset search result set ( ldda_ids is a comma separated string of ldda ids ) - message = kwd.get( 'message', '' ) + message = escape( kwd.get( 'message', '' ) ) status = kwd.get( 'status', 'done' ) show_deleted = util.string_as_bool( kwd.get( 'show_deleted', False ) ) use_panels = util.string_as_bool( kwd.get( 'use_panels', False ) ) @@ -2102,7 +2102,7 @@ def manage_template_inheritance( self, trans, cntrller, item_type, library_id, folder_id=None, ldda_id=None, **kwd ): show_deleted = util.string_as_bool( kwd.get( 'show_deleted', False ) ) use_panels = util.string_as_bool( kwd.get( 'use_panels', False ) ) - message = kwd.get( 'message', '' ) + message = escape( kwd.get( 'message', '' ) ) status = kwd.get( 'status', 'done' ) is_admin = ( trans.user_is_admin() and cntrller == 'library_admin' ) current_user_roles = trans.get_current_user_roles() @@ -2152,7 +2152,7 @@ # 'ldda' and item_id is a comma separated string of ldda ids ) # - a menu option for a library dataset search result set ( item_type is 'ldda' and item_id is a # comma separated string of ldda ids ) - message = kwd.get( 'message', '' ) + message = escape( kwd.get( 'message', '' ) ) status = kwd.get( 'status', 'done' ) show_deleted = util.string_as_bool( kwd.get( 'show_deleted', False ) ) use_panels = util.string_as_bool( kwd.get( 'use_panels', False ) ) @@ -2723,7 +2723,7 @@ return map( operator.getitem, intermed, ( -1, ) * len( intermed ) ) def lucene_search( trans, cntrller, search_term, search_url, **kwd ): """Return display of results from a full-text lucene search of data libraries.""" - message = kwd.get( 'message', '' ) + message = escape( kwd.get( 'message', '' ) ) status = kwd.get( 'status', 'done' ) full_url = "%s/find?%s" % ( search_url, urllib.urlencode( { "kwd" : search_term } ) ) response = urllib2.urlopen( full_url ) @@ -2733,7 +2733,7 @@ return status, message, get_sorted_accessible_library_items( trans, cntrller, lddas, 'name' ) def whoosh_search( trans, cntrller, search_term, **kwd ): """Return display of results from a full-text whoosh search of data libraries.""" - message = kwd.get( 'message', '' ) + message = escape( kwd.get( 'message', '' ) ) status = kwd.get( 'status', 'done' ) ok = True if whoosh_search_enabled: diff -r 0ac7297b58491d542948ae3976732dd2c3450b89 -r e416697be38e66f18be89a4cfca70457c9784294 lib/galaxy/webapps/galaxy/controllers/user.py --- a/lib/galaxy/webapps/galaxy/controllers/user.py +++ b/lib/galaxy/webapps/galaxy/controllers/user.py @@ -28,9 +28,10 @@ from galaxy.web.base.controller import CreatesApiKeysMixin from galaxy.web.form_builder import CheckboxField from galaxy.web.form_builder import build_select_field -from galaxy.web.framework.helpers import time_ago, grids, escape +from galaxy.web.framework.helpers import time_ago, grids from datetime import datetime, timedelta from galaxy.util import hash_util, biostar +from markupsafe import escape log = logging.getLogger( __name__ ) @@ -254,7 +255,7 @@ if not trans.app.config.enable_openid: return trans.show_error_message( 'OpenID authentication is not enabled in this instance of Galaxy' ) use_panels = util.string_as_bool( kwd.get( 'use_panels', False ) ) - message = kwd.get( 'message', '' ) + message = escape( kwd.get( 'message', '' ) ) status = kwd.get( 'status', 'done' ) email = kwd.get( 'email', '' ) username = kwd.get( 'username', '' ) @@ -502,7 +503,7 @@ """ Function validates numerous cases that might happen during the login time. """ - message = kwd.get( 'message', '' ) + message = escape( kwd.get( 'message', '' ) ) status = kwd.get( 'status', 'error' ) email = kwd.get( 'email', '' ) password = kwd.get( 'password', '' ) @@ -719,7 +720,7 @@ email = util.restore_text( kwd.get( 'email', '' ) ) password = kwd.get( 'password', '' ) username = util.restore_text( kwd.get( 'username', '' ) ) - message = kwd.get( 'message', '' ) + message = escape( kwd.get( 'message', '' ) ) status = kwd.get( 'status', 'done' ) is_admin = cntrller == 'admin' and trans.user_is_admin() user = self.create_user( trans=trans, email=email, username=username, password=password ) @@ -1093,7 +1094,7 @@ def reset_password( self, trans, email=None, **kwd ): if trans.app.config.smtp_server is None: return trans.show_error_message( "Mail is not configured for this Galaxy instance. Please contact your local Galaxy administrator." ) - message = util.sanitize_text(util.restore_text( kwd.get( 'message', '' ) )) + message = util.sanitize_text( util.restore_text( kwd.get( 'message', '' ) ) ) status = kwd.get( 'status', 'done' ) if kwd.get( 'reset_password_button', False ): reset_user = trans.sa_session.query( trans.app.model.User ).filter( trans.app.model.User.table.c.email == email ).first() diff -r 0ac7297b58491d542948ae3976732dd2c3450b89 -r e416697be38e66f18be89a4cfca70457c9784294 lib/galaxy/webapps/galaxy/controllers/workflow.py --- a/lib/galaxy/webapps/galaxy/controllers/workflow.py +++ b/lib/galaxy/webapps/galaxy/controllers/workflow.py @@ -22,7 +22,7 @@ from galaxy.web import error, url_for from galaxy.web.base.controller import BaseUIController, SharableMixin, UsesStoredWorkflowMixin from galaxy.web.framework.formbuilder import form -from galaxy.web.framework.helpers import grids, time_ago, to_unicode, escape +from galaxy.web.framework.helpers import grids, time_ago, to_unicode from galaxy.workflow.modules import WorkflowModuleInjector from galaxy.workflow.modules import MissingToolException from galaxy.workflow.modules import module_factory, is_tool_module_type @@ -37,6 +37,7 @@ order_workflow_steps_with_levels, ) from galaxy.workflow.render import WorkflowCanvas, MARGIN, LINE_SPACING +from markupsafe import escape class StoredWorkflowListGrid( grids.Grid ): @@ -1021,7 +1022,7 @@ """ url = kwd.get( 'url', '' ) workflow_text = kwd.get( 'workflow_text', '' ) - message = kwd.get( 'message', '' ) + message = escape( kwd.get( 'message', '' ) ) status = kwd.get( 'status', 'done' ) import_button = kwd.get( 'import_button', False ) # The special Galaxy integration landing page's URL on myExperiment diff -r 0ac7297b58491d542948ae3976732dd2c3450b89 -r e416697be38e66f18be89a4cfca70457c9784294 lib/galaxy/webapps/reports/controllers/users.py --- a/lib/galaxy/webapps/reports/controllers/users.py +++ b/lib/galaxy/webapps/reports/controllers/users.py @@ -9,17 +9,19 @@ pkg_resources.require( "SQLAlchemy >= 0.4" ) import sqlalchemy as sa import logging +from markupsafe import escape + log = logging.getLogger( __name__ ) class Users( BaseUIController ): @web.expose def registered_users( self, trans, **kwd ): - message = util.restore_text( kwd.get( 'message', '' ) ) + message = escape( util.restore_text( kwd.get( 'message', '' ) ) ) num_users = trans.sa_session.query( galaxy.model.User ).count() return trans.fill_template( '/webapps/reports/registered_users.mako', num_users=num_users, message=message ) @web.expose def registered_users_per_month( self, trans, **kwd ): - message = util.restore_text( kwd.get( 'message', '' ) ) + message = escape( util.restore_text( kwd.get( 'message', '' ) ) ) q = sa.select( ( sa.func.date_trunc( 'month', sa.func.date( galaxy.model.User.table.c.create_time ) ).label( 'date' ), sa.func.count( galaxy.model.User.table.c.id ).label( 'num_users' ) ), from_obj = [ galaxy.model.User.table ], @@ -36,7 +38,7 @@ message=message ) @web.expose def specified_month( self, trans, **kwd ): - message = util.restore_text( kwd.get( 'message', '' ) ) + message = escape( util.restore_text( kwd.get( 'message', '' ) ) ) # If specified_date is not received, we'll default to the current month specified_date = kwd.get( 'specified_date', datetime.utcnow().strftime( "%Y-%m-%d" ) ) specified_month = specified_date[ :7 ] @@ -66,7 +68,7 @@ message=message ) @web.expose def specified_date( self, trans, **kwd ): - message = util.restore_text( kwd.get( 'message', '' ) ) + message = escape( util.restore_text( kwd.get( 'message', '' ) ) ) # If specified_date is not received, we'll default to the current month specified_date = kwd.get( 'specified_date', datetime.utcnow().strftime( "%Y-%m-%d" ) ) year, month, day = map( int, specified_date.split( "-" ) ) @@ -95,7 +97,7 @@ message=message ) @web.expose def last_access_date( self, trans, **kwd ): - message = util.restore_text( kwd.get( 'message', '' ) ) + message = escape( util.restore_text( kwd.get( 'message', '' ) ) ) not_logged_in_for_days = kwd.get( 'not_logged_in_for_days', 90 ) if not not_logged_in_for_days: not_logged_in_for_days = 0 @@ -120,7 +122,7 @@ @web.expose def user_disk_usage( self, trans, **kwd ): - message = util.restore_text( kwd.get( 'message', '' ) ) + message = escape( util.restore_text( kwd.get( 'message', '' ) ) ) user_cutoff = int( kwd.get( 'user_cutoff', 60 ) ) # disk_usage isn't indexed users = sorted( trans.sa_session.query( galaxy.model.User ).all(), key=operator.attrgetter( 'disk_usage' ), reverse=True ) diff -r 0ac7297b58491d542948ae3976732dd2c3450b89 -r e416697be38e66f18be89a4cfca70457c9784294 lib/galaxy/webapps/tool_shed/controllers/admin.py --- a/lib/galaxy/webapps/tool_shed/controllers/admin.py +++ b/lib/galaxy/webapps/tool_shed/controllers/admin.py @@ -3,6 +3,7 @@ from galaxy import util from galaxy.util import inflector from galaxy import web +from markupsafe import escape from galaxy.web.base.controller import BaseUIController from galaxy.web.base.controllers.admin import Admin @@ -121,7 +122,7 @@ @web.expose @web.require_admin def create_category( self, trans, **kwd ): - message = kwd.get( 'message', '' ) + message = escape( kwd.get( 'message', '' ) ) status = kwd.get( 'status', 'done' ) name = kwd.get( 'name', '' ).strip() description = kwd.get( 'description', '' ).strip() @@ -154,7 +155,7 @@ @web.expose @web.require_admin def delete_repository( self, trans, **kwd ): - message = kwd.get( 'message', '' ) + message = escape( kwd.get( 'message', '' ) ) status = kwd.get( 'status', 'done' ) id = kwd.get( 'id', None ) if id: @@ -197,7 +198,7 @@ @web.expose @web.require_admin def delete_repository_metadata( self, trans, **kwd ): - message = kwd.get( 'message', '' ) + message = escape( kwd.get( 'message', '' ) ) status = kwd.get( 'status', 'done' ) id = kwd.get( 'id', None ) if id: @@ -221,7 +222,7 @@ @web.expose @web.require_admin def edit_category( self, trans, **kwd ): - message = kwd.get( 'message', '' ) + message = escape( kwd.get( 'message', '' ) ) status = kwd.get( 'status', 'done' ) id = kwd.get( 'id', None ) if not id: @@ -306,7 +307,7 @@ @web.expose @web.require_admin def regenerate_statistics( self, trans, **kwd ): - message = kwd.get( 'message', '' ) + message = escape( kwd.get( 'message', '' ) ) status = kwd.get( 'status', 'done' ) if 'regenerate_statistics_button' in kwd: trans.app.shed_counter.generate_statistics() @@ -352,7 +353,7 @@ if 'reset_metadata_on_selected_repositories_button' in kwd: message, status = rmm.reset_metadata_on_selected_repositories( **kwd ) else: - message = util.restore_text( kwd.get( 'message', '' ) ) + message = escape( util.restore_text( kwd.get( 'message', '' ) ) ) status = kwd.get( 'status', 'done' ) repositories_select_field = rmm.build_repository_ids_select_field( name='repository_ids', multiple=True, @@ -366,7 +367,7 @@ @web.expose @web.require_admin def undelete_repository( self, trans, **kwd ): - message = kwd.get( 'message', '' ) + message = escape( kwd.get( 'message', '' ) ) status = kwd.get( 'status', 'done' ) id = kwd.get( 'id', None ) if id: @@ -417,7 +418,7 @@ # TODO: We should probably eliminate the Category.deleted column since it really makes no # sense to mark a category as deleted (category names and descriptions can be changed instead). # If we do this, and the following 2 methods can be eliminated. - message = kwd.get( 'message', '' ) + message = escape( kwd.get( 'message', '' ) ) status = kwd.get( 'status', 'done' ) id = kwd.get( 'id', None ) if id: @@ -445,7 +446,7 @@ # This method should only be called for a Category that has previously been deleted. # Purging a deleted Category deletes all of the following from the database: # - RepoitoryCategoryAssociations where category_id == Category.id - message = kwd.get( 'message', '' ) + message = escape( kwd.get( 'message', '' ) ) status = kwd.get( 'status', 'done' ) id = kwd.get( 'id', None ) if id: @@ -473,7 +474,7 @@ @web.expose @web.require_admin def undelete_category( self, trans, **kwd ): - message = kwd.get( 'message', '' ) + message = escape( kwd.get( 'message', '' ) ) status = kwd.get( 'status', 'done' ) id = kwd.get( 'id', None ) if id: diff -r 0ac7297b58491d542948ae3976732dd2c3450b89 -r e416697be38e66f18be89a4cfca70457c9784294 lib/galaxy/webapps/tool_shed/controllers/repository.py --- a/lib/galaxy/webapps/tool_shed/controllers/repository.py +++ b/lib/galaxy/webapps/tool_shed/controllers/repository.py @@ -6,6 +6,7 @@ from time import strftime from datetime import date from datetime import datetime +from markupsafe import escape from galaxy import util from galaxy import web @@ -385,7 +386,7 @@ action='reviewed_repositories_i_own' ) ) elif operation == "repositories_by_category": category_id = kwd.get( 'id', None ) - message = kwd.get( 'message', '' ) + message = escape( kwd.get( 'message', '' ) ) status = kwd.get( 'status', 'done' ) return trans.response.send_redirect( web.url_for( controller='repository', action='browse_repositories_in_category', @@ -721,9 +722,9 @@ @web.expose def browse_repository( self, trans, id, **kwd ): - message = kwd.get( 'message', '' ) + message = escape( kwd.get( 'message', '' ) ) status = kwd.get( 'status', 'done' ) - commit_message = kwd.get( 'commit_message', 'Deleted selected files' ) + commit_message = escape( kwd.get( 'commit_message', 'Deleted selected files' ) ) repository = suc.get_repository_in_tool_shed( trans.app, id ) repo = hg_util.get_repo_for_repository( trans.app, repository=repository, repo_path=None, create=False ) # Update repository files for browsing. @@ -891,7 +892,7 @@ @web.expose def check_for_updates( self, trans, **kwd ): """Handle a request from a local Galaxy instance.""" - message = kwd.get( 'message', '' ) + message = escape( kwd.get( 'message', '' ) ) status = kwd.get( 'status', 'done' ) # If the request originated with the UpdateRepositoryManager, it will not include a galaxy_url. galaxy_url = common_util.handle_galaxy_url( trans, **kwd ) @@ -976,7 +977,7 @@ @web.expose def contact_owner( self, trans, id, **kwd ): - message = kwd.get( 'message', '' ) + message = escape( kwd.get( 'message', '' ) ) status = kwd.get( 'status', 'done' ) repository = suc.get_repository_in_tool_shed( trans.app, id ) metadata = metadata_util.get_repository_metadata_by_repository_id_changeset_revision( trans.app, @@ -995,7 +996,7 @@ @web.expose def create_galaxy_docker_image( self, trans, **kwd ): - message = kwd.get( 'message', '' ) + message = escape( kwd.get( 'message', '' ) ) status = kwd.get( 'status', 'done' ) repository_ids = util.listify( kwd.get( 'id', '' ) ) if 'operation' in kwd: @@ -1051,7 +1052,7 @@ @web.expose def create_repository( self, trans, **kwd ): - message = kwd.get( 'message', '' ) + message = escape( kwd.get( 'message', '' ) ) status = kwd.get( 'status', 'done' ) categories = suc.get_categories( trans ) if not categories: @@ -1108,7 +1109,7 @@ # Marking a repository in the tool shed as deprecated has no effect on any downloadable changeset # revisions that may be associated with the repository. Revisions are not marked as not downlaodable # because those that have installed the repository must be allowed to get updates. - message = kwd.get( 'message', '' ) + message = escape( kwd.get( 'message', '' ) ) status = kwd.get( 'status', 'done' ) repository_id = kwd.get( 'id', None ) repository = suc.get_repository_in_tool_shed( trans.app, repository_id ) @@ -1164,7 +1165,7 @@ @web.expose def display_tool( self, trans, repository_id, tool_config, changeset_revision, **kwd ): - message = kwd.get( 'message', '' ) + message = escape( kwd.get( 'message', '' ) ) status = kwd.get( 'status', 'done' ) render_repository_actions_for = kwd.get( 'render_repository_actions_for', 'tool_shed' ) tv = tool_validator.ToolValidator( trans.app ) @@ -1229,7 +1230,7 @@ @web.expose def export( self, trans, repository_id, changeset_revision, **kwd ): - message = kwd.get( 'message', '' ) + message = escape( kwd.get( 'message', '' ) ) status = kwd.get( 'status', 'done' ) export_repository_dependencies = kwd.get( 'export_repository_dependencies', '' ) repository = suc.get_repository_in_tool_shed( trans.app, repository_id ) @@ -1309,7 +1310,7 @@ @web.expose def find_tools( self, trans, **kwd ): - message = kwd.get( 'message', '' ) + message = escape( kwd.get( 'message', '' ) ) status = kwd.get( 'status', 'done' ) galaxy_url = common_util.handle_galaxy_url( trans, **kwd ) if 'operation' in kwd: @@ -1400,7 +1401,7 @@ @web.expose def find_workflows( self, trans, **kwd ): - message = kwd.get( 'message', '' ) + message = escape( kwd.get( 'message', '' ) ) status = kwd.get( 'status', 'done' ) galaxy_url = common_util.handle_galaxy_url( trans, **kwd ) if 'operation' in kwd: @@ -2020,13 +2021,13 @@ @web.expose def help( self, trans, **kwd ): - message = kwd.get( 'message', '' ) + message = escape( kwd.get( 'message', '' ) ) status = kwd.get( 'status', 'done' ) return trans.fill_template( '/webapps/tool_shed/repository/help.mako', message=message, status=status, **kwd ) @web.expose def import_capsule( self, trans, **kwd ): - message = kwd.get( 'message', '' ) + message = escape( kwd.get( 'message', '' ) ) status = kwd.get( 'status', 'done' ) capsule_file_name = kwd.get( 'capsule_file_name', None ) encoded_file_path = kwd.get( 'encoded_file_path', None ) @@ -2069,7 +2070,7 @@ @web.expose def index( self, trans, **kwd ): - message = kwd.get( 'message', '' ) + message = escape( kwd.get( 'message', '' ) ) status = kwd.get( 'status', 'done' ) # See if there are any RepositoryMetadata records since menu items require them. repository_metadata = trans.sa_session.query( trans.model.RepositoryMetadata ).first() @@ -2151,7 +2152,7 @@ @web.expose def load_invalid_tool( self, trans, repository_id, tool_config, changeset_revision, **kwd ): - message = kwd.get( 'message', '' ) + message = escape( kwd.get( 'message', '' ) ) status = kwd.get( 'status', 'error' ) render_repository_actions_for = kwd.get( 'render_repository_actions_for', 'tool_shed' ) tv = tool_validator.ToolValidator( trans.app ) @@ -2203,7 +2204,7 @@ @web.expose @web.require_login( "manage email alerts" ) def manage_email_alerts( self, trans, **kwd ): - message = kwd.get( 'message', '' ) + message = escape( kwd.get( 'message', '' ) ) status = kwd.get( 'status', 'done' ) new_repo_alert = kwd.get( 'new_repo_alert', '' ) new_repo_alert_checked = CheckboxField.is_checked( new_repo_alert ) @@ -2234,7 +2235,7 @@ @web.expose @web.require_login( "manage repository" ) def manage_repository( self, trans, id, **kwd ): - message = kwd.get( 'message', '' ) + message = escape( kwd.get( 'message', '' ) ) status = kwd.get( 'status', 'done' ) repository = suc.get_repository_in_tool_shed( trans.app, id ) repository_type = kwd.get( 'repository_type', str( repository.type ) ) @@ -2500,7 +2501,7 @@ @web.expose @web.require_login( "manage repository administrators" ) def manage_repository_admins( self, trans, id, **kwd ): - message = kwd.get( 'message', '' ) + message = escape( kwd.get( 'message', '' ) ) status = kwd.get( 'status', 'done' ) repository = suc.get_repository_in_tool_shed( trans.app, id ) changeset_revision = kwd.get( 'changeset_revision', repository.tip( trans.app ) ) @@ -2558,7 +2559,7 @@ @web.expose @web.require_login( "multi select email alerts" ) def multi_select_email_alerts( self, trans, **kwd ): - message = kwd.get( 'message', '' ) + message = escape( kwd.get( 'message', '' ) ) status = kwd.get( 'status', 'done' ) if 'operation' in kwd: operation = kwd[ 'operation' ].lower() @@ -2607,7 +2608,7 @@ @web.expose def preview_tools_in_changeset( self, trans, repository_id, **kwd ): - message = kwd.get( 'message', '' ) + message = escape( kwd.get( 'message', '' ) ) status = kwd.get( 'status', 'done' ) repository = suc.get_repository_in_tool_shed( trans.app, repository_id ) repo = hg_util.get_repo_for_repository( trans.app, repository=repository, repo_path=None, create=False ) @@ -2714,7 +2715,7 @@ @web.require_login( "rate repositories" ) def rate_repository( self, trans, **kwd ): """ Rate a repository and return updated rating data. """ - message = kwd.get( 'message', '' ) + message = escape( kwd.get( 'message', '' ) ) status = kwd.get( 'status', 'done' ) id = kwd.get( 'id', None ) if not id: @@ -2787,7 +2788,7 @@ if 'reset_metadata_on_selected_repositories_button' in kwd: message, status = rmm.reset_metadata_on_selected_repositories( **kwd ) else: - message = kwd.get( 'message', '' ) + message = escape( kwd.get( 'message', '' ) ) status = kwd.get( 'status', 'done' ) repositories_select_field = rmm.build_repository_ids_select_field( name='repository_ids', multiple=True, @@ -2800,9 +2801,9 @@ @web.expose def select_files_to_delete( self, trans, id, **kwd ): - message = kwd.get( 'message', '' ) + message = escape( kwd.get( 'message', '' ) ) status = kwd.get( 'status', 'done' ) - commit_message = kwd.get( 'commit_message', 'Deleted selected files' ) + commit_message = escape( kwd.get( 'commit_message', 'Deleted selected files' ) ) repository = suc.get_repository_in_tool_shed( trans.app, id ) repo_dir = repository.repo_path( trans.app ) repo = hg_util.get_repo_for_repository( trans.app, repository=None, repo_path=repo_dir, create=False ) @@ -3145,7 +3146,7 @@ @web.expose def upload_capsule( self, trans, **kwd ): - message = kwd.get( 'message', '' ) + message = escape( kwd.get( 'message', '' ) ) status = kwd.get( 'status', 'done' ) url = kwd.get( 'url', '' ) if 'upload_capsule_button' in kwd: @@ -3175,7 +3176,7 @@ @web.expose def view_changelog( self, trans, id, **kwd ): - message = kwd.get( 'message', '' ) + message = escape( kwd.get( 'message', '' ) ) status = kwd.get( 'status', 'done' ) repository = suc.get_repository_in_tool_shed( trans.app, id ) repo = hg_util.get_repo_for_repository( trans.app, repository=repository, repo_path=None, create=False ) @@ -3210,7 +3211,7 @@ @web.expose def view_changeset( self, trans, id, ctx_str, **kwd ): - message = kwd.get( 'message', '' ) + message = escape( kwd.get( 'message', '' ) ) status = kwd.get( 'status', 'done' ) repository = suc.get_repository_in_tool_shed( trans.app, id ) repo = hg_util.get_repo_for_repository( trans.app, repository=repository, repo_path=None, create=False ) @@ -3302,7 +3303,7 @@ @web.expose def view_repository( self, trans, id, **kwd ): - message = kwd.get( 'message', '' ) + message = escape( kwd.get( 'message', '' ) ) status = kwd.get( 'status', 'done' ) repository = suc.get_repository_in_tool_shed( trans.app, id ) repo = hg_util.get_repo_for_repository( trans.app, repository=repository, repo_path=None, create=False ) @@ -3390,7 +3391,7 @@ @web.expose def view_tool_metadata( self, trans, repository_id, changeset_revision, tool_id, **kwd ): - message = kwd.get( 'message', '' ) + message = escape( kwd.get( 'message', '' ) ) status = kwd.get( 'status', 'done' ) render_repository_actions_for = kwd.get( 'render_repository_actions_for', 'tool_shed' ) repository = suc.get_repository_in_tool_shed( trans.app, repository_id ) @@ -3471,7 +3472,7 @@ @web.expose def view_workflow( self, trans, workflow_name, repository_metadata_id, **kwd ): """Retrieve necessary information about a workflow from the database so that it can be displayed in an svg image.""" - message = kwd.get( 'message', '' ) + message = escape( kwd.get( 'message', '' ) ) status = kwd.get( 'status', 'done' ) render_repository_actions_for = kwd.get( 'render_repository_actions_for', 'tool_shed' ) if workflow_name: diff -r 0ac7297b58491d542948ae3976732dd2c3450b89 -r e416697be38e66f18be89a4cfca70457c9784294 lib/galaxy/webapps/tool_shed/controllers/repository_review.py --- a/lib/galaxy/webapps/tool_shed/controllers/repository_review.py +++ b/lib/galaxy/webapps/tool_shed/controllers/repository_review.py @@ -2,6 +2,7 @@ import os from sqlalchemy.sql.expression import func +from markupsafe import escape from galaxy import util from galaxy import web @@ -40,7 +41,7 @@ @web.require_login( "approve repository review" ) def approve_repository_review( self, trans, **kwd ): # The value of the received id is the encoded review id. - message = kwd.get( 'message', '' ) + message = escape( kwd.get( 'message', '' ) ) status = kwd.get( 'status', 'done' ) encoded_review_id = kwd[ 'id' ] review = review_util.get_review( trans.app, encoded_review_id ) @@ -74,7 +75,7 @@ @web.expose @web.require_login( "browse review" ) def browse_review( self, trans, **kwd ): - message = kwd.get( 'message', '' ) + message = escape( kwd.get( 'message', '' ) ) status = kwd.get( 'status', 'done' ) review = review_util.get_review( trans.app, kwd[ 'id' ] ) repository = review.repository @@ -105,7 +106,7 @@ @web.expose @web.require_login( "create component" ) def create_component( self, trans, **kwd ): - message = kwd.get( 'message', '' ) + message = escape( kwd.get( 'message', '' ) ) status = kwd.get( 'status', 'done' ) name = kwd.get( 'name', '' ) description = kwd.get( 'description', '' ) @@ -136,7 +137,7 @@ @web.require_login( "create review" ) def create_review( self, trans, **kwd ): # The value of the received id is the encoded repository id. - message = kwd.get( 'message', '' ) + message = escape( kwd.get( 'message', '' ) ) status = kwd.get( 'status', 'done' ) repository_id = kwd.get( 'id', None ) changeset_revision = kwd.get( 'changeset_revision', None ) @@ -201,7 +202,7 @@ @web.expose @web.require_login( "edit component" ) def edit_component( self, trans, **kwd ): - message = kwd.get( 'message', '' ) + message = escape( kwd.get( 'message', '' ) ) status = kwd.get( 'status', 'done' ) id = kwd.get( 'id', None ) if not id: @@ -232,7 +233,7 @@ @web.require_login( "edit review" ) def edit_review( self, trans, **kwd ): # The value of the received id is the encoded review id. - message = kwd.get( 'message', '' ) + message = escape( kwd.get( 'message', '' ) ) status = kwd.get( 'status', 'done' ) review_id = kwd.get( 'id', None ) review = review_util.get_review( trans.app, review_id ) @@ -408,7 +409,7 @@ @web.require_login( "manage repositories reviewed by me" ) def manage_repositories_reviewed_by_me( self, trans, **kwd ): # The value of the received id is the encoded repository id. - message = kwd.get( 'message', '' ) + message = escape( kwd.get( 'message', '' ) ) status = kwd.get( 'status', 'done' ) if 'operation' in kwd: kwd[ 'mine' ] = True @@ -475,7 +476,7 @@ @web.require_login( "manage repository reviews" ) def manage_repository_reviews( self, trans, mine=False, **kwd ): # The value of the received id is the encoded repository id. - message = kwd.get( 'message', '' ) + message = escape( kwd.get( 'message', '' ) ) status = kwd.get( 'status', 'done' ) repository_id = kwd.get( 'id', None ) if repository_id: @@ -524,7 +525,7 @@ @web.require_login( "manage repository reviews of revision" ) def manage_repository_reviews_of_revision( self, trans, **kwd ): # The value of the received id is the encoded repository id. - message = kwd.get( 'message', '' ) + message = escape( kwd.get( 'message', '' ) ) status = kwd.get( 'status', 'done' ) repository_id = kwd.get( 'id', None ) changeset_revision = kwd.get( 'changeset_revision', None ) @@ -547,7 +548,7 @@ @web.expose @web.require_login( "repository reviews by user" ) def repository_reviews_by_user( self, trans, **kwd ): - message = kwd.get( 'message', '' ) + message = escape( kwd.get( 'message', '' ) ) status = kwd.get( 'status', 'done' ) if 'operation' in kwd: @@ -573,7 +574,7 @@ @web.expose @web.require_login( "reviewed repositories i own" ) def reviewed_repositories_i_own( self, trans, **kwd ): - message = kwd.get( 'message', '' ) + message = escape( kwd.get( 'message', '' ) ) status = kwd.get( 'status', 'done' ) # The value of the received id is the encoded repository id. if 'operation' in kwd: @@ -592,7 +593,7 @@ @web.require_login( "select previous review" ) def select_previous_review( self, trans, **kwd ): # The value of the received id is the encoded repository id. - message = kwd.get( 'message', '' ) + message = escape( kwd.get( 'message', '' ) ) status = kwd.get( 'status', 'done' ) repository = suc.get_repository_in_tool_shed( trans.app, kwd[ 'id' ] ) changeset_revision = kwd.get( 'changeset_revision', None ) diff -r 0ac7297b58491d542948ae3976732dd2c3450b89 -r e416697be38e66f18be89a4cfca70457c9784294 lib/galaxy/webapps/tool_shed/controllers/upload.py --- a/lib/galaxy/webapps/tool_shed/controllers/upload.py +++ b/lib/galaxy/webapps/tool_shed/controllers/upload.py @@ -9,6 +9,7 @@ from galaxy import web from galaxy.datatypes import checkers from galaxy.web.base.controller import BaseUIController +from markupsafe import escape from tool_shed.dependencies import attribute_handlers from tool_shed.galaxy_install import dependency_display @@ -34,9 +35,9 @@ @web.expose @web.require_login( 'upload', use_panels=True ) def upload( self, trans, **kwd ): - message = kwd.get( 'message', '' ) + message = escape( kwd.get( 'message', '' ) ) status = kwd.get( 'status', 'done' ) - commit_message = kwd.get( 'commit_message', 'Uploaded' ) + commit_message = escape( kwd.get( 'commit_message', 'Uploaded' ) ) category_ids = util.listify( kwd.get( 'category_id', '' ) ) categories = suc.get_categories( trans.app ) repository_id = kwd.get( 'repository_id', '' ) diff -r 0ac7297b58491d542948ae3976732dd2c3450b89 -r e416697be38e66f18be89a4cfca70457c9784294 lib/tool_shed/util/repository_util.py --- a/lib/tool_shed/util/repository_util.py +++ b/lib/tool_shed/util/repository_util.py @@ -7,6 +7,7 @@ from galaxy import web from galaxy.web.form_builder import build_select_field from galaxy.webapps.tool_shed.model import directory_hash_id +from markupsafe import escape from tool_shed.dependencies.repository import relation_builder @@ -256,7 +257,7 @@ def handle_role_associations( app, role, repository, **kwd ): sa_session = app.model.context.current - message = kwd.get( 'message', '' ) + message = escape( kwd.get( 'message', '' ) ) status = kwd.get( 'status', 'done' ) repository_owner = repository.user if kwd.get( 'manage_role_associations_button', False ): Repository URL: https://bitbucket.org/galaxy/galaxy-central/ -- This is a commit notification from bitbucket.org. You are receiving this because you have the service enabled, addressing the recipient of this email.

1 0

commit/galaxy-central: martenson: Merged in martenson/galaxy-central-marten/stable (pull request #599)
by commits-noreply＠bitbucket.org 11 Dec '14

11 Dec '14

1 new commit in galaxy-central: https://bitbucket.org/galaxy/galaxy-central/commits/0ac7297b5849/ Changeset: 0ac7297b5849 Branch: stable User: martenson Date: 2014-12-11 18:01:22+00:00 Summary: Merged in martenson/galaxy-central-marten/stable (pull request #599) [STABLE] encode dataset, ldda, folder and library IDs properly in some more places Affected #: 5 files diff -r f0f1f78b54c55c8569bd1e3ed7fc15726b0b64a4 -r 0ac7297b58491d542948ae3976732dd2c3450b89 templates/webapps/galaxy/library/common/browse_library.mako --- a/templates/webapps/galaxy/library/common/browse_library.mako +++ b/templates/webapps/galaxy/library/common/browse_library.mako @@ -238,7 +238,7 @@ %if parent is not None: parent="${parent | h}" %endif - id="libraryItem-${ldda.id | h}"> + id="libraryItem-${ trans.security.encode_id( ldda.id ) | h}"><td style="padding-left: ${pad+20}px;"><input style="float: left;" type="checkbox" name="ldda_ids" id="${trans.security.encode_id( ldda.id ) | h}" value="${trans.security.encode_id( ldda.id ) | h}" %if selected: @@ -248,7 +248,7 @@ %if simple: <label for="${trans.security.encode_id( ldda.id ) | h}">${ util.unicodify( ldda.name ) | h}</label> %else: - <div style="float: left; margin-left: 1px;" class="menubutton split popup" id="dataset-${ldda.id | h}-popup"> + <div style="float: left; margin-left: 1px;" class="menubutton split popup" id="dataset-${ trans.security.encode_id( ldda.id ) | h}-popup"><a class="view-info" href="${h.url_for( controller='library_common', action='ldda_info', cntrller=cntrller, library_id=trans.security.encode_id( library.id ), folder_id=trans.security.encode_id( folder.id ), id=trans.security.encode_id( ldda.id ), use_panels=use_panels, show_deleted=show_deleted )}"> %if ldda.library_dataset.deleted: <div class="libraryItem-error">${util.unicodify( ldda.name ) | h}</div> @@ -258,7 +258,7 @@ </a></div> %if not library.deleted: - <div popupmenu="dataset-${ldda.id | h}-popup"> + <div popupmenu="dataset-${ trans.security.encode_id( ldda.id ) | h}-popup"> %if not branch_deleted( folder ) and not ldda.library_dataset.deleted and can_modify: <a class="action-button" href="${h.url_for( controller='library_common', action='ldda_edit_info', cntrller=cntrller, library_id=trans.security.encode_id( library.id ), folder_id=trans.security.encode_id( folder.id ), id=trans.security.encode_id( ldda.id ), use_panels=use_panels, show_deleted=show_deleted )}">Edit information</a><a class="action-button" href="${h.url_for( controller='library_common', action='move_library_item', cntrller=cntrller, item_type='ldda', item_id=trans.security.encode_id( ldda.id ), source_library_id=trans.security.encode_id( library.id ), use_panels=use_panels, show_deleted=show_deleted )}">Move this dataset</a> @@ -364,7 +364,7 @@ <td style="padding-left: ${folder_pad | h}px;"><input type="checkbox" class="folderCheckbox"/><span class="expandLink folder-${encoded_id | h}-click"> - <div style="float: left; margin-left: 2px;" class="menubutton split popup" id="folder_img-${folder.id | h}-popup"> + <div style="float: left; margin-left: 2px;" class="menubutton split popup" id="folder_img-${ 'F' + trans.security.encode_id( folder.id ) }-popup"><a class="folder-${encoded_id | h}-click" href="javascript:void(0);"><span class="rowIcon"></span> %if folder.deleted: @@ -376,7 +376,7 @@ </div></span> %if not library.deleted: - <div popupmenu="folder_img-${folder.id | h}-popup"> + <div popupmenu="folder_img-${ 'F' + trans.security.encode_id( folder.id ) }-popup"> %if not branch_deleted( folder ) and can_add: <a class="action-button" href="${h.url_for( controller='library_common', action='upload_library_dataset', cntrller=cntrller, library_id=trans.security.encode_id( library.id ), folder_id=trans.security.encode_id( folder.id ), use_panels=use_panels, show_deleted=show_deleted )}">Add datasets</a><a class="action-button" href="${h.url_for( controller='library_common', action='create_folder', cntrller=cntrller, parent_id=trans.security.encode_id( folder.id ), library_id=trans.security.encode_id( library.id ), use_panels=use_panels, show_deleted=show_deleted )}">Add sub-folder</a> @@ -512,8 +512,8 @@ <li><a class="action-button" href="${h.url_for( controller='library_common', action='create_folder', cntrller=cntrller, parent_id=trans.security.encode_id( library.root_folder.id ), library_id=trans.security.encode_id( library.id ), use_panels=use_panels, show_deleted=show_deleted )}">Add folder</a></li> %endif %if ( ( not library.deleted ) and ( can_modify or can_manage ) ) or ( can_modify and not library.purged ) or ( library.purged ): - <li><a class="action-button" id="library-${library.id}-popup" class="menubutton">Library Actions</a></li> - <div popupmenu="library-${library.id}-popup"> + <li><a class="action-button" id="library-${ trans.security.encode_id( library.id ) }-popup" class="menubutton">Library Actions</a></li> + <div popupmenu="library-${ trans.security.encode_id( library.id ) }-popup"> %if not library.deleted: %if can_modify: <a class="action-button" href="${h.url_for( controller='library_common', action='library_info', cntrller=cntrller, id=trans.security.encode_id( library.id ), use_panels=use_panels, show_deleted=show_deleted )}">Edit information</a> diff -r f0f1f78b54c55c8569bd1e3ed7fc15726b0b64a4 -r 0ac7297b58491d542948ae3976732dd2c3450b89 templates/webapps/galaxy/library/common/browse_library_opt.mako --- a/templates/webapps/galaxy/library/common/browse_library_opt.mako +++ b/templates/webapps/galaxy/library/common/browse_library_opt.mako @@ -230,9 +230,9 @@ %if parent is not None: parent="${parent | h}" %endif - id="libraryItem-${ldda.id | h}"> + id="libraryItem-${ trans.security.encode_id( ldda.id ) | h }"><td style="padding-left: ${pad+20}px;"> - <input style="float: left;" type="checkbox" name="ldda_ids" id="${trans.security.encode_id( ldda.id ) | h}" value="${trans.security.encode_id( ldda.id ) | h}" + <input style="float: left;" type="checkbox" name="ldda_ids" id="${trans.security.encode_id( ldda.id ) | h}" value="${ trans.security.encode_id( ldda.id ) | h }" %if selected: checked="checked" %endif @@ -240,7 +240,7 @@ %if simple: <label for="${trans.security.encode_id( ldda.id ) | h}">${ util.unicodify( ldda.name ) | h}</label> %else: - <div style="float: left; margin-left: 1px;" class="menubutton split popup" id="dataset-${ldda.id | h}-popup"> + <div style="float: left; margin-left: 1px;" class="menubutton split popup" id="dataset-${ trans.security.encode_id( ldda.id ) | h }-popup"><a class="view-info" href="${h.url_for( controller='library_common', action='ldda_info', cntrller=cntrller, library_id=trans.security.encode_id( library.id ), folder_id=trans.security.encode_id( folder.id ), id=trans.security.encode_id( ldda.id ), use_panels=use_panels, show_deleted=show_deleted )}"> %if ldda.library_dataset.deleted: <div class="libraryItem-error">${util.unicodify( ldda.name ) | h}</div> @@ -250,7 +250,7 @@ </a></div> %if not library.deleted: - <div popupmenu="dataset-${ldda.id | h}-popup"> + <div popupmenu="dataset-${ trans.security.encode_id( ldda.id ) | h }-popup"> %if not branch_deleted( folder ) and not ldda.library_dataset.deleted and can_modify: <a class="action-button" href="${h.url_for( controller='library_common', action='ldda_edit_info', cntrller=cntrller, library_id=trans.security.encode_id( library.id ), folder_id=trans.security.encode_id( folder.id ), id=trans.security.encode_id( ldda.id ), use_panels=use_panels, show_deleted=show_deleted )}">Edit information</a><a class="action-button" href="${h.url_for( controller='library_common', action='move_library_item', cntrller=cntrller, item_type='ldda', item_id=trans.security.encode_id( ldda.id ), source_library_id=trans.security.encode_id( library.id ), use_panels=use_panels, show_deleted=show_deleted )}">Move this dataset</a> @@ -371,7 +371,7 @@ <td style="padding-left: ${folder_pad | h}px;"><input type="checkbox" class="folderCheckbox"/><span class="expandLink folder-${encoded_id | h}-click"> - <div style="float: left; margin-left: 2px;" class="menubutton split popup" id="folder_img-${folder.id | h}-popup"> + <div style="float: left; margin-left: 2px;" class="menubutton split popup" id="folder_img-${ 'F' + trans.security.encode_id( folder.id ) }-popup"><a class="folder-${encoded_id | h}-click" href="javascript:void(0);"><span class="rowIcon"></span> %if folder.deleted: @@ -383,7 +383,7 @@ </div></span> %if not library.deleted: - <div popupmenu="folder_img-${folder.id | h}-popup"> + <div popupmenu="folder_img-${ 'F' + trans.security.encode_id( folder.id ) }-popup"> %if not branch_deleted( folder ) and can_add: <a class="action-button" href="${h.url_for( controller='library_common', action='upload_library_dataset', cntrller=cntrller, library_id=trans.security.encode_id( library.id ), folder_id=trans.security.encode_id( folder.id ), use_panels=use_panels, show_deleted=show_deleted )}">Add datasets</a><a class="action-button" href="${h.url_for( controller='library_common', action='create_folder', cntrller=cntrller, parent_id=trans.security.encode_id( folder.id ), library_id=trans.security.encode_id( library.id ), use_panels=use_panels, show_deleted=show_deleted )}">Add sub-folder</a> @@ -515,8 +515,8 @@ <li><a class="action-button" href="${h.url_for( controller='library_common', action='create_folder', cntrller=cntrller, parent_id=trans.security.encode_id( library.root_folder.id ), library_id=trans.security.encode_id( library.id ), use_panels=use_panels, show_deleted=show_deleted )}">Add folder</a></li> %endif %if ( ( not library.deleted ) and ( can_modify or can_manage ) ) or ( can_modify and not library.purged ) or ( library.purged ): - <li><a class="action-button" id="library-${library.id | h}-popup" class="menubutton">Library Actions</a></li> - <div popupmenu="library-${library.id | h}-popup"> + <li><a class="action-button" id="library-${ trans.security.encode_id( library.id ) | h}-popup" class="menubutton">Library Actions</a></li> + <div popupmenu="library-${ trans.security.encode_id( library.id ) | h}-popup"> %if not library.deleted: %if can_modify: <a class="action-button" href="${h.url_for( controller='library_common', action='library_info', cntrller=cntrller, id=trans.security.encode_id( library.id ), use_panels=use_panels, show_deleted=show_deleted )}">Edit information</a> diff -r f0f1f78b54c55c8569bd1e3ed7fc15726b0b64a4 -r 0ac7297b58491d542948ae3976732dd2c3450b89 templates/webapps/galaxy/library/common/ldda_info.mako --- a/templates/webapps/galaxy/library/common/ldda_info.mako +++ b/templates/webapps/galaxy/library/common/ldda_info.mako @@ -47,9 +47,9 @@ <div class="toolForm"><div class="toolFormTitle"> - Information about <div class="menubutton popup" id="dataset-${ldda.id | h}-popup">${util.unicodify( ldda.name ) | h}</div> + Information about <div class="menubutton popup" id="dataset-${ trans.security.encode_id( ldda.id ) | h}-popup">${util.unicodify( ldda.name ) | h}</div> %if not library.deleted and not branch_deleted( ldda.library_dataset.folder ) and not ldda.library_dataset.deleted: - <div popupmenu="dataset-${ldda.id | h}-popup"> + <div popupmenu="dataset-${ trans.security.encode_id( ldda.id ) | h}-popup"> %if can_modify: <a class="action-button" href="${h.url_for( controller='library_common', action='ldda_edit_info', cntrller=cntrller, library_id=trans.security.encode_id( library.id ), folder_id=trans.security.encode_id( ldda.library_dataset.folder.id ), id=trans.security.encode_id( ldda.id ), use_panels=use_panels, show_deleted=show_deleted )}">Edit information</a> %if not info_association: @@ -168,9 +168,9 @@ %endfor %if ldda.peek != "no peek": <div class="form-row"> - <div id="info${ldda.id | h}" class="historyItemBody"> + <div id="info${ trans.security.encode_id( ldda.id ) | h}" class="historyItemBody"><label>Peek:</label> - <div><pre id="peek${ldda.id | h}" class="peek">${util.unicodify( ldda.display_peek() )}</pre></div> + <div><pre id="peek${ trans.security.encode_id( ldda.id ) | h}" class="peek">${util.unicodify( ldda.display_peek() )}</pre></div></div></div> %endif diff -r f0f1f78b54c55c8569bd1e3ed7fc15726b0b64a4 -r 0ac7297b58491d542948ae3976732dd2c3450b89 templates/webapps/galaxy/library/common/library_info.mako --- a/templates/webapps/galaxy/library/common/library_info.mako +++ b/templates/webapps/galaxy/library/common/library_info.mako @@ -34,11 +34,11 @@ <div class="toolForm"><div class="toolFormTitle"> - <div class="menubutton split popup" id="library-${library.id}-popup"> + <div class="menubutton split popup" id="library-${trans.security.encode_id( library.id ) | h }-popup"><a href="${h.url_for( controller='library_common', action='browse_library', cntrller=cntrller, id=trans.security.encode_id( library.id ), use_panels=use_panels, show_deleted=show_deleted )}">${library.name[:50] | h}</a></div> %if can_add or can_modify or can_manage: - <div popupmenu="library-${library.id | h}-popup"> + <div popupmenu="library-${ trans.security.encode_id( library.id ) | h }-popup"> %if not library.deleted: %if can_add and not library.info_association: <a class="action-button" href="${h.url_for( controller='library_common', action='add_template', cntrller=cntrller, item_type='library', form_type=trans.model.FormDefinition.types.LIBRARY_INFO_TEMPLATE, library_id=trans.security.encode_id( library.id ), use_panels=use_panels, show_deleted=show_deleted )}">Use template</a> diff -r f0f1f78b54c55c8569bd1e3ed7fc15726b0b64a4 -r 0ac7297b58491d542948ae3976732dd2c3450b89 templates/webapps/galaxy/requests/common/common.mako --- a/templates/webapps/galaxy/requests/common/common.mako +++ b/templates/webapps/galaxy/requests/common/common.mako @@ -694,11 +694,11 @@ <td> %if is_admin: <span class="expandLink dataset-${dataset}-click"><span class="rowIcon"></span> - <div style="float: left; margin-left: 2px;" class="menubutton split popup" id="dataset-${dataset.id}-popup"> + <div style="float: left; margin-left: 2px;" class="menubutton split popup" id="dataset-${ trans.security.encode_id( dataset.id ) }-popup"><a class="dataset-${encoded_id}-click" href="${h.url_for( controller='requests_admin', action='manage_datasets', operation='view', id=trans.security.encode_id( dataset.id ) )}">${dataset.name | h}</a></div></span> - <div popupmenu="dataset-${dataset.id}-popup"> + <div popupmenu="dataset-${ trans.security.encode_id( dataset.id ) }-popup"> %if can_transfer_datasets and dataset in sample.untransferred_dataset_files: <li><a class="action-button" href="${h.url_for( controller='requests_admin', action='initiate_data_transfer', sample_id=trans.security.encode_id( sample.id ), sample_dataset_id=trans.security.encode_id( dataset.id ) )}">Transfer</a></li> %endif Repository URL: https://bitbucket.org/galaxy/galaxy-central/ -- This is a commit notification from bitbucket.org. You are receiving this because you have the service enabled, addressing the recipient of this email.

1 0

commit/galaxy-central: 6 new changesets
by commits-noreply＠bitbucket.org 11 Dec '14

11 Dec '14

6 new commits in galaxy-central: https://bitbucket.org/galaxy/galaxy-central/commits/7dad1a27eda3/ Changeset: 7dad1a27eda3 Branch: stable User: martenson Date: 2014-12-08 21:02:12+00:00 Summary: encode dataset, ldda, folder and library IDs properly in some more places Affected #: 5 files diff -r 07404a82972d877b5529fffaeb3e7e05b69a02a3 -r 7dad1a27eda301e019d143ef1fefed73036addd9 templates/webapps/galaxy/library/common/browse_library.mako --- a/templates/webapps/galaxy/library/common/browse_library.mako +++ b/templates/webapps/galaxy/library/common/browse_library.mako @@ -238,7 +238,7 @@ %if parent is not None: parent="${parent | h}" %endif - id="libraryItem-${ldda.id | h}"> + id="libraryItem-${ trans.security.encode_id( ldda.id ) | h}"><td style="padding-left: ${pad+20}px;"><input style="float: left;" type="checkbox" name="ldda_ids" id="${trans.security.encode_id( ldda.id ) | h}" value="${trans.security.encode_id( ldda.id ) | h}" %if selected: @@ -248,7 +248,7 @@ %if simple: <label for="${trans.security.encode_id( ldda.id ) | h}">${ util.unicodify( ldda.name ) | h}</label> %else: - <div style="float: left; margin-left: 1px;" class="menubutton split popup" id="dataset-${ldda.id | h}-popup"> + <div style="float: left; margin-left: 1px;" class="menubutton split popup" id="dataset-${ trans.security.encode_id( ldda.id ) | h}-popup"><a class="view-info" href="${h.url_for( controller='library_common', action='ldda_info', cntrller=cntrller, library_id=trans.security.encode_id( library.id ), folder_id=trans.security.encode_id( folder.id ), id=trans.security.encode_id( ldda.id ), use_panels=use_panels, show_deleted=show_deleted )}"> %if ldda.library_dataset.deleted: <div class="libraryItem-error">${util.unicodify( ldda.name ) | h}</div> @@ -258,7 +258,7 @@ </a></div> %if not library.deleted: - <div popupmenu="dataset-${ldda.id | h}-popup"> + <div popupmenu="dataset-${ trans.security.encode_id( ldda.id ) | h}-popup"> %if not branch_deleted( folder ) and not ldda.library_dataset.deleted and can_modify: <a class="action-button" href="${h.url_for( controller='library_common', action='ldda_edit_info', cntrller=cntrller, library_id=trans.security.encode_id( library.id ), folder_id=trans.security.encode_id( folder.id ), id=trans.security.encode_id( ldda.id ), use_panels=use_panels, show_deleted=show_deleted )}">Edit information</a><a class="action-button" href="${h.url_for( controller='library_common', action='move_library_item', cntrller=cntrller, item_type='ldda', item_id=trans.security.encode_id( ldda.id ), source_library_id=trans.security.encode_id( library.id ), use_panels=use_panels, show_deleted=show_deleted )}">Move this dataset</a> @@ -364,7 +364,7 @@ <td style="padding-left: ${folder_pad | h}px;"><input type="checkbox" class="folderCheckbox"/><span class="expandLink folder-${encoded_id | h}-click"> - <div style="float: left; margin-left: 2px;" class="menubutton split popup" id="folder_img-${folder.id | h}-popup"> + <div style="float: left; margin-left: 2px;" class="menubutton split popup" id="folder_img-${ 'F' + trans.security.encode_id( folder.id ) }-popup"><a class="folder-${encoded_id | h}-click" href="javascript:void(0);"><span class="rowIcon"></span> %if folder.deleted: @@ -376,7 +376,7 @@ </div></span> %if not library.deleted: - <div popupmenu="folder_img-${folder.id | h}-popup"> + <div popupmenu="folder_img-${ 'F' + trans.security.encode_id( folder.id ) } | h}-popup"> %if not branch_deleted( folder ) and can_add: <a class="action-button" href="${h.url_for( controller='library_common', action='upload_library_dataset', cntrller=cntrller, library_id=trans.security.encode_id( library.id ), folder_id=trans.security.encode_id( folder.id ), use_panels=use_panels, show_deleted=show_deleted )}">Add datasets</a><a class="action-button" href="${h.url_for( controller='library_common', action='create_folder', cntrller=cntrller, parent_id=trans.security.encode_id( folder.id ), library_id=trans.security.encode_id( library.id ), use_panels=use_panels, show_deleted=show_deleted )}">Add sub-folder</a> @@ -512,8 +512,8 @@ <li><a class="action-button" href="${h.url_for( controller='library_common', action='create_folder', cntrller=cntrller, parent_id=trans.security.encode_id( library.root_folder.id ), library_id=trans.security.encode_id( library.id ), use_panels=use_panels, show_deleted=show_deleted )}">Add folder</a></li> %endif %if ( ( not library.deleted ) and ( can_modify or can_manage ) ) or ( can_modify and not library.purged ) or ( library.purged ): - <li><a class="action-button" id="library-${library.id}-popup" class="menubutton">Library Actions</a></li> - <div popupmenu="library-${library.id}-popup"> + <li><a class="action-button" id="library-${ trans.security.encode_id( library.id ) }-popup" class="menubutton">Library Actions</a></li> + <div popupmenu="library-${ trans.security.encode_id( library.id ) }-popup"> %if not library.deleted: %if can_modify: <a class="action-button" href="${h.url_for( controller='library_common', action='library_info', cntrller=cntrller, id=trans.security.encode_id( library.id ), use_panels=use_panels, show_deleted=show_deleted )}">Edit information</a> diff -r 07404a82972d877b5529fffaeb3e7e05b69a02a3 -r 7dad1a27eda301e019d143ef1fefed73036addd9 templates/webapps/galaxy/library/common/browse_library_opt.mako --- a/templates/webapps/galaxy/library/common/browse_library_opt.mako +++ b/templates/webapps/galaxy/library/common/browse_library_opt.mako @@ -230,9 +230,9 @@ %if parent is not None: parent="${parent | h}" %endif - id="libraryItem-${ldda.id | h}"> + id="libraryItem-${ trans.security.encode_id( ldda.id ) | h }"><td style="padding-left: ${pad+20}px;"> - <input style="float: left;" type="checkbox" name="ldda_ids" id="${trans.security.encode_id( ldda.id ) | h}" value="${trans.security.encode_id( ldda.id ) | h}" + <input style="float: left;" type="checkbox" name="ldda_ids" id="${trans.security.encode_id( ldda.id ) | h}" value="${ trans.security.encode_id( ldda.id ) | h }" %if selected: checked="checked" %endif @@ -240,7 +240,7 @@ %if simple: <label for="${trans.security.encode_id( ldda.id ) | h}">${ util.unicodify( ldda.name ) | h}</label> %else: - <div style="float: left; margin-left: 1px;" class="menubutton split popup" id="dataset-${ldda.id | h}-popup"> + <div style="float: left; margin-left: 1px;" class="menubutton split popup" id="dataset-${ trans.security.encode_id( ldda.id ) | h }-popup"><a class="view-info" href="${h.url_for( controller='library_common', action='ldda_info', cntrller=cntrller, library_id=trans.security.encode_id( library.id ), folder_id=trans.security.encode_id( folder.id ), id=trans.security.encode_id( ldda.id ), use_panels=use_panels, show_deleted=show_deleted )}"> %if ldda.library_dataset.deleted: <div class="libraryItem-error">${util.unicodify( ldda.name ) | h}</div> @@ -250,7 +250,7 @@ </a></div> %if not library.deleted: - <div popupmenu="dataset-${ldda.id | h}-popup"> + <div popupmenu="dataset-${ trans.security.encode_id( ldda.id ) | h }-popup"> %if not branch_deleted( folder ) and not ldda.library_dataset.deleted and can_modify: <a class="action-button" href="${h.url_for( controller='library_common', action='ldda_edit_info', cntrller=cntrller, library_id=trans.security.encode_id( library.id ), folder_id=trans.security.encode_id( folder.id ), id=trans.security.encode_id( ldda.id ), use_panels=use_panels, show_deleted=show_deleted )}">Edit information</a><a class="action-button" href="${h.url_for( controller='library_common', action='move_library_item', cntrller=cntrller, item_type='ldda', item_id=trans.security.encode_id( ldda.id ), source_library_id=trans.security.encode_id( library.id ), use_panels=use_panels, show_deleted=show_deleted )}">Move this dataset</a> @@ -371,7 +371,7 @@ <td style="padding-left: ${folder_pad | h}px;"><input type="checkbox" class="folderCheckbox"/><span class="expandLink folder-${encoded_id | h}-click"> - <div style="float: left; margin-left: 2px;" class="menubutton split popup" id="folder_img-${folder.id | h}-popup"> + <div style="float: left; margin-left: 2px;" class="menubutton split popup" id="folder_img-${ 'F' + trans.security.encode_id( folder.id ) }-popup"><a class="folder-${encoded_id | h}-click" href="javascript:void(0);"><span class="rowIcon"></span> %if folder.deleted: @@ -383,7 +383,7 @@ </div></span> %if not library.deleted: - <div popupmenu="folder_img-${folder.id | h}-popup"> + <div popupmenu="folder_img-${ 'F' + trans.security.encode_id( folder.id ) }-popup"> %if not branch_deleted( folder ) and can_add: <a class="action-button" href="${h.url_for( controller='library_common', action='upload_library_dataset', cntrller=cntrller, library_id=trans.security.encode_id( library.id ), folder_id=trans.security.encode_id( folder.id ), use_panels=use_panels, show_deleted=show_deleted )}">Add datasets</a><a class="action-button" href="${h.url_for( controller='library_common', action='create_folder', cntrller=cntrller, parent_id=trans.security.encode_id( folder.id ), library_id=trans.security.encode_id( library.id ), use_panels=use_panels, show_deleted=show_deleted )}">Add sub-folder</a> @@ -515,8 +515,8 @@ <li><a class="action-button" href="${h.url_for( controller='library_common', action='create_folder', cntrller=cntrller, parent_id=trans.security.encode_id( library.root_folder.id ), library_id=trans.security.encode_id( library.id ), use_panels=use_panels, show_deleted=show_deleted )}">Add folder</a></li> %endif %if ( ( not library.deleted ) and ( can_modify or can_manage ) ) or ( can_modify and not library.purged ) or ( library.purged ): - <li><a class="action-button" id="library-${library.id | h}-popup" class="menubutton">Library Actions</a></li> - <div popupmenu="library-${library.id | h}-popup"> + <li><a class="action-button" id="library-${ trans.security.encode_id( library.id ) | h}-popup" class="menubutton">Library Actions</a></li> + <div popupmenu="library-${ trans.security.encode_id( library.id ) | h}-popup"> %if not library.deleted: %if can_modify: <a class="action-button" href="${h.url_for( controller='library_common', action='library_info', cntrller=cntrller, id=trans.security.encode_id( library.id ), use_panels=use_panels, show_deleted=show_deleted )}">Edit information</a> diff -r 07404a82972d877b5529fffaeb3e7e05b69a02a3 -r 7dad1a27eda301e019d143ef1fefed73036addd9 templates/webapps/galaxy/library/common/ldda_info.mako --- a/templates/webapps/galaxy/library/common/ldda_info.mako +++ b/templates/webapps/galaxy/library/common/ldda_info.mako @@ -47,9 +47,9 @@ <div class="toolForm"><div class="toolFormTitle"> - Information about <div class="menubutton popup" id="dataset-${ldda.id | h}-popup">${util.unicodify( ldda.name ) | h}</div> + Information about <div class="menubutton popup" id="dataset-${ trans.security.encode_id( ldda.id ) | h}-popup">${util.unicodify( ldda.name ) | h}</div> %if not library.deleted and not branch_deleted( ldda.library_dataset.folder ) and not ldda.library_dataset.deleted: - <div popupmenu="dataset-${ldda.id | h}-popup"> + <div popupmenu="dataset-${ trans.security.encode_id( ldda.id ) | h}-popup"> %if can_modify: <a class="action-button" href="${h.url_for( controller='library_common', action='ldda_edit_info', cntrller=cntrller, library_id=trans.security.encode_id( library.id ), folder_id=trans.security.encode_id( ldda.library_dataset.folder.id ), id=trans.security.encode_id( ldda.id ), use_panels=use_panels, show_deleted=show_deleted )}">Edit information</a> %if not info_association: @@ -168,9 +168,9 @@ %endfor %if ldda.peek != "no peek": <div class="form-row"> - <div id="info${ldda.id | h}" class="historyItemBody"> + <div id="info${ trans.security.encode_id( ldda.id ) | h}" class="historyItemBody"><label>Peek:</label> - <div><pre id="peek${ldda.id | h}" class="peek">${util.unicodify( ldda.display_peek() )}</pre></div> + <div><pre id="peek${ trans.security.encode_id( ldda.id ) | h}" class="peek">${util.unicodify( ldda.display_peek() )}</pre></div></div></div> %endif diff -r 07404a82972d877b5529fffaeb3e7e05b69a02a3 -r 7dad1a27eda301e019d143ef1fefed73036addd9 templates/webapps/galaxy/library/common/library_info.mako --- a/templates/webapps/galaxy/library/common/library_info.mako +++ b/templates/webapps/galaxy/library/common/library_info.mako @@ -34,11 +34,11 @@ <div class="toolForm"><div class="toolFormTitle"> - <div class="menubutton split popup" id="library-${library.id}-popup"> + <div class="menubutton split popup" id="library-${trans.security.encode_id( library.id ) | h }-popup"><a href="${h.url_for( controller='library_common', action='browse_library', cntrller=cntrller, id=trans.security.encode_id( library.id ), use_panels=use_panels, show_deleted=show_deleted )}">${library.name[:50] | h}</a></div> %if can_add or can_modify or can_manage: - <div popupmenu="library-${library.id | h}-popup"> + <div popupmenu="library-${ trans.security.encode_id( library.id ) | h }-popup"> %if not library.deleted: %if can_add and not library.info_association: <a class="action-button" href="${h.url_for( controller='library_common', action='add_template', cntrller=cntrller, item_type='library', form_type=trans.model.FormDefinition.types.LIBRARY_INFO_TEMPLATE, library_id=trans.security.encode_id( library.id ), use_panels=use_panels, show_deleted=show_deleted )}">Use template</a> diff -r 07404a82972d877b5529fffaeb3e7e05b69a02a3 -r 7dad1a27eda301e019d143ef1fefed73036addd9 templates/webapps/galaxy/requests/common/common.mako --- a/templates/webapps/galaxy/requests/common/common.mako +++ b/templates/webapps/galaxy/requests/common/common.mako @@ -694,11 +694,11 @@ <td> %if is_admin: <span class="expandLink dataset-${dataset}-click"><span class="rowIcon"></span> - <div style="float: left; margin-left: 2px;" class="menubutton split popup" id="dataset-${dataset.id}-popup"> + <div style="float: left; margin-left: 2px;" class="menubutton split popup" id="dataset-${ trans.security.encode_id( dataset.id ) }-popup"><a class="dataset-${encoded_id}-click" href="${h.url_for( controller='requests_admin', action='manage_datasets', operation='view', id=trans.security.encode_id( dataset.id ) )}">${dataset.name | h}</a></div></span> - <div popupmenu="dataset-${dataset.id}-popup"> + <div popupmenu="dataset-${ trans.security.encode_id( dataset.id ) }-popup"> %if can_transfer_datasets and dataset in sample.untransferred_dataset_files: <li><a class="action-button" href="${h.url_for( controller='requests_admin', action='initiate_data_transfer', sample_id=trans.security.encode_id( sample.id ), sample_dataset_id=trans.security.encode_id( dataset.id ) )}">Transfer</a></li> %endif https://bitbucket.org/galaxy/galaxy-central/commits/81e7210a53c0/ Changeset: 81e7210a53c0 Branch: stable User: martenson Date: 2014-12-08 21:27:18+00:00 Summary: typo in escaping Affected #: 1 file diff -r 7dad1a27eda301e019d143ef1fefed73036addd9 -r 81e7210a53c0ff8d650ea6040c09053c370600e6 templates/webapps/galaxy/library/common/browse_library.mako --- a/templates/webapps/galaxy/library/common/browse_library.mako +++ b/templates/webapps/galaxy/library/common/browse_library.mako @@ -376,7 +376,7 @@ </div></span> %if not library.deleted: - <div popupmenu="folder_img-${ 'F' + trans.security.encode_id( folder.id ) } | h}-popup"> + <div popupmenu="folder_img-${ 'F' + trans.security.encode_id( folder.id ) }-popup"> %if not branch_deleted( folder ) and can_add: <a class="action-button" href="${h.url_for( controller='library_common', action='upload_library_dataset', cntrller=cntrller, library_id=trans.security.encode_id( library.id ), folder_id=trans.security.encode_id( folder.id ), use_panels=use_panels, show_deleted=show_deleted )}">Add datasets</a><a class="action-button" href="${h.url_for( controller='library_common', action='create_folder', cntrller=cntrller, parent_id=trans.security.encode_id( folder.id ), library_id=trans.security.encode_id( library.id ), use_panels=use_panels, show_deleted=show_deleted )}">Add sub-folder</a> https://bitbucket.org/galaxy/galaxy-central/commits/3a4113a5bde8/ Changeset: 3a4113a5bde8 Branch: stable User: martenson Date: 2014-12-08 22:10:20+00:00 Summary: Merge Affected #: 5 files diff -r 782cf1a1f6b56f8a9c0b3e5e9ffd29fd93b16ce3 -r 3a4113a5bde8e7b7c0a26dcaf8f5242892c40dff templates/webapps/galaxy/library/common/browse_library.mako --- a/templates/webapps/galaxy/library/common/browse_library.mako +++ b/templates/webapps/galaxy/library/common/browse_library.mako @@ -238,7 +238,7 @@ %if parent is not None: parent="${parent | h}" %endif - id="libraryItem-${ldda.id | h}"> + id="libraryItem-${ trans.security.encode_id( ldda.id ) | h}"><td style="padding-left: ${pad+20}px;"><input style="float: left;" type="checkbox" name="ldda_ids" id="${trans.security.encode_id( ldda.id ) | h}" value="${trans.security.encode_id( ldda.id ) | h}" %if selected: @@ -248,7 +248,7 @@ %if simple: <label for="${trans.security.encode_id( ldda.id ) | h}">${ util.unicodify( ldda.name ) | h}</label> %else: - <div style="float: left; margin-left: 1px;" class="menubutton split popup" id="dataset-${ldda.id | h}-popup"> + <div style="float: left; margin-left: 1px;" class="menubutton split popup" id="dataset-${ trans.security.encode_id( ldda.id ) | h}-popup"><a class="view-info" href="${h.url_for( controller='library_common', action='ldda_info', cntrller=cntrller, library_id=trans.security.encode_id( library.id ), folder_id=trans.security.encode_id( folder.id ), id=trans.security.encode_id( ldda.id ), use_panels=use_panels, show_deleted=show_deleted )}"> %if ldda.library_dataset.deleted: <div class="libraryItem-error">${util.unicodify( ldda.name ) | h}</div> @@ -258,7 +258,7 @@ </a></div> %if not library.deleted: - <div popupmenu="dataset-${ldda.id | h}-popup"> + <div popupmenu="dataset-${ trans.security.encode_id( ldda.id ) | h}-popup"> %if not branch_deleted( folder ) and not ldda.library_dataset.deleted and can_modify: <a class="action-button" href="${h.url_for( controller='library_common', action='ldda_edit_info', cntrller=cntrller, library_id=trans.security.encode_id( library.id ), folder_id=trans.security.encode_id( folder.id ), id=trans.security.encode_id( ldda.id ), use_panels=use_panels, show_deleted=show_deleted )}">Edit information</a><a class="action-button" href="${h.url_for( controller='library_common', action='move_library_item', cntrller=cntrller, item_type='ldda', item_id=trans.security.encode_id( ldda.id ), source_library_id=trans.security.encode_id( library.id ), use_panels=use_panels, show_deleted=show_deleted )}">Move this dataset</a> @@ -364,7 +364,7 @@ <td style="padding-left: ${folder_pad | h}px;"><input type="checkbox" class="folderCheckbox"/><span class="expandLink folder-${encoded_id | h}-click"> - <div style="float: left; margin-left: 2px;" class="menubutton split popup" id="folder_img-${folder.id | h}-popup"> + <div style="float: left; margin-left: 2px;" class="menubutton split popup" id="folder_img-${ 'F' + trans.security.encode_id( folder.id ) }-popup"><a class="folder-${encoded_id | h}-click" href="javascript:void(0);"><span class="rowIcon"></span> %if folder.deleted: @@ -376,7 +376,7 @@ </div></span> %if not library.deleted: - <div popupmenu="folder_img-${folder.id | h}-popup"> + <div popupmenu="folder_img-${ 'F' + trans.security.encode_id( folder.id ) }-popup"> %if not branch_deleted( folder ) and can_add: <a class="action-button" href="${h.url_for( controller='library_common', action='upload_library_dataset', cntrller=cntrller, library_id=trans.security.encode_id( library.id ), folder_id=trans.security.encode_id( folder.id ), use_panels=use_panels, show_deleted=show_deleted )}">Add datasets</a><a class="action-button" href="${h.url_for( controller='library_common', action='create_folder', cntrller=cntrller, parent_id=trans.security.encode_id( folder.id ), library_id=trans.security.encode_id( library.id ), use_panels=use_panels, show_deleted=show_deleted )}">Add sub-folder</a> @@ -512,8 +512,8 @@ <li><a class="action-button" href="${h.url_for( controller='library_common', action='create_folder', cntrller=cntrller, parent_id=trans.security.encode_id( library.root_folder.id ), library_id=trans.security.encode_id( library.id ), use_panels=use_panels, show_deleted=show_deleted )}">Add folder</a></li> %endif %if ( ( not library.deleted ) and ( can_modify or can_manage ) ) or ( can_modify and not library.purged ) or ( library.purged ): - <li><a class="action-button" id="library-${library.id}-popup" class="menubutton">Library Actions</a></li> - <div popupmenu="library-${library.id}-popup"> + <li><a class="action-button" id="library-${ trans.security.encode_id( library.id ) }-popup" class="menubutton">Library Actions</a></li> + <div popupmenu="library-${ trans.security.encode_id( library.id ) }-popup"> %if not library.deleted: %if can_modify: <a class="action-button" href="${h.url_for( controller='library_common', action='library_info', cntrller=cntrller, id=trans.security.encode_id( library.id ), use_panels=use_panels, show_deleted=show_deleted )}">Edit information</a> diff -r 782cf1a1f6b56f8a9c0b3e5e9ffd29fd93b16ce3 -r 3a4113a5bde8e7b7c0a26dcaf8f5242892c40dff templates/webapps/galaxy/library/common/browse_library_opt.mako --- a/templates/webapps/galaxy/library/common/browse_library_opt.mako +++ b/templates/webapps/galaxy/library/common/browse_library_opt.mako @@ -230,9 +230,9 @@ %if parent is not None: parent="${parent | h}" %endif - id="libraryItem-${ldda.id | h}"> + id="libraryItem-${ trans.security.encode_id( ldda.id ) | h }"><td style="padding-left: ${pad+20}px;"> - <input style="float: left;" type="checkbox" name="ldda_ids" id="${trans.security.encode_id( ldda.id ) | h}" value="${trans.security.encode_id( ldda.id ) | h}" + <input style="float: left;" type="checkbox" name="ldda_ids" id="${trans.security.encode_id( ldda.id ) | h}" value="${ trans.security.encode_id( ldda.id ) | h }" %if selected: checked="checked" %endif @@ -240,7 +240,7 @@ %if simple: <label for="${trans.security.encode_id( ldda.id ) | h}">${ util.unicodify( ldda.name ) | h}</label> %else: - <div style="float: left; margin-left: 1px;" class="menubutton split popup" id="dataset-${ldda.id | h}-popup"> + <div style="float: left; margin-left: 1px;" class="menubutton split popup" id="dataset-${ trans.security.encode_id( ldda.id ) | h }-popup"><a class="view-info" href="${h.url_for( controller='library_common', action='ldda_info', cntrller=cntrller, library_id=trans.security.encode_id( library.id ), folder_id=trans.security.encode_id( folder.id ), id=trans.security.encode_id( ldda.id ), use_panels=use_panels, show_deleted=show_deleted )}"> %if ldda.library_dataset.deleted: <div class="libraryItem-error">${util.unicodify( ldda.name ) | h}</div> @@ -250,7 +250,7 @@ </a></div> %if not library.deleted: - <div popupmenu="dataset-${ldda.id | h}-popup"> + <div popupmenu="dataset-${ trans.security.encode_id( ldda.id ) | h }-popup"> %if not branch_deleted( folder ) and not ldda.library_dataset.deleted and can_modify: <a class="action-button" href="${h.url_for( controller='library_common', action='ldda_edit_info', cntrller=cntrller, library_id=trans.security.encode_id( library.id ), folder_id=trans.security.encode_id( folder.id ), id=trans.security.encode_id( ldda.id ), use_panels=use_panels, show_deleted=show_deleted )}">Edit information</a><a class="action-button" href="${h.url_for( controller='library_common', action='move_library_item', cntrller=cntrller, item_type='ldda', item_id=trans.security.encode_id( ldda.id ), source_library_id=trans.security.encode_id( library.id ), use_panels=use_panels, show_deleted=show_deleted )}">Move this dataset</a> @@ -371,7 +371,7 @@ <td style="padding-left: ${folder_pad | h}px;"><input type="checkbox" class="folderCheckbox"/><span class="expandLink folder-${encoded_id | h}-click"> - <div style="float: left; margin-left: 2px;" class="menubutton split popup" id="folder_img-${folder.id | h}-popup"> + <div style="float: left; margin-left: 2px;" class="menubutton split popup" id="folder_img-${ 'F' + trans.security.encode_id( folder.id ) }-popup"><a class="folder-${encoded_id | h}-click" href="javascript:void(0);"><span class="rowIcon"></span> %if folder.deleted: @@ -383,7 +383,7 @@ </div></span> %if not library.deleted: - <div popupmenu="folder_img-${folder.id | h}-popup"> + <div popupmenu="folder_img-${ 'F' + trans.security.encode_id( folder.id ) }-popup"> %if not branch_deleted( folder ) and can_add: <a class="action-button" href="${h.url_for( controller='library_common', action='upload_library_dataset', cntrller=cntrller, library_id=trans.security.encode_id( library.id ), folder_id=trans.security.encode_id( folder.id ), use_panels=use_panels, show_deleted=show_deleted )}">Add datasets</a><a class="action-button" href="${h.url_for( controller='library_common', action='create_folder', cntrller=cntrller, parent_id=trans.security.encode_id( folder.id ), library_id=trans.security.encode_id( library.id ), use_panels=use_panels, show_deleted=show_deleted )}">Add sub-folder</a> @@ -515,8 +515,8 @@ <li><a class="action-button" href="${h.url_for( controller='library_common', action='create_folder', cntrller=cntrller, parent_id=trans.security.encode_id( library.root_folder.id ), library_id=trans.security.encode_id( library.id ), use_panels=use_panels, show_deleted=show_deleted )}">Add folder</a></li> %endif %if ( ( not library.deleted ) and ( can_modify or can_manage ) ) or ( can_modify and not library.purged ) or ( library.purged ): - <li><a class="action-button" id="library-${library.id | h}-popup" class="menubutton">Library Actions</a></li> - <div popupmenu="library-${library.id | h}-popup"> + <li><a class="action-button" id="library-${ trans.security.encode_id( library.id ) | h}-popup" class="menubutton">Library Actions</a></li> + <div popupmenu="library-${ trans.security.encode_id( library.id ) | h}-popup"> %if not library.deleted: %if can_modify: <a class="action-button" href="${h.url_for( controller='library_common', action='library_info', cntrller=cntrller, id=trans.security.encode_id( library.id ), use_panels=use_panels, show_deleted=show_deleted )}">Edit information</a> diff -r 782cf1a1f6b56f8a9c0b3e5e9ffd29fd93b16ce3 -r 3a4113a5bde8e7b7c0a26dcaf8f5242892c40dff templates/webapps/galaxy/library/common/ldda_info.mako --- a/templates/webapps/galaxy/library/common/ldda_info.mako +++ b/templates/webapps/galaxy/library/common/ldda_info.mako @@ -47,9 +47,9 @@ <div class="toolForm"><div class="toolFormTitle"> - Information about <div class="menubutton popup" id="dataset-${ldda.id | h}-popup">${util.unicodify( ldda.name ) | h}</div> + Information about <div class="menubutton popup" id="dataset-${ trans.security.encode_id( ldda.id ) | h}-popup">${util.unicodify( ldda.name ) | h}</div> %if not library.deleted and not branch_deleted( ldda.library_dataset.folder ) and not ldda.library_dataset.deleted: - <div popupmenu="dataset-${ldda.id | h}-popup"> + <div popupmenu="dataset-${ trans.security.encode_id( ldda.id ) | h}-popup"> %if can_modify: <a class="action-button" href="${h.url_for( controller='library_common', action='ldda_edit_info', cntrller=cntrller, library_id=trans.security.encode_id( library.id ), folder_id=trans.security.encode_id( ldda.library_dataset.folder.id ), id=trans.security.encode_id( ldda.id ), use_panels=use_panels, show_deleted=show_deleted )}">Edit information</a> %if not info_association: @@ -168,9 +168,9 @@ %endfor %if ldda.peek != "no peek": <div class="form-row"> - <div id="info${ldda.id | h}" class="historyItemBody"> + <div id="info${ trans.security.encode_id( ldda.id ) | h}" class="historyItemBody"><label>Peek:</label> - <div><pre id="peek${ldda.id | h}" class="peek">${util.unicodify( ldda.display_peek() )}</pre></div> + <div><pre id="peek${ trans.security.encode_id( ldda.id ) | h}" class="peek">${util.unicodify( ldda.display_peek() )}</pre></div></div></div> %endif diff -r 782cf1a1f6b56f8a9c0b3e5e9ffd29fd93b16ce3 -r 3a4113a5bde8e7b7c0a26dcaf8f5242892c40dff templates/webapps/galaxy/library/common/library_info.mako --- a/templates/webapps/galaxy/library/common/library_info.mako +++ b/templates/webapps/galaxy/library/common/library_info.mako @@ -34,11 +34,11 @@ <div class="toolForm"><div class="toolFormTitle"> - <div class="menubutton split popup" id="library-${library.id}-popup"> + <div class="menubutton split popup" id="library-${trans.security.encode_id( library.id ) | h }-popup"><a href="${h.url_for( controller='library_common', action='browse_library', cntrller=cntrller, id=trans.security.encode_id( library.id ), use_panels=use_panels, show_deleted=show_deleted )}">${library.name[:50] | h}</a></div> %if can_add or can_modify or can_manage: - <div popupmenu="library-${library.id | h}-popup"> + <div popupmenu="library-${ trans.security.encode_id( library.id ) | h }-popup"> %if not library.deleted: %if can_add and not library.info_association: <a class="action-button" href="${h.url_for( controller='library_common', action='add_template', cntrller=cntrller, item_type='library', form_type=trans.model.FormDefinition.types.LIBRARY_INFO_TEMPLATE, library_id=trans.security.encode_id( library.id ), use_panels=use_panels, show_deleted=show_deleted )}">Use template</a> diff -r 782cf1a1f6b56f8a9c0b3e5e9ffd29fd93b16ce3 -r 3a4113a5bde8e7b7c0a26dcaf8f5242892c40dff templates/webapps/galaxy/requests/common/common.mako --- a/templates/webapps/galaxy/requests/common/common.mako +++ b/templates/webapps/galaxy/requests/common/common.mako @@ -694,11 +694,11 @@ <td> %if is_admin: <span class="expandLink dataset-${dataset}-click"><span class="rowIcon"></span> - <div style="float: left; margin-left: 2px;" class="menubutton split popup" id="dataset-${dataset.id}-popup"> + <div style="float: left; margin-left: 2px;" class="menubutton split popup" id="dataset-${ trans.security.encode_id( dataset.id ) }-popup"><a class="dataset-${encoded_id}-click" href="${h.url_for( controller='requests_admin', action='manage_datasets', operation='view', id=trans.security.encode_id( dataset.id ) )}">${dataset.name | h}</a></div></span> - <div popupmenu="dataset-${dataset.id}-popup"> + <div popupmenu="dataset-${ trans.security.encode_id( dataset.id ) }-popup"> %if can_transfer_datasets and dataset in sample.untransferred_dataset_files: <li><a class="action-button" href="${h.url_for( controller='requests_admin', action='initiate_data_transfer', sample_id=trans.security.encode_id( sample.id ), sample_dataset_id=trans.security.encode_id( dataset.id ) )}">Transfer</a></li> %endif https://bitbucket.org/galaxy/galaxy-central/commits/2954ae5e46f5/ Changeset: 2954ae5e46f5 Branch: stable User: martenson Date: 2014-12-09 18:41:41+00:00 Summary: Merge Affected #: 5 files diff -r 3e7adbbe91a06d30a96e7a7101707e040376aba1 -r 2954ae5e46f59b11193b69ebcb0415c73dcda06b templates/webapps/galaxy/library/common/browse_library.mako --- a/templates/webapps/galaxy/library/common/browse_library.mako +++ b/templates/webapps/galaxy/library/common/browse_library.mako @@ -238,7 +238,7 @@ %if parent is not None: parent="${parent | h}" %endif - id="libraryItem-${ldda.id | h}"> + id="libraryItem-${ trans.security.encode_id( ldda.id ) | h}"><td style="padding-left: ${pad+20}px;"><input style="float: left;" type="checkbox" name="ldda_ids" id="${trans.security.encode_id( ldda.id ) | h}" value="${trans.security.encode_id( ldda.id ) | h}" %if selected: @@ -248,7 +248,7 @@ %if simple: <label for="${trans.security.encode_id( ldda.id ) | h}">${ util.unicodify( ldda.name ) | h}</label> %else: - <div style="float: left; margin-left: 1px;" class="menubutton split popup" id="dataset-${ldda.id | h}-popup"> + <div style="float: left; margin-left: 1px;" class="menubutton split popup" id="dataset-${ trans.security.encode_id( ldda.id ) | h}-popup"><a class="view-info" href="${h.url_for( controller='library_common', action='ldda_info', cntrller=cntrller, library_id=trans.security.encode_id( library.id ), folder_id=trans.security.encode_id( folder.id ), id=trans.security.encode_id( ldda.id ), use_panels=use_panels, show_deleted=show_deleted )}"> %if ldda.library_dataset.deleted: <div class="libraryItem-error">${util.unicodify( ldda.name ) | h}</div> @@ -258,7 +258,7 @@ </a></div> %if not library.deleted: - <div popupmenu="dataset-${ldda.id | h}-popup"> + <div popupmenu="dataset-${ trans.security.encode_id( ldda.id ) | h}-popup"> %if not branch_deleted( folder ) and not ldda.library_dataset.deleted and can_modify: <a class="action-button" href="${h.url_for( controller='library_common', action='ldda_edit_info', cntrller=cntrller, library_id=trans.security.encode_id( library.id ), folder_id=trans.security.encode_id( folder.id ), id=trans.security.encode_id( ldda.id ), use_panels=use_panels, show_deleted=show_deleted )}">Edit information</a><a class="action-button" href="${h.url_for( controller='library_common', action='move_library_item', cntrller=cntrller, item_type='ldda', item_id=trans.security.encode_id( ldda.id ), source_library_id=trans.security.encode_id( library.id ), use_panels=use_panels, show_deleted=show_deleted )}">Move this dataset</a> @@ -364,7 +364,7 @@ <td style="padding-left: ${folder_pad | h}px;"><input type="checkbox" class="folderCheckbox"/><span class="expandLink folder-${encoded_id | h}-click"> - <div style="float: left; margin-left: 2px;" class="menubutton split popup" id="folder_img-${folder.id | h}-popup"> + <div style="float: left; margin-left: 2px;" class="menubutton split popup" id="folder_img-${ 'F' + trans.security.encode_id( folder.id ) }-popup"><a class="folder-${encoded_id | h}-click" href="javascript:void(0);"><span class="rowIcon"></span> %if folder.deleted: @@ -376,7 +376,7 @@ </div></span> %if not library.deleted: - <div popupmenu="folder_img-${folder.id | h}-popup"> + <div popupmenu="folder_img-${ 'F' + trans.security.encode_id( folder.id ) }-popup"> %if not branch_deleted( folder ) and can_add: <a class="action-button" href="${h.url_for( controller='library_common', action='upload_library_dataset', cntrller=cntrller, library_id=trans.security.encode_id( library.id ), folder_id=trans.security.encode_id( folder.id ), use_panels=use_panels, show_deleted=show_deleted )}">Add datasets</a><a class="action-button" href="${h.url_for( controller='library_common', action='create_folder', cntrller=cntrller, parent_id=trans.security.encode_id( folder.id ), library_id=trans.security.encode_id( library.id ), use_panels=use_panels, show_deleted=show_deleted )}">Add sub-folder</a> @@ -512,8 +512,8 @@ <li><a class="action-button" href="${h.url_for( controller='library_common', action='create_folder', cntrller=cntrller, parent_id=trans.security.encode_id( library.root_folder.id ), library_id=trans.security.encode_id( library.id ), use_panels=use_panels, show_deleted=show_deleted )}">Add folder</a></li> %endif %if ( ( not library.deleted ) and ( can_modify or can_manage ) ) or ( can_modify and not library.purged ) or ( library.purged ): - <li><a class="action-button" id="library-${library.id}-popup" class="menubutton">Library Actions</a></li> - <div popupmenu="library-${library.id}-popup"> + <li><a class="action-button" id="library-${ trans.security.encode_id( library.id ) }-popup" class="menubutton">Library Actions</a></li> + <div popupmenu="library-${ trans.security.encode_id( library.id ) }-popup"> %if not library.deleted: %if can_modify: <a class="action-button" href="${h.url_for( controller='library_common', action='library_info', cntrller=cntrller, id=trans.security.encode_id( library.id ), use_panels=use_panels, show_deleted=show_deleted )}">Edit information</a> diff -r 3e7adbbe91a06d30a96e7a7101707e040376aba1 -r 2954ae5e46f59b11193b69ebcb0415c73dcda06b templates/webapps/galaxy/library/common/browse_library_opt.mako --- a/templates/webapps/galaxy/library/common/browse_library_opt.mako +++ b/templates/webapps/galaxy/library/common/browse_library_opt.mako @@ -230,9 +230,9 @@ %if parent is not None: parent="${parent | h}" %endif - id="libraryItem-${ldda.id | h}"> + id="libraryItem-${ trans.security.encode_id( ldda.id ) | h }"><td style="padding-left: ${pad+20}px;"> - <input style="float: left;" type="checkbox" name="ldda_ids" id="${trans.security.encode_id( ldda.id ) | h}" value="${trans.security.encode_id( ldda.id ) | h}" + <input style="float: left;" type="checkbox" name="ldda_ids" id="${trans.security.encode_id( ldda.id ) | h}" value="${ trans.security.encode_id( ldda.id ) | h }" %if selected: checked="checked" %endif @@ -240,7 +240,7 @@ %if simple: <label for="${trans.security.encode_id( ldda.id ) | h}">${ util.unicodify( ldda.name ) | h}</label> %else: - <div style="float: left; margin-left: 1px;" class="menubutton split popup" id="dataset-${ldda.id | h}-popup"> + <div style="float: left; margin-left: 1px;" class="menubutton split popup" id="dataset-${ trans.security.encode_id( ldda.id ) | h }-popup"><a class="view-info" href="${h.url_for( controller='library_common', action='ldda_info', cntrller=cntrller, library_id=trans.security.encode_id( library.id ), folder_id=trans.security.encode_id( folder.id ), id=trans.security.encode_id( ldda.id ), use_panels=use_panels, show_deleted=show_deleted )}"> %if ldda.library_dataset.deleted: <div class="libraryItem-error">${util.unicodify( ldda.name ) | h}</div> @@ -250,7 +250,7 @@ </a></div> %if not library.deleted: - <div popupmenu="dataset-${ldda.id | h}-popup"> + <div popupmenu="dataset-${ trans.security.encode_id( ldda.id ) | h }-popup"> %if not branch_deleted( folder ) and not ldda.library_dataset.deleted and can_modify: <a class="action-button" href="${h.url_for( controller='library_common', action='ldda_edit_info', cntrller=cntrller, library_id=trans.security.encode_id( library.id ), folder_id=trans.security.encode_id( folder.id ), id=trans.security.encode_id( ldda.id ), use_panels=use_panels, show_deleted=show_deleted )}">Edit information</a><a class="action-button" href="${h.url_for( controller='library_common', action='move_library_item', cntrller=cntrller, item_type='ldda', item_id=trans.security.encode_id( ldda.id ), source_library_id=trans.security.encode_id( library.id ), use_panels=use_panels, show_deleted=show_deleted )}">Move this dataset</a> @@ -371,7 +371,7 @@ <td style="padding-left: ${folder_pad | h}px;"><input type="checkbox" class="folderCheckbox"/><span class="expandLink folder-${encoded_id | h}-click"> - <div style="float: left; margin-left: 2px;" class="menubutton split popup" id="folder_img-${folder.id | h}-popup"> + <div style="float: left; margin-left: 2px;" class="menubutton split popup" id="folder_img-${ 'F' + trans.security.encode_id( folder.id ) }-popup"><a class="folder-${encoded_id | h}-click" href="javascript:void(0);"><span class="rowIcon"></span> %if folder.deleted: @@ -383,7 +383,7 @@ </div></span> %if not library.deleted: - <div popupmenu="folder_img-${folder.id | h}-popup"> + <div popupmenu="folder_img-${ 'F' + trans.security.encode_id( folder.id ) }-popup"> %if not branch_deleted( folder ) and can_add: <a class="action-button" href="${h.url_for( controller='library_common', action='upload_library_dataset', cntrller=cntrller, library_id=trans.security.encode_id( library.id ), folder_id=trans.security.encode_id( folder.id ), use_panels=use_panels, show_deleted=show_deleted )}">Add datasets</a><a class="action-button" href="${h.url_for( controller='library_common', action='create_folder', cntrller=cntrller, parent_id=trans.security.encode_id( folder.id ), library_id=trans.security.encode_id( library.id ), use_panels=use_panels, show_deleted=show_deleted )}">Add sub-folder</a> @@ -515,8 +515,8 @@ <li><a class="action-button" href="${h.url_for( controller='library_common', action='create_folder', cntrller=cntrller, parent_id=trans.security.encode_id( library.root_folder.id ), library_id=trans.security.encode_id( library.id ), use_panels=use_panels, show_deleted=show_deleted )}">Add folder</a></li> %endif %if ( ( not library.deleted ) and ( can_modify or can_manage ) ) or ( can_modify and not library.purged ) or ( library.purged ): - <li><a class="action-button" id="library-${library.id | h}-popup" class="menubutton">Library Actions</a></li> - <div popupmenu="library-${library.id | h}-popup"> + <li><a class="action-button" id="library-${ trans.security.encode_id( library.id ) | h}-popup" class="menubutton">Library Actions</a></li> + <div popupmenu="library-${ trans.security.encode_id( library.id ) | h}-popup"> %if not library.deleted: %if can_modify: <a class="action-button" href="${h.url_for( controller='library_common', action='library_info', cntrller=cntrller, id=trans.security.encode_id( library.id ), use_panels=use_panels, show_deleted=show_deleted )}">Edit information</a> diff -r 3e7adbbe91a06d30a96e7a7101707e040376aba1 -r 2954ae5e46f59b11193b69ebcb0415c73dcda06b templates/webapps/galaxy/library/common/ldda_info.mako --- a/templates/webapps/galaxy/library/common/ldda_info.mako +++ b/templates/webapps/galaxy/library/common/ldda_info.mako @@ -47,9 +47,9 @@ <div class="toolForm"><div class="toolFormTitle"> - Information about <div class="menubutton popup" id="dataset-${ldda.id | h}-popup">${util.unicodify( ldda.name ) | h}</div> + Information about <div class="menubutton popup" id="dataset-${ trans.security.encode_id( ldda.id ) | h}-popup">${util.unicodify( ldda.name ) | h}</div> %if not library.deleted and not branch_deleted( ldda.library_dataset.folder ) and not ldda.library_dataset.deleted: - <div popupmenu="dataset-${ldda.id | h}-popup"> + <div popupmenu="dataset-${ trans.security.encode_id( ldda.id ) | h}-popup"> %if can_modify: <a class="action-button" href="${h.url_for( controller='library_common', action='ldda_edit_info', cntrller=cntrller, library_id=trans.security.encode_id( library.id ), folder_id=trans.security.encode_id( ldda.library_dataset.folder.id ), id=trans.security.encode_id( ldda.id ), use_panels=use_panels, show_deleted=show_deleted )}">Edit information</a> %if not info_association: @@ -168,9 +168,9 @@ %endfor %if ldda.peek != "no peek": <div class="form-row"> - <div id="info${ldda.id | h}" class="historyItemBody"> + <div id="info${ trans.security.encode_id( ldda.id ) | h}" class="historyItemBody"><label>Peek:</label> - <div><pre id="peek${ldda.id | h}" class="peek">${util.unicodify( ldda.display_peek() )}</pre></div> + <div><pre id="peek${ trans.security.encode_id( ldda.id ) | h}" class="peek">${util.unicodify( ldda.display_peek() )}</pre></div></div></div> %endif diff -r 3e7adbbe91a06d30a96e7a7101707e040376aba1 -r 2954ae5e46f59b11193b69ebcb0415c73dcda06b templates/webapps/galaxy/library/common/library_info.mako --- a/templates/webapps/galaxy/library/common/library_info.mako +++ b/templates/webapps/galaxy/library/common/library_info.mako @@ -34,11 +34,11 @@ <div class="toolForm"><div class="toolFormTitle"> - <div class="menubutton split popup" id="library-${library.id}-popup"> + <div class="menubutton split popup" id="library-${trans.security.encode_id( library.id ) | h }-popup"><a href="${h.url_for( controller='library_common', action='browse_library', cntrller=cntrller, id=trans.security.encode_id( library.id ), use_panels=use_panels, show_deleted=show_deleted )}">${library.name[:50] | h}</a></div> %if can_add or can_modify or can_manage: - <div popupmenu="library-${library.id | h}-popup"> + <div popupmenu="library-${ trans.security.encode_id( library.id ) | h }-popup"> %if not library.deleted: %if can_add and not library.info_association: <a class="action-button" href="${h.url_for( controller='library_common', action='add_template', cntrller=cntrller, item_type='library', form_type=trans.model.FormDefinition.types.LIBRARY_INFO_TEMPLATE, library_id=trans.security.encode_id( library.id ), use_panels=use_panels, show_deleted=show_deleted )}">Use template</a> diff -r 3e7adbbe91a06d30a96e7a7101707e040376aba1 -r 2954ae5e46f59b11193b69ebcb0415c73dcda06b templates/webapps/galaxy/requests/common/common.mako --- a/templates/webapps/galaxy/requests/common/common.mako +++ b/templates/webapps/galaxy/requests/common/common.mako @@ -694,11 +694,11 @@ <td> %if is_admin: <span class="expandLink dataset-${dataset}-click"><span class="rowIcon"></span> - <div style="float: left; margin-left: 2px;" class="menubutton split popup" id="dataset-${dataset.id}-popup"> + <div style="float: left; margin-left: 2px;" class="menubutton split popup" id="dataset-${ trans.security.encode_id( dataset.id ) }-popup"><a class="dataset-${encoded_id}-click" href="${h.url_for( controller='requests_admin', action='manage_datasets', operation='view', id=trans.security.encode_id( dataset.id ) )}">${dataset.name | h}</a></div></span> - <div popupmenu="dataset-${dataset.id}-popup"> + <div popupmenu="dataset-${ trans.security.encode_id( dataset.id ) }-popup"> %if can_transfer_datasets and dataset in sample.untransferred_dataset_files: <li><a class="action-button" href="${h.url_for( controller='requests_admin', action='initiate_data_transfer', sample_id=trans.security.encode_id( sample.id ), sample_dataset_id=trans.security.encode_id( dataset.id ) )}">Transfer</a></li> %endif https://bitbucket.org/galaxy/galaxy-central/commits/0a1379bb7f1e/ Changeset: 0a1379bb7f1e Branch: stable User: martenson Date: 2014-12-10 23:28:45+00:00 Summary: Merge Affected #: 5 files diff -r 2db0fb9594d6c315e4e0a4be70f64373cfc708f6 -r 0a1379bb7f1e1664a76da1c321584e3bbd2842cd templates/webapps/galaxy/library/common/browse_library.mako --- a/templates/webapps/galaxy/library/common/browse_library.mako +++ b/templates/webapps/galaxy/library/common/browse_library.mako @@ -238,7 +238,7 @@ %if parent is not None: parent="${parent | h}" %endif - id="libraryItem-${ldda.id | h}"> + id="libraryItem-${ trans.security.encode_id( ldda.id ) | h}"><td style="padding-left: ${pad+20}px;"><input style="float: left;" type="checkbox" name="ldda_ids" id="${trans.security.encode_id( ldda.id ) | h}" value="${trans.security.encode_id( ldda.id ) | h}" %if selected: @@ -248,7 +248,7 @@ %if simple: <label for="${trans.security.encode_id( ldda.id ) | h}">${ util.unicodify( ldda.name ) | h}</label> %else: - <div style="float: left; margin-left: 1px;" class="menubutton split popup" id="dataset-${ldda.id | h}-popup"> + <div style="float: left; margin-left: 1px;" class="menubutton split popup" id="dataset-${ trans.security.encode_id( ldda.id ) | h}-popup"><a class="view-info" href="${h.url_for( controller='library_common', action='ldda_info', cntrller=cntrller, library_id=trans.security.encode_id( library.id ), folder_id=trans.security.encode_id( folder.id ), id=trans.security.encode_id( ldda.id ), use_panels=use_panels, show_deleted=show_deleted )}"> %if ldda.library_dataset.deleted: <div class="libraryItem-error">${util.unicodify( ldda.name ) | h}</div> @@ -258,7 +258,7 @@ </a></div> %if not library.deleted: - <div popupmenu="dataset-${ldda.id | h}-popup"> + <div popupmenu="dataset-${ trans.security.encode_id( ldda.id ) | h}-popup"> %if not branch_deleted( folder ) and not ldda.library_dataset.deleted and can_modify: <a class="action-button" href="${h.url_for( controller='library_common', action='ldda_edit_info', cntrller=cntrller, library_id=trans.security.encode_id( library.id ), folder_id=trans.security.encode_id( folder.id ), id=trans.security.encode_id( ldda.id ), use_panels=use_panels, show_deleted=show_deleted )}">Edit information</a><a class="action-button" href="${h.url_for( controller='library_common', action='move_library_item', cntrller=cntrller, item_type='ldda', item_id=trans.security.encode_id( ldda.id ), source_library_id=trans.security.encode_id( library.id ), use_panels=use_panels, show_deleted=show_deleted )}">Move this dataset</a> @@ -364,7 +364,7 @@ <td style="padding-left: ${folder_pad | h}px;"><input type="checkbox" class="folderCheckbox"/><span class="expandLink folder-${encoded_id | h}-click"> - <div style="float: left; margin-left: 2px;" class="menubutton split popup" id="folder_img-${folder.id | h}-popup"> + <div style="float: left; margin-left: 2px;" class="menubutton split popup" id="folder_img-${ 'F' + trans.security.encode_id( folder.id ) }-popup"><a class="folder-${encoded_id | h}-click" href="javascript:void(0);"><span class="rowIcon"></span> %if folder.deleted: @@ -376,7 +376,7 @@ </div></span> %if not library.deleted: - <div popupmenu="folder_img-${folder.id | h}-popup"> + <div popupmenu="folder_img-${ 'F' + trans.security.encode_id( folder.id ) }-popup"> %if not branch_deleted( folder ) and can_add: <a class="action-button" href="${h.url_for( controller='library_common', action='upload_library_dataset', cntrller=cntrller, library_id=trans.security.encode_id( library.id ), folder_id=trans.security.encode_id( folder.id ), use_panels=use_panels, show_deleted=show_deleted )}">Add datasets</a><a class="action-button" href="${h.url_for( controller='library_common', action='create_folder', cntrller=cntrller, parent_id=trans.security.encode_id( folder.id ), library_id=trans.security.encode_id( library.id ), use_panels=use_panels, show_deleted=show_deleted )}">Add sub-folder</a> @@ -512,8 +512,8 @@ <li><a class="action-button" href="${h.url_for( controller='library_common', action='create_folder', cntrller=cntrller, parent_id=trans.security.encode_id( library.root_folder.id ), library_id=trans.security.encode_id( library.id ), use_panels=use_panels, show_deleted=show_deleted )}">Add folder</a></li> %endif %if ( ( not library.deleted ) and ( can_modify or can_manage ) ) or ( can_modify and not library.purged ) or ( library.purged ): - <li><a class="action-button" id="library-${library.id}-popup" class="menubutton">Library Actions</a></li> - <div popupmenu="library-${library.id}-popup"> + <li><a class="action-button" id="library-${ trans.security.encode_id( library.id ) }-popup" class="menubutton">Library Actions</a></li> + <div popupmenu="library-${ trans.security.encode_id( library.id ) }-popup"> %if not library.deleted: %if can_modify: <a class="action-button" href="${h.url_for( controller='library_common', action='library_info', cntrller=cntrller, id=trans.security.encode_id( library.id ), use_panels=use_panels, show_deleted=show_deleted )}">Edit information</a> diff -r 2db0fb9594d6c315e4e0a4be70f64373cfc708f6 -r 0a1379bb7f1e1664a76da1c321584e3bbd2842cd templates/webapps/galaxy/library/common/browse_library_opt.mako --- a/templates/webapps/galaxy/library/common/browse_library_opt.mako +++ b/templates/webapps/galaxy/library/common/browse_library_opt.mako @@ -230,9 +230,9 @@ %if parent is not None: parent="${parent | h}" %endif - id="libraryItem-${ldda.id | h}"> + id="libraryItem-${ trans.security.encode_id( ldda.id ) | h }"><td style="padding-left: ${pad+20}px;"> - <input style="float: left;" type="checkbox" name="ldda_ids" id="${trans.security.encode_id( ldda.id ) | h}" value="${trans.security.encode_id( ldda.id ) | h}" + <input style="float: left;" type="checkbox" name="ldda_ids" id="${trans.security.encode_id( ldda.id ) | h}" value="${ trans.security.encode_id( ldda.id ) | h }" %if selected: checked="checked" %endif @@ -240,7 +240,7 @@ %if simple: <label for="${trans.security.encode_id( ldda.id ) | h}">${ util.unicodify( ldda.name ) | h}</label> %else: - <div style="float: left; margin-left: 1px;" class="menubutton split popup" id="dataset-${ldda.id | h}-popup"> + <div style="float: left; margin-left: 1px;" class="menubutton split popup" id="dataset-${ trans.security.encode_id( ldda.id ) | h }-popup"><a class="view-info" href="${h.url_for( controller='library_common', action='ldda_info', cntrller=cntrller, library_id=trans.security.encode_id( library.id ), folder_id=trans.security.encode_id( folder.id ), id=trans.security.encode_id( ldda.id ), use_panels=use_panels, show_deleted=show_deleted )}"> %if ldda.library_dataset.deleted: <div class="libraryItem-error">${util.unicodify( ldda.name ) | h}</div> @@ -250,7 +250,7 @@ </a></div> %if not library.deleted: - <div popupmenu="dataset-${ldda.id | h}-popup"> + <div popupmenu="dataset-${ trans.security.encode_id( ldda.id ) | h }-popup"> %if not branch_deleted( folder ) and not ldda.library_dataset.deleted and can_modify: <a class="action-button" href="${h.url_for( controller='library_common', action='ldda_edit_info', cntrller=cntrller, library_id=trans.security.encode_id( library.id ), folder_id=trans.security.encode_id( folder.id ), id=trans.security.encode_id( ldda.id ), use_panels=use_panels, show_deleted=show_deleted )}">Edit information</a><a class="action-button" href="${h.url_for( controller='library_common', action='move_library_item', cntrller=cntrller, item_type='ldda', item_id=trans.security.encode_id( ldda.id ), source_library_id=trans.security.encode_id( library.id ), use_panels=use_panels, show_deleted=show_deleted )}">Move this dataset</a> @@ -371,7 +371,7 @@ <td style="padding-left: ${folder_pad | h}px;"><input type="checkbox" class="folderCheckbox"/><span class="expandLink folder-${encoded_id | h}-click"> - <div style="float: left; margin-left: 2px;" class="menubutton split popup" id="folder_img-${folder.id | h}-popup"> + <div style="float: left; margin-left: 2px;" class="menubutton split popup" id="folder_img-${ 'F' + trans.security.encode_id( folder.id ) }-popup"><a class="folder-${encoded_id | h}-click" href="javascript:void(0);"><span class="rowIcon"></span> %if folder.deleted: @@ -383,7 +383,7 @@ </div></span> %if not library.deleted: - <div popupmenu="folder_img-${folder.id | h}-popup"> + <div popupmenu="folder_img-${ 'F' + trans.security.encode_id( folder.id ) }-popup"> %if not branch_deleted( folder ) and can_add: <a class="action-button" href="${h.url_for( controller='library_common', action='upload_library_dataset', cntrller=cntrller, library_id=trans.security.encode_id( library.id ), folder_id=trans.security.encode_id( folder.id ), use_panels=use_panels, show_deleted=show_deleted )}">Add datasets</a><a class="action-button" href="${h.url_for( controller='library_common', action='create_folder', cntrller=cntrller, parent_id=trans.security.encode_id( folder.id ), library_id=trans.security.encode_id( library.id ), use_panels=use_panels, show_deleted=show_deleted )}">Add sub-folder</a> @@ -515,8 +515,8 @@ <li><a class="action-button" href="${h.url_for( controller='library_common', action='create_folder', cntrller=cntrller, parent_id=trans.security.encode_id( library.root_folder.id ), library_id=trans.security.encode_id( library.id ), use_panels=use_panels, show_deleted=show_deleted )}">Add folder</a></li> %endif %if ( ( not library.deleted ) and ( can_modify or can_manage ) ) or ( can_modify and not library.purged ) or ( library.purged ): - <li><a class="action-button" id="library-${library.id | h}-popup" class="menubutton">Library Actions</a></li> - <div popupmenu="library-${library.id | h}-popup"> + <li><a class="action-button" id="library-${ trans.security.encode_id( library.id ) | h}-popup" class="menubutton">Library Actions</a></li> + <div popupmenu="library-${ trans.security.encode_id( library.id ) | h}-popup"> %if not library.deleted: %if can_modify: <a class="action-button" href="${h.url_for( controller='library_common', action='library_info', cntrller=cntrller, id=trans.security.encode_id( library.id ), use_panels=use_panels, show_deleted=show_deleted )}">Edit information</a> diff -r 2db0fb9594d6c315e4e0a4be70f64373cfc708f6 -r 0a1379bb7f1e1664a76da1c321584e3bbd2842cd templates/webapps/galaxy/library/common/ldda_info.mako --- a/templates/webapps/galaxy/library/common/ldda_info.mako +++ b/templates/webapps/galaxy/library/common/ldda_info.mako @@ -47,9 +47,9 @@ <div class="toolForm"><div class="toolFormTitle"> - Information about <div class="menubutton popup" id="dataset-${ldda.id | h}-popup">${util.unicodify( ldda.name ) | h}</div> + Information about <div class="menubutton popup" id="dataset-${ trans.security.encode_id( ldda.id ) | h}-popup">${util.unicodify( ldda.name ) | h}</div> %if not library.deleted and not branch_deleted( ldda.library_dataset.folder ) and not ldda.library_dataset.deleted: - <div popupmenu="dataset-${ldda.id | h}-popup"> + <div popupmenu="dataset-${ trans.security.encode_id( ldda.id ) | h}-popup"> %if can_modify: <a class="action-button" href="${h.url_for( controller='library_common', action='ldda_edit_info', cntrller=cntrller, library_id=trans.security.encode_id( library.id ), folder_id=trans.security.encode_id( ldda.library_dataset.folder.id ), id=trans.security.encode_id( ldda.id ), use_panels=use_panels, show_deleted=show_deleted )}">Edit information</a> %if not info_association: @@ -168,9 +168,9 @@ %endfor %if ldda.peek != "no peek": <div class="form-row"> - <div id="info${ldda.id | h}" class="historyItemBody"> + <div id="info${ trans.security.encode_id( ldda.id ) | h}" class="historyItemBody"><label>Peek:</label> - <div><pre id="peek${ldda.id | h}" class="peek">${util.unicodify( ldda.display_peek() )}</pre></div> + <div><pre id="peek${ trans.security.encode_id( ldda.id ) | h}" class="peek">${util.unicodify( ldda.display_peek() )}</pre></div></div></div> %endif diff -r 2db0fb9594d6c315e4e0a4be70f64373cfc708f6 -r 0a1379bb7f1e1664a76da1c321584e3bbd2842cd templates/webapps/galaxy/library/common/library_info.mako --- a/templates/webapps/galaxy/library/common/library_info.mako +++ b/templates/webapps/galaxy/library/common/library_info.mako @@ -34,11 +34,11 @@ <div class="toolForm"><div class="toolFormTitle"> - <div class="menubutton split popup" id="library-${library.id}-popup"> + <div class="menubutton split popup" id="library-${trans.security.encode_id( library.id ) | h }-popup"><a href="${h.url_for( controller='library_common', action='browse_library', cntrller=cntrller, id=trans.security.encode_id( library.id ), use_panels=use_panels, show_deleted=show_deleted )}">${library.name[:50] | h}</a></div> %if can_add or can_modify or can_manage: - <div popupmenu="library-${library.id | h}-popup"> + <div popupmenu="library-${ trans.security.encode_id( library.id ) | h }-popup"> %if not library.deleted: %if can_add and not library.info_association: <a class="action-button" href="${h.url_for( controller='library_common', action='add_template', cntrller=cntrller, item_type='library', form_type=trans.model.FormDefinition.types.LIBRARY_INFO_TEMPLATE, library_id=trans.security.encode_id( library.id ), use_panels=use_panels, show_deleted=show_deleted )}">Use template</a> diff -r 2db0fb9594d6c315e4e0a4be70f64373cfc708f6 -r 0a1379bb7f1e1664a76da1c321584e3bbd2842cd templates/webapps/galaxy/requests/common/common.mako --- a/templates/webapps/galaxy/requests/common/common.mako +++ b/templates/webapps/galaxy/requests/common/common.mako @@ -694,11 +694,11 @@ <td> %if is_admin: <span class="expandLink dataset-${dataset}-click"><span class="rowIcon"></span> - <div style="float: left; margin-left: 2px;" class="menubutton split popup" id="dataset-${dataset.id}-popup"> + <div style="float: left; margin-left: 2px;" class="menubutton split popup" id="dataset-${ trans.security.encode_id( dataset.id ) }-popup"><a class="dataset-${encoded_id}-click" href="${h.url_for( controller='requests_admin', action='manage_datasets', operation='view', id=trans.security.encode_id( dataset.id ) )}">${dataset.name | h}</a></div></span> - <div popupmenu="dataset-${dataset.id}-popup"> + <div popupmenu="dataset-${ trans.security.encode_id( dataset.id ) }-popup"> %if can_transfer_datasets and dataset in sample.untransferred_dataset_files: <li><a class="action-button" href="${h.url_for( controller='requests_admin', action='initiate_data_transfer', sample_id=trans.security.encode_id( sample.id ), sample_dataset_id=trans.security.encode_id( dataset.id ) )}">Transfer</a></li> %endif https://bitbucket.org/galaxy/galaxy-central/commits/0ac7297b5849/ Changeset: 0ac7297b5849 Branch: stable User: martenson Date: 2014-12-11 18:01:22+00:00 Summary: Merged in martenson/galaxy-central-marten/stable (pull request #599) [STABLE] encode dataset, ldda, folder and library IDs properly in some more places Affected #: 5 files diff -r f0f1f78b54c55c8569bd1e3ed7fc15726b0b64a4 -r 0ac7297b58491d542948ae3976732dd2c3450b89 templates/webapps/galaxy/library/common/browse_library.mako --- a/templates/webapps/galaxy/library/common/browse_library.mako +++ b/templates/webapps/galaxy/library/common/browse_library.mako @@ -238,7 +238,7 @@ %if parent is not None: parent="${parent | h}" %endif - id="libraryItem-${ldda.id | h}"> + id="libraryItem-${ trans.security.encode_id( ldda.id ) | h}"><td style="padding-left: ${pad+20}px;"><input style="float: left;" type="checkbox" name="ldda_ids" id="${trans.security.encode_id( ldda.id ) | h}" value="${trans.security.encode_id( ldda.id ) | h}" %if selected: @@ -248,7 +248,7 @@ %if simple: <label for="${trans.security.encode_id( ldda.id ) | h}">${ util.unicodify( ldda.name ) | h}</label> %else: - <div style="float: left; margin-left: 1px;" class="menubutton split popup" id="dataset-${ldda.id | h}-popup"> + <div style="float: left; margin-left: 1px;" class="menubutton split popup" id="dataset-${ trans.security.encode_id( ldda.id ) | h}-popup"><a class="view-info" href="${h.url_for( controller='library_common', action='ldda_info', cntrller=cntrller, library_id=trans.security.encode_id( library.id ), folder_id=trans.security.encode_id( folder.id ), id=trans.security.encode_id( ldda.id ), use_panels=use_panels, show_deleted=show_deleted )}"> %if ldda.library_dataset.deleted: <div class="libraryItem-error">${util.unicodify( ldda.name ) | h}</div> @@ -258,7 +258,7 @@ </a></div> %if not library.deleted: - <div popupmenu="dataset-${ldda.id | h}-popup"> + <div popupmenu="dataset-${ trans.security.encode_id( ldda.id ) | h}-popup"> %if not branch_deleted( folder ) and not ldda.library_dataset.deleted and can_modify: <a class="action-button" href="${h.url_for( controller='library_common', action='ldda_edit_info', cntrller=cntrller, library_id=trans.security.encode_id( library.id ), folder_id=trans.security.encode_id( folder.id ), id=trans.security.encode_id( ldda.id ), use_panels=use_panels, show_deleted=show_deleted )}">Edit information</a><a class="action-button" href="${h.url_for( controller='library_common', action='move_library_item', cntrller=cntrller, item_type='ldda', item_id=trans.security.encode_id( ldda.id ), source_library_id=trans.security.encode_id( library.id ), use_panels=use_panels, show_deleted=show_deleted )}">Move this dataset</a> @@ -364,7 +364,7 @@ <td style="padding-left: ${folder_pad | h}px;"><input type="checkbox" class="folderCheckbox"/><span class="expandLink folder-${encoded_id | h}-click"> - <div style="float: left; margin-left: 2px;" class="menubutton split popup" id="folder_img-${folder.id | h}-popup"> + <div style="float: left; margin-left: 2px;" class="menubutton split popup" id="folder_img-${ 'F' + trans.security.encode_id( folder.id ) }-popup"><a class="folder-${encoded_id | h}-click" href="javascript:void(0);"><span class="rowIcon"></span> %if folder.deleted: @@ -376,7 +376,7 @@ </div></span> %if not library.deleted: - <div popupmenu="folder_img-${folder.id | h}-popup"> + <div popupmenu="folder_img-${ 'F' + trans.security.encode_id( folder.id ) }-popup"> %if not branch_deleted( folder ) and can_add: <a class="action-button" href="${h.url_for( controller='library_common', action='upload_library_dataset', cntrller=cntrller, library_id=trans.security.encode_id( library.id ), folder_id=trans.security.encode_id( folder.id ), use_panels=use_panels, show_deleted=show_deleted )}">Add datasets</a><a class="action-button" href="${h.url_for( controller='library_common', action='create_folder', cntrller=cntrller, parent_id=trans.security.encode_id( folder.id ), library_id=trans.security.encode_id( library.id ), use_panels=use_panels, show_deleted=show_deleted )}">Add sub-folder</a> @@ -512,8 +512,8 @@ <li><a class="action-button" href="${h.url_for( controller='library_common', action='create_folder', cntrller=cntrller, parent_id=trans.security.encode_id( library.root_folder.id ), library_id=trans.security.encode_id( library.id ), use_panels=use_panels, show_deleted=show_deleted )}">Add folder</a></li> %endif %if ( ( not library.deleted ) and ( can_modify or can_manage ) ) or ( can_modify and not library.purged ) or ( library.purged ): - <li><a class="action-button" id="library-${library.id}-popup" class="menubutton">Library Actions</a></li> - <div popupmenu="library-${library.id}-popup"> + <li><a class="action-button" id="library-${ trans.security.encode_id( library.id ) }-popup" class="menubutton">Library Actions</a></li> + <div popupmenu="library-${ trans.security.encode_id( library.id ) }-popup"> %if not library.deleted: %if can_modify: <a class="action-button" href="${h.url_for( controller='library_common', action='library_info', cntrller=cntrller, id=trans.security.encode_id( library.id ), use_panels=use_panels, show_deleted=show_deleted )}">Edit information</a> diff -r f0f1f78b54c55c8569bd1e3ed7fc15726b0b64a4 -r 0ac7297b58491d542948ae3976732dd2c3450b89 templates/webapps/galaxy/library/common/browse_library_opt.mako --- a/templates/webapps/galaxy/library/common/browse_library_opt.mako +++ b/templates/webapps/galaxy/library/common/browse_library_opt.mako @@ -230,9 +230,9 @@ %if parent is not None: parent="${parent | h}" %endif - id="libraryItem-${ldda.id | h}"> + id="libraryItem-${ trans.security.encode_id( ldda.id ) | h }"><td style="padding-left: ${pad+20}px;"> - <input style="float: left;" type="checkbox" name="ldda_ids" id="${trans.security.encode_id( ldda.id ) | h}" value="${trans.security.encode_id( ldda.id ) | h}" + <input style="float: left;" type="checkbox" name="ldda_ids" id="${trans.security.encode_id( ldda.id ) | h}" value="${ trans.security.encode_id( ldda.id ) | h }" %if selected: checked="checked" %endif @@ -240,7 +240,7 @@ %if simple: <label for="${trans.security.encode_id( ldda.id ) | h}">${ util.unicodify( ldda.name ) | h}</label> %else: - <div style="float: left; margin-left: 1px;" class="menubutton split popup" id="dataset-${ldda.id | h}-popup"> + <div style="float: left; margin-left: 1px;" class="menubutton split popup" id="dataset-${ trans.security.encode_id( ldda.id ) | h }-popup"><a class="view-info" href="${h.url_for( controller='library_common', action='ldda_info', cntrller=cntrller, library_id=trans.security.encode_id( library.id ), folder_id=trans.security.encode_id( folder.id ), id=trans.security.encode_id( ldda.id ), use_panels=use_panels, show_deleted=show_deleted )}"> %if ldda.library_dataset.deleted: <div class="libraryItem-error">${util.unicodify( ldda.name ) | h}</div> @@ -250,7 +250,7 @@ </a></div> %if not library.deleted: - <div popupmenu="dataset-${ldda.id | h}-popup"> + <div popupmenu="dataset-${ trans.security.encode_id( ldda.id ) | h }-popup"> %if not branch_deleted( folder ) and not ldda.library_dataset.deleted and can_modify: <a class="action-button" href="${h.url_for( controller='library_common', action='ldda_edit_info', cntrller=cntrller, library_id=trans.security.encode_id( library.id ), folder_id=trans.security.encode_id( folder.id ), id=trans.security.encode_id( ldda.id ), use_panels=use_panels, show_deleted=show_deleted )}">Edit information</a><a class="action-button" href="${h.url_for( controller='library_common', action='move_library_item', cntrller=cntrller, item_type='ldda', item_id=trans.security.encode_id( ldda.id ), source_library_id=trans.security.encode_id( library.id ), use_panels=use_panels, show_deleted=show_deleted )}">Move this dataset</a> @@ -371,7 +371,7 @@ <td style="padding-left: ${folder_pad | h}px;"><input type="checkbox" class="folderCheckbox"/><span class="expandLink folder-${encoded_id | h}-click"> - <div style="float: left; margin-left: 2px;" class="menubutton split popup" id="folder_img-${folder.id | h}-popup"> + <div style="float: left; margin-left: 2px;" class="menubutton split popup" id="folder_img-${ 'F' + trans.security.encode_id( folder.id ) }-popup"><a class="folder-${encoded_id | h}-click" href="javascript:void(0);"><span class="rowIcon"></span> %if folder.deleted: @@ -383,7 +383,7 @@ </div></span> %if not library.deleted: - <div popupmenu="folder_img-${folder.id | h}-popup"> + <div popupmenu="folder_img-${ 'F' + trans.security.encode_id( folder.id ) }-popup"> %if not branch_deleted( folder ) and can_add: <a class="action-button" href="${h.url_for( controller='library_common', action='upload_library_dataset', cntrller=cntrller, library_id=trans.security.encode_id( library.id ), folder_id=trans.security.encode_id( folder.id ), use_panels=use_panels, show_deleted=show_deleted )}">Add datasets</a><a class="action-button" href="${h.url_for( controller='library_common', action='create_folder', cntrller=cntrller, parent_id=trans.security.encode_id( folder.id ), library_id=trans.security.encode_id( library.id ), use_panels=use_panels, show_deleted=show_deleted )}">Add sub-folder</a> @@ -515,8 +515,8 @@ <li><a class="action-button" href="${h.url_for( controller='library_common', action='create_folder', cntrller=cntrller, parent_id=trans.security.encode_id( library.root_folder.id ), library_id=trans.security.encode_id( library.id ), use_panels=use_panels, show_deleted=show_deleted )}">Add folder</a></li> %endif %if ( ( not library.deleted ) and ( can_modify or can_manage ) ) or ( can_modify and not library.purged ) or ( library.purged ): - <li><a class="action-button" id="library-${library.id | h}-popup" class="menubutton">Library Actions</a></li> - <div popupmenu="library-${library.id | h}-popup"> + <li><a class="action-button" id="library-${ trans.security.encode_id( library.id ) | h}-popup" class="menubutton">Library Actions</a></li> + <div popupmenu="library-${ trans.security.encode_id( library.id ) | h}-popup"> %if not library.deleted: %if can_modify: <a class="action-button" href="${h.url_for( controller='library_common', action='library_info', cntrller=cntrller, id=trans.security.encode_id( library.id ), use_panels=use_panels, show_deleted=show_deleted )}">Edit information</a> diff -r f0f1f78b54c55c8569bd1e3ed7fc15726b0b64a4 -r 0ac7297b58491d542948ae3976732dd2c3450b89 templates/webapps/galaxy/library/common/ldda_info.mako --- a/templates/webapps/galaxy/library/common/ldda_info.mako +++ b/templates/webapps/galaxy/library/common/ldda_info.mako @@ -47,9 +47,9 @@ <div class="toolForm"><div class="toolFormTitle"> - Information about <div class="menubutton popup" id="dataset-${ldda.id | h}-popup">${util.unicodify( ldda.name ) | h}</div> + Information about <div class="menubutton popup" id="dataset-${ trans.security.encode_id( ldda.id ) | h}-popup">${util.unicodify( ldda.name ) | h}</div> %if not library.deleted and not branch_deleted( ldda.library_dataset.folder ) and not ldda.library_dataset.deleted: - <div popupmenu="dataset-${ldda.id | h}-popup"> + <div popupmenu="dataset-${ trans.security.encode_id( ldda.id ) | h}-popup"> %if can_modify: <a class="action-button" href="${h.url_for( controller='library_common', action='ldda_edit_info', cntrller=cntrller, library_id=trans.security.encode_id( library.id ), folder_id=trans.security.encode_id( ldda.library_dataset.folder.id ), id=trans.security.encode_id( ldda.id ), use_panels=use_panels, show_deleted=show_deleted )}">Edit information</a> %if not info_association: @@ -168,9 +168,9 @@ %endfor %if ldda.peek != "no peek": <div class="form-row"> - <div id="info${ldda.id | h}" class="historyItemBody"> + <div id="info${ trans.security.encode_id( ldda.id ) | h}" class="historyItemBody"><label>Peek:</label> - <div><pre id="peek${ldda.id | h}" class="peek">${util.unicodify( ldda.display_peek() )}</pre></div> + <div><pre id="peek${ trans.security.encode_id( ldda.id ) | h}" class="peek">${util.unicodify( ldda.display_peek() )}</pre></div></div></div> %endif diff -r f0f1f78b54c55c8569bd1e3ed7fc15726b0b64a4 -r 0ac7297b58491d542948ae3976732dd2c3450b89 templates/webapps/galaxy/library/common/library_info.mako --- a/templates/webapps/galaxy/library/common/library_info.mako +++ b/templates/webapps/galaxy/library/common/library_info.mako @@ -34,11 +34,11 @@ <div class="toolForm"><div class="toolFormTitle"> - <div class="menubutton split popup" id="library-${library.id}-popup"> + <div class="menubutton split popup" id="library-${trans.security.encode_id( library.id ) | h }-popup"><a href="${h.url_for( controller='library_common', action='browse_library', cntrller=cntrller, id=trans.security.encode_id( library.id ), use_panels=use_panels, show_deleted=show_deleted )}">${library.name[:50] | h}</a></div> %if can_add or can_modify or can_manage: - <div popupmenu="library-${library.id | h}-popup"> + <div popupmenu="library-${ trans.security.encode_id( library.id ) | h }-popup"> %if not library.deleted: %if can_add and not library.info_association: <a class="action-button" href="${h.url_for( controller='library_common', action='add_template', cntrller=cntrller, item_type='library', form_type=trans.model.FormDefinition.types.LIBRARY_INFO_TEMPLATE, library_id=trans.security.encode_id( library.id ), use_panels=use_panels, show_deleted=show_deleted )}">Use template</a> diff -r f0f1f78b54c55c8569bd1e3ed7fc15726b0b64a4 -r 0ac7297b58491d542948ae3976732dd2c3450b89 templates/webapps/galaxy/requests/common/common.mako --- a/templates/webapps/galaxy/requests/common/common.mako +++ b/templates/webapps/galaxy/requests/common/common.mako @@ -694,11 +694,11 @@ <td> %if is_admin: <span class="expandLink dataset-${dataset}-click"><span class="rowIcon"></span> - <div style="float: left; margin-left: 2px;" class="menubutton split popup" id="dataset-${dataset.id}-popup"> + <div style="float: left; margin-left: 2px;" class="menubutton split popup" id="dataset-${ trans.security.encode_id( dataset.id ) }-popup"><a class="dataset-${encoded_id}-click" href="${h.url_for( controller='requests_admin', action='manage_datasets', operation='view', id=trans.security.encode_id( dataset.id ) )}">${dataset.name | h}</a></div></span> - <div popupmenu="dataset-${dataset.id}-popup"> + <div popupmenu="dataset-${ trans.security.encode_id( dataset.id ) }-popup"> %if can_transfer_datasets and dataset in sample.untransferred_dataset_files: <li><a class="action-button" href="${h.url_for( controller='requests_admin', action='initiate_data_transfer', sample_id=trans.security.encode_id( sample.id ), sample_dataset_id=trans.security.encode_id( dataset.id ) )}">Transfer</a></li> %endif Repository URL: https://bitbucket.org/galaxy/galaxy-central/ -- This is a commit notification from bitbucket.org. You are receiving this because you have the service enabled, addressing the recipient of this email.

1 0

commit/galaxy-central: dannon: Merged in davebgx/galaxy-central/stable (pull request #603)
by commits-noreply＠bitbucket.org 11 Dec '14

11 Dec '14

1 new commit in galaxy-central: https://bitbucket.org/galaxy/galaxy-central/commits/f0f1f78b54c5/ Changeset: f0f1f78b54c5 Branch: stable User: dannon Date: 2014-12-11 14:50:35+00:00 Summary: Merged in davebgx/galaxy-central/stable (pull request #603) [STABLE] Escape anything that could be user input in my assigned mako templates, add markupsafe.escape to username and email in users API controller. Affected #: 46 files diff -r 5fc83b69fe241d469ad27235a39e93d847764bbc -r f0f1f78b54c55c8569bd1e3ed7fc15726b0b64a4 templates/admin/dataset_security/group/group.mako --- a/templates/admin/dataset_security/group/group.mako +++ b/templates/admin/dataset_security/group/group.mako @@ -11,9 +11,9 @@ </%def><%def name="render_select( name, options )"> - <select name="${name}" id="${name}" style="min-width: 250px; height: 150px;" multiple> + <select name="${name|h}" id="${name|h}" style="min-width: 250px; height: 150px;" multiple> %for option in options: - <option value="${option[0]}">${option[1]}</option> + <option value="${option[0]|h}">${option[1]|h}</option> %endfor </select></%def> @@ -48,29 +48,29 @@ %endif <div class="toolForm"> - <div class="toolFormTitle">Group '${group.name}'</div> + <div class="toolFormTitle">Group '${group.name|h}'</div><div class="toolFormBody"><form name="associate_group_role_user" id="associate_group_role_user" action="${h.url_for(controller='admin', action='manage_users_and_roles_for_group', id=trans.security.encode_id( group.id ) )}" method="post" ><div class="form-row"><div style="float: left; margin-right: 10px;"> - <label>Roles associated with '${group.name}'</label> + <label>Roles associated with '${group.name|h}'</label> ${render_select( "in_roles", in_roles )}<br/><input type="submit" id="roles_remove_button" value=">>"/></div><div> - <label>Roles not associated with '${group.name}'</label> + <label>Roles not associated with '${group.name|h}'</label> ${render_select( "out_roles", out_roles )}<br/><input type="submit" id="roles_add_button" value="<<"/></div></div><div class="form-row"><div style="float: left; margin-right: 10px;"> - <label>Users associated with '${group.name}'</label> + <label>Users associated with '${group.name|h}'</label> ${render_select( "in_users", in_users )}<br/><input type="submit" id="users_remove_button" value=">>"/></div><div> - <label>Users not associated with '${group.name}'</label> + <label>Users not associated with '${group.name|h}'</label> ${render_select( "out_users", out_users )}<br/><input type="submit" id="users_add_button" value="<<"/></div> diff -r 5fc83b69fe241d469ad27235a39e93d847764bbc -r f0f1f78b54c55c8569bd1e3ed7fc15726b0b64a4 templates/admin/dataset_security/group/group_create.mako --- a/templates/admin/dataset_security/group/group_create.mako +++ b/templates/admin/dataset_security/group/group_create.mako @@ -11,9 +11,9 @@ </%def><%def name="render_select( name, options )"> - <select name="${name}" id="${name}" style="min-width: 250px; height: 150px;" multiple> + <select name="${name|h}" id="${name|h}" style="min-width: 250px; height: 150px;" multiple> %for option in options: - <option value="${option[0]}">${option[1]}</option> + <option value="${option[0]|h}">${option[1]|h}</option> %endfor </select></%def> @@ -60,7 +60,7 @@ <form name="associate_group_role_user" id="associate_group_role_user" action="${h.url_for(controller='admin', action='create_group' )}" method="post" ><div class="form-row"><label>Name:</label> - <input name="name" type="textfield" value="${name}" size=40"/> + <input name="name" type="textfield" value="${name|h}" size=40"/></div><div class="form-row"><div style="float: left; margin-right: 10px;"> diff -r 5fc83b69fe241d469ad27235a39e93d847764bbc -r f0f1f78b54c55c8569bd1e3ed7fc15726b0b64a4 templates/admin/dataset_security/group/group_rename.mako --- a/templates/admin/dataset_security/group/group_rename.mako +++ b/templates/admin/dataset_security/group/group_rename.mako @@ -12,7 +12,7 @@ <div class="form-row"><label>Name:</label><div style="float: left; width: 250px; margin-right: 10px;"> - <input type="text" name="name" value="${group.name}" size="40"/> + <input type="text" name="name" value="${group.name|h}" size="40"/></div><div style="clear: both"></div></div> diff -r 5fc83b69fe241d469ad27235a39e93d847764bbc -r f0f1f78b54c55c8569bd1e3ed7fc15726b0b64a4 templates/admin/dataset_security/role/role.mako --- a/templates/admin/dataset_security/role/role.mako +++ b/templates/admin/dataset_security/role/role.mako @@ -11,9 +11,9 @@ </%def><%def name="render_select( name, options )"> - <select name="${name}" id="${name}" style="min-width: 250px; height: 150px;" multiple> + <select name="${name|h}" id="${name|h}" style="min-width: 250px; height: 150px;" multiple> %for option in options: - <option value="${option[0]}">${option[1]}</option> + <option value="${option[0]|h}">${option[1]|h}</option> %endfor </select></%def> @@ -48,29 +48,29 @@ %endif <div class="toolForm"> - <div class="toolFormTitle">Role '${role.name}'</div> + <div class="toolFormTitle">Role '${role.name|h}'</div><div class="toolFormBody"><form name="associate_role_user_group" id="associate_role_user_group" action="${h.url_for(controller='admin', action='manage_users_and_groups_for_role', id=trans.security.encode_id( role.id ) )}" method="post" ><div class="form-row"><div style="float: left; margin-right: 10px;"> - <label>Users associated with '${role.name}'</label> + <label>Users associated with '${role.name|h}'</label> ${render_select( "in_users", in_users )}<br/><input type="submit" id="users_remove_button" value=">>"/></div><div> - <label>Users not associated with '${role.name}'</label> + <label>Users not associated with '${role.name|h}'</label> ${render_select( "out_users", out_users )}<br/><input type="submit" id="users_add_button" value="<<"/></div></div><div class="form-row"><div style="float: left; margin-right: 10px;"> - <label>Groups associated with '${role.name}'</label> + <label>Groups associated with '${role.name|h}'</label> ${render_select( "in_groups", in_groups )}<br/><input type="submit" id="groups_remove_button" value=">>"/></div><div> - <label>Groups not associated with '${role.name}'</label> + <label>Groups not associated with '${role.name|h}'</label> ${render_select( "out_groups", out_groups )}<br/><input type="submit" id="groups_add_button" value="<<"/></div> @@ -84,7 +84,7 @@ <br clear="left"/><br/> %if len( library_dataset_actions ) > 0: - <h3>Data library datasets associated with role '${role.name}'</h3> + <h3>Data library datasets associated with role '${role.name|h}'</h3><table class="manage-table colored" border="0" cellspacing="0" cellpadding="0" width="100%"><tr><td> @@ -92,16 +92,16 @@ %for ctr, library, in enumerate( library_dataset_actions.keys() ): <li><img src="${h.url_for( '/static/images/silk/book_open.png' )}" class="rowIcon"/> - ${library.name} + ${library.name|h} <ul> %for folder_path, permissions in library_dataset_actions[ library ].items(): <li><img src="/static/images/silk/folder_page.png" class="rowIcon"/> - ${folder_path} + ${folder_path|h} <ul> % for permission in permissions: <ul> - <li>${permission}</li> + <li>${permission|h}</li></ul> %endfor </ul> diff -r 5fc83b69fe241d469ad27235a39e93d847764bbc -r f0f1f78b54c55c8569bd1e3ed7fc15726b0b64a4 templates/admin/dataset_security/role/role_create.mako --- a/templates/admin/dataset_security/role/role_create.mako +++ b/templates/admin/dataset_security/role/role_create.mako @@ -11,9 +11,9 @@ </%def><%def name="render_select( name, options )"> - <select name="${name}" id="${name}" style="min-width: 250px; height: 150px;" multiple> + <select name="${name|h}" id="${name|h}" style="min-width: 250px; height: 150px;" multiple> %for option in options: - <option value="${option[0]}">${option[1]}</option> + <option value="${option[0]|h}">${option[1]|h}</option> %endfor </select></%def> @@ -60,11 +60,11 @@ <form name="associate_role_group_user" id="associate_role_group_user" action="${h.url_for(controller='admin', action='create_role' )}" method="post" ><div class="form-row"><label>Name:</label> - <input name="name" type="textfield" value="${name}" size=40"/> + <input name="name" type="textfield" value="${name|h}" size=40"/></div><div class="form-row"><label>Description:</label> - <input name="description" type="textfield" value="${description}" size=40"/> + <input name="description" type="textfield" value="${description|h}" size=40"/></div><div class="form-row"><div style="float: left; margin-right: 10px;"> diff -r 5fc83b69fe241d469ad27235a39e93d847764bbc -r f0f1f78b54c55c8569bd1e3ed7fc15726b0b64a4 templates/admin/dataset_security/role/role_rename.mako --- a/templates/admin/dataset_security/role/role_rename.mako +++ b/templates/admin/dataset_security/role/role_rename.mako @@ -12,14 +12,14 @@ <div class="form-row"><label>Name:</label><div style="float: left; width: 250px; margin-right: 10px;"> - <input type="text" name="name" value="${role.name}" size="40"/> + <input type="text" name="name" value="${role.name|h}" size="40"/></div><div style="clear: both"></div></div><div class="form-row"><label>Description:</label><div style="float: left; width: 250px; margin-right: 10px;"> - <input name="description" type="textfield" value="${role.description}" size=40"/> + <input name="description" type="textfield" value="${role.description|h}" size=40"/></div><div style="clear: both"></div></div> diff -r 5fc83b69fe241d469ad27235a39e93d847764bbc -r f0f1f78b54c55c8569bd1e3ed7fc15726b0b64a4 templates/admin/external_service/create_external_service.mako --- a/templates/admin/external_service/create_external_service.mako +++ b/templates/admin/external_service/create_external_service.mako @@ -12,10 +12,10 @@ %if widgets: %for i, field in enumerate( widgets ): <div class="form-row"> - <label>${field['label']}:</label> + <label>${field['label']|h}:</label> ${field['widget'].get_html()} <div class="toolParamHelp" style="clear: both;"> - ${field['helptext']} + ${field['helptext']|h} </div><div style="clear: both"></div></div> diff -r 5fc83b69fe241d469ad27235a39e93d847764bbc -r f0f1f78b54c55c8569bd1e3ed7fc15726b0b64a4 templates/admin/external_service/edit_external_service.mako --- a/templates/admin/external_service/edit_external_service.mako +++ b/templates/admin/external_service/edit_external_service.mako @@ -25,10 +25,10 @@ <div class="toolFormTitle">Edit external service</div> %for i, field in enumerate( widgets ): <div class="form-row"> - <label>${field['label']}:</label> + <label>${field['label']|h}:</label> ${field['widget'].get_html()} <div class="toolParamHelp" style="clear: both;"> - ${field['helptext']} + ${field['helptext']|h} </div><div style="clear: both"></div></div> diff -r 5fc83b69fe241d469ad27235a39e93d847764bbc -r f0f1f78b54c55c8569bd1e3ed7fc15726b0b64a4 templates/admin/jobs.mako --- a/templates/admin/jobs.mako +++ b/templates/admin/jobs.mako @@ -63,12 +63,12 @@ </td><td>${job.id}</td> %if job.history and job.history.user: - <td>${job.history.user.email}</td> + <td>${job.history.user.email|h}</td> %else: <td>anonymous</td> %endif <td>${last_updated[job.id]} ago</td> - <td>${job.tool_id}</td> + <td>${job.tool_id|h}</td><td>${job.state}</td><% try: @@ -77,8 +77,8 @@ inputs = 'Unable to determine inputs' %><td>${inputs}</td> - <td>${job.command_line}</td> - <td>${job.job_runner_name}</td> + <td>${job.command_line|h}</td> + <td>${job.job_runner_name|h}</td><td>${job.job_runner_external_id}</td></tr> %endfor @@ -131,12 +131,12 @@ %for job in recent_jobs: <td><a href="${h.url_for( controller="admin", action="job_info" )}?jobid=${job.id}">${job.id}</a></td> %if job.history and job.history.user: - <td>${job.history.user.email}</td> + <td>${job.history.user.email|h}</td> %else: <td>anonymous</td> %endif <td>${finished[job.id]} ago</td> - <td>${job.tool_id}</td> + <td>${job.tool_id|h}</td><td>${job.state}</td><% try: @@ -145,9 +145,9 @@ inputs = 'Unable to determine inputs' %><td>${inputs}</td> - <td>${job.command_line}</td> - <td>${job.job_runner_name}</td> - <td>${job.job_runner_external_id}</td> + <td>${job.command_line|h}</td> + <td>${job.job_runner_name|h}</td> + <td>${job.job_runner_external_id|h}</td></tr> %endfor </table> diff -r 5fc83b69fe241d469ad27235a39e93d847764bbc -r f0f1f78b54c55c8569bd1e3ed7fc15726b0b64a4 templates/admin/memdump.mako --- a/templates/admin/memdump.mako +++ b/templates/admin/memdump.mako @@ -55,7 +55,7 @@ <br/> You are here: ${breadcrumb}<br/> %if breadcrumb.endswith( 'theone' ): - ${heap} + ${heap|h} %else: <nobr> Sort: diff -r 5fc83b69fe241d469ad27235a39e93d847764bbc -r f0f1f78b54c55c8569bd1e3ed7fc15726b0b64a4 templates/admin/package_tool.mako --- a/templates/admin/package_tool.mako +++ b/templates/admin/package_tool.mako @@ -28,9 +28,9 @@ <select name="tool_id"> %for key, val in toolbox.tool_panel.items(): %if isinstance( val, Tool ): - <option value="${val.id}">${val.name}</option> + <option value="${val.id|h}">${val.name|h}</option> %elif isinstance( val, ToolSection ): - <optgroup label="${val.name}"> + <optgroup label="${val.name|h}"><% section = val %> %for section_key, section_val in section.elems.items(): %if isinstance( section_val, Tool ): @@ -38,7 +38,7 @@ %if section_val.id == tool_id: <% selected_str = " selected=\"selected\"" %> %endif - <option value="${section_val.id}"${selected_str}>${section_val.name}</option> + <option value="${section_val.id|h}"${selected_str}>${section_val.name|h}</option> %endif %endfor %endif diff -r 5fc83b69fe241d469ad27235a39e93d847764bbc -r f0f1f78b54c55c8569bd1e3ed7fc15726b0b64a4 templates/admin/quota/quota.mako --- a/templates/admin/quota/quota.mako +++ b/templates/admin/quota/quota.mako @@ -11,9 +11,9 @@ </%def><%def name="render_select( name, options )"> - <select name="${name}" id="${name}" style="min-width: 250px; height: 150px;" multiple> + <select name="${name|h}" id="${name|h}" style="min-width: 250px; height: 150px;" multiple> %for option in options: - <option value="${option[0]}">${option[1]}</option> + <option value="${option[0]|h}">${option[1]|h}</option> %endfor </select></%def> @@ -48,29 +48,29 @@ %endif <div class="toolForm"> - <div class="toolFormTitle">Quota '${name}'</div> + <div class="toolFormTitle">Quota '${name|h}'</div><div class="toolFormBody"><form name="associate_quota_user_group" id="associate_quota_user_group" action="${h.url_for(controller='admin', action='manage_users_and_groups_for_quota', id=id )}" method="post" ><div class="form-row"><div style="float: left; margin-right: 10px;"> - <label>Users associated with '${name}'</label> + <label>Users associated with '${name|h}'</label> ${render_select( "in_users", in_users )}<br/><input type="submit" id="users_remove_button" value=">>"/></div><div> - <label>Users not associated with '${name}'</label> + <label>Users not associated with '${name|h}'</label> ${render_select( "out_users", out_users )}<br/><input type="submit" id="users_add_button" value="<<"/></div></div><div class="form-row"><div style="float: left; margin-right: 10px;"> - <label>Groups associated with '${name}'</label> + <label>Groups associated with '${name|h}'</label> ${render_select( "in_groups", in_groups )}<br/><input type="submit" id="groups_remove_button" value=">>"/></div><div> - <label>Groups not associated with '${name}'</label> + <label>Groups not associated with '${name|h}'</label> ${render_select( "out_groups", out_groups )}<br/><input type="submit" id="groups_add_button" value="<<"/></div> diff -r 5fc83b69fe241d469ad27235a39e93d847764bbc -r f0f1f78b54c55c8569bd1e3ed7fc15726b0b64a4 templates/admin/quota/quota_create.mako --- a/templates/admin/quota/quota_create.mako +++ b/templates/admin/quota/quota_create.mako @@ -11,9 +11,9 @@ </%def><%def name="render_select( name, options )"> - <select name="${name}" id="${name}" style="min-width: 250px; height: 150px;" multiple> + <select name="${name|h}" id="${name|h}" style="min-width: 250px; height: 150px;" multiple> %for option in options: - <option value="${option[0]}">${option[1]}</option> + <option value="${option[0]|h}">${option[1]|h}</option> %endfor </select></%def> @@ -69,15 +69,15 @@ <form name="associate_quota_group_user" id="associate_quota_group_user" action="${h.url_for(controller='admin', action='create_quota' )}" method="post" ><div class="form-row"><label>Name:</label> - <input name="name" type="textfield" value="${name}" size=40"/> + <input name="name" type="textfield" value="${name|h}" size=40"/></div><div class="form-row"><label>Description:</label> - <input name="description" type="textfield" value="${description}" size=40"/> + <input name="description" type="textfield" value="${description|h}" size=40"/></div><div class="form-row"><label>Amount</label> - <input name="amount" type="textfield" value="${amount}" size=40"/> + <input name="amount" type="textfield" value="${amount|h}" size=40"/><div class="toolParamHelp" style="clear: both;"> Examples: "10000MB", "99 gb", "0.2T", "unlimited" </div> diff -r 5fc83b69fe241d469ad27235a39e93d847764bbc -r f0f1f78b54c55c8569bd1e3ed7fc15726b0b64a4 templates/admin/quota/quota_edit.mako --- a/templates/admin/quota/quota_edit.mako +++ b/templates/admin/quota/quota_edit.mako @@ -29,7 +29,7 @@ <input name="id" type="hidden" value="${id}"/><div class="form-row"><label>Amount</label> - <input name="amount" type="textfield" value="${display_amount}" size=40"/> + <input name="amount" type="textfield" value="${display_amount|h}" size=40"/><div class="toolParamHelp" style="clear: both;"> Examples: "10000MB", "99 gb", "0.2T", "unlimited" </div> diff -r 5fc83b69fe241d469ad27235a39e93d847764bbc -r f0f1f78b54c55c8569bd1e3ed7fc15726b0b64a4 templates/admin/quota/quota_rename.mako --- a/templates/admin/quota/quota_rename.mako +++ b/templates/admin/quota/quota_rename.mako @@ -21,14 +21,14 @@ <div class="form-row"><label>Name:</label><div style="float: left; width: 250px; margin-right: 10px;"> - <input type="text" name="name" value="${name}" size="40"/> + <input type="text" name="name" value="${name|h}" size="40"/></div><div style="clear: both"></div></div><div class="form-row"><label>Description:</label><div style="float: left; width: 250px; margin-right: 10px;"> - <input name="description" type="textfield" value="${description}" size=40"/> + <input name="description" type="textfield" value="${description|h}" size=40"/></div><div style="clear: both"></div></div> diff -r 5fc83b69fe241d469ad27235a39e93d847764bbc -r f0f1f78b54c55c8569bd1e3ed7fc15726b0b64a4 templates/admin/reload_tool.mako --- a/templates/admin/reload_tool.mako +++ b/templates/admin/reload_tool.mako @@ -28,9 +28,9 @@ <select name="tool_id"> %for key, val in toolbox.tool_panel.items(): %if isinstance( val, Tool ): - <option value="${val.id}">${val.name}</option> + <option value="${val.id}">${val.name|h}</option> %elif isinstance( val, ToolSection ): - <optgroup label="${val.name}"> + <optgroup label="${val.name|h}"><% section = val %> %for section_key, section_val in section.elems.items(): %if isinstance( section_val, Tool ): @@ -38,7 +38,7 @@ %if section_val.id == tool_id: <% selected_str = " selected=\"selected\"" %> %endif - <option value="${section_val.id}"${selected_str}>${section_val.name}</option> + <option value="${section_val.id}"${selected_str}>${section_val.name|h}</option> %endif %endfor %endif diff -r 5fc83b69fe241d469ad27235a39e93d847764bbc -r f0f1f78b54c55c8569bd1e3ed7fc15726b0b64a4 templates/admin/review_tool_migration_stages.mako --- a/templates/admin/review_tool_migration_stages.mako +++ b/templates/admin/review_tool_migration_stages.mako @@ -4,7 +4,9 @@ %if message: ${render_msg( message, status )} %endif - +<% +from markupsafe import escape +%><div class="toolForm"><div class="toolFormTitle">Tool migrations that can be performed on this Galaxy instance</div><div class="toolFormBody"> @@ -51,7 +53,7 @@ repository_names.sort() repository_names = ', '.join( repository_names ) %> - <tr><td bgcolor="#D8D8D8"><b>Tool migration stage ${stage} - repositories: ${repository_names}</b></td></tr> + <tr><td bgcolor="#D8D8D8"><b>Tool migration stage ${stage} - repositories: ${repository_names|h}</b></td></tr><tr><td bgcolor="#FFFFCC"><div class="form-row"> @@ -59,11 +61,11 @@ <p> %if tool_dependencies: This migration stage includes tools that have tool dependencies that can be automatically installed. To install them, run:<br/> - <b>${install_dependencies}</b><br/><br/> + <b>${install_dependencies|h}</b><br/><br/> To skip tool dependency installation run:<br/> - <b>${migration_command}</b> + <b>${migration_command|h}</b> %else: - <b>${migration_command}</b> + <b>${migration_command|h}</b> %endif </p></div> @@ -74,7 +76,7 @@ <tr><td bgcolor="#DADFEF"><div class="form-row"> - <b>Repository:</b> ${repository_name} + <b>Repository:</b> ${repository_name|h} </div></td></tr> @@ -88,10 +90,10 @@ </tr> %for tool_dependencies_tup in tool_dependencies: <% - tool_dependency_name = tool_dependencies_tup[0] - tool_dependency_version = tool_dependencies_tup[1] - tool_dependency_type = tool_dependencies_tup[2] - installation_requirements = tool_dependencies_tup[3].replace( '\n', '<br/>' ) + tool_dependency_name = escape( tool_dependencies_tup[0] ) + tool_dependency_version = escape( tool_dependencies_tup[1] ) + tool_dependency_type = escape( tool_dependencies_tup[2] ) + installation_requirements = escape( tool_dependencies_tup[3] ).replace( '\n', '<br/>' ) %><tr><td> diff -r 5fc83b69fe241d469ad27235a39e93d847764bbc -r f0f1f78b54c55c8569bd1e3ed7fc15726b0b64a4 templates/admin/tool_shed_repository/browse_repository.mako --- a/templates/admin/tool_shed_repository/browse_repository.mako +++ b/templates/admin/tool_shed_repository/browse_repository.mako @@ -21,7 +21,7 @@ %endif <div class="toolForm"> - <div class="toolFormTitle">Browse ${repository.name} revision ${repository.changeset_revision} files</div> + <div class="toolFormTitle">Browse ${repository.name|h} revision ${repository.changeset_revision} files</div><div class="toolFormBody"><div class="form-row" ><label>Contents:</label> diff -r 5fc83b69fe241d469ad27235a39e93d847764bbc -r f0f1f78b54c55c8569bd1e3ed7fc15726b0b64a4 templates/admin/tool_shed_repository/browse_tool_dependency.mako --- a/templates/admin/tool_shed_repository/browse_tool_dependency.mako +++ b/templates/admin/tool_shed_repository/browse_tool_dependency.mako @@ -23,33 +23,33 @@ %endif <div class="toolForm"> - <div class="toolFormTitle">Browse tool dependency ${tool_dependency.name} installation directory</div> + <div class="toolFormTitle">Browse tool dependency ${tool_dependency.name|h} installation directory</div><div class="toolFormBody"><div class="form-row" ><label>Tool shed repository:</label> - ${repository.name} + ${repository.name|h} <div style="clear: both"></div></div><div class="form-row" ><label>Tool shed repository changeset revision:</label> - ${repository.changeset_revision} + ${repository.changeset_revision|h} <div style="clear: both"></div></div><div class="form-row" ><label>Tool dependency status:</label> - ${tool_dependency.status} + ${tool_dependency.status|h} <div style="clear: both"></div></div> %if tool_dependency.in_error_state: <div class="form-row" ><label>Tool dependency installation error:</label> - ${tool_dependency.error_message} + ${tool_dependency.error_message|h} <div style="clear: both"></div></div> %endif <div class="form-row" ><label>Tool dependency installation directory:</label> - ${tool_dependency.installation_directory( trans.app )} + ${tool_dependency.installation_directory( trans.app )|h} <div style="clear: both"></div></div><div class="form-row" > diff -r 5fc83b69fe241d469ad27235a39e93d847764bbc -r f0f1f78b54c55c8569bd1e3ed7fc15726b0b64a4 templates/admin/tool_shed_repository/common.mako --- a/templates/admin/tool_shed_repository/common.mako +++ b/templates/admin/tool_shed_repository/common.mako @@ -8,7 +8,7 @@ }); // --- Initialize sample trees $("#tree").dynatree({ - title: "${title_text}", + title: "${title_text|h}", rootVisible: true, minExpandLevel: 0, // 1: root node is not collapsible persist: false, @@ -24,7 +24,7 @@ // initAjax is hard to fake, so we pass the children as object array: initAjax: {url: "${h.url_for( controller='admin_toolshed', action='open_folder' )}", dataType: "json", - data: { folder_path: "${directory_path}" }, + data: { folder_path: "${directory_path|h}" }, }, onLazyRead: function(dtnode){ dtnode.appendAjax({ @@ -45,7 +45,7 @@ var cell = $("#file_contents"); var selected_value; if (dtnode.data.key == 'root') { - selected_value = "${directory_path}/"; + selected_value = "${directory_path|h}/"; } else { selected_value = dtnode.data.key; }; @@ -81,6 +81,7 @@ line-break:strict; } </style><% + from markupsafe import escape class RowCounter( object ): def __init__( self ): self.count = 0 @@ -96,7 +97,7 @@ env_settings_heaader_row_displayed = False package_header_row_displayed = False if revision_label: - revision_label_str = ' revision <b>%s</b> of ' % str( revision_label ) + revision_label_str = ' revision <b>%s</b> of ' % escape( str( revision_label ) ) else: revision_label_str = ' ' %> @@ -104,7 +105,7 @@ <div class="toolParamHelp" style="clear: both;"><p> %if export: - The following additional repositories are required by${revision_label_str}the <b>${repository.name}</b> repository + The following additional repositories are required by${revision_label_str}the <b>${repository.name|h}</b> repository and they can be exported as well. %else: These dependencies can be automatically handled with${revision_label_str}the installed repository, providing significant diff -r 5fc83b69fe241d469ad27235a39e93d847764bbc -r f0f1f78b54c55c8569bd1e3ed7fc15726b0b64a4 templates/admin/tool_shed_repository/deactivate_or_uninstall_repository.mako --- a/templates/admin/tool_shed_repository/deactivate_or_uninstall_repository.mako +++ b/templates/admin/tool_shed_repository/deactivate_or_uninstall_repository.mako @@ -10,30 +10,30 @@ %endif <div class="toolForm"> - <div class="toolFormTitle">${repository.name}</div> + <div class="toolFormTitle">${repository.name|h}</div><div class="toolFormBody"><form name="deactivate_or_uninstall_repository" id="deactivate_or_uninstall_repository" action="${h.url_for( controller='admin_toolshed', action='deactivate_or_uninstall_repository', id=trans.security.encode_id( repository.id ) )}" method="post" ><div class="form-row"><label>Description:</label> - ${repository.description} + ${repository.description|h} <div style="clear: both"></div></div><div class="form-row"><label>Revision:</label> - ${repository.changeset_revision}</a> + ${repository.changeset_revision|h}</a></div><div class="form-row"><label>Tool shed:</label> - ${repository.tool_shed} + ${repository.tool_shed|h} <div style="clear: both"></div></div><div class="form-row"><label>Owner:</label> - ${repository.owner} + ${repository.owner|h} </div><div class="form-row"><label>Deleted:</label> - ${repository.deleted} + ${repository.deleted|h} </div><div class="form-row"><% @@ -186,7 +186,7 @@ ##hack to mimic check box <input type="hidden" name="remove_from_disk" value="true"/><input type="hidden" name="remove_from_disk" value="true"/> %endif - <input type="submit" name="deactivate_or_uninstall_repository_button" value="${deactivate_uninstall_button_text}"/> + <input type="submit" name="deactivate_or_uninstall_repository_button" value="${deactivate_uninstall_button_text|h}"/></div></form></div> diff -r 5fc83b69fe241d469ad27235a39e93d847764bbc -r f0f1f78b54c55c8569bd1e3ed7fc15726b0b64a4 templates/admin/tool_shed_repository/initiate_repository_installation.mako --- a/templates/admin/tool_shed_repository/initiate_repository_installation.mako +++ b/templates/admin/tool_shed_repository/initiate_repository_installation.mako @@ -53,18 +53,18 @@ <td> %if link_to_manage_tool_dependencies: <a class="view-info" href="${h.url_for( controller='admin_toolshed', action='manage_tool_dependencies', tool_dependency_ids=ids_of_tool_dependencies_missing_or_being_installed )}"> - ${tool_shed_repository.name} + ${tool_shed_repository.name|h} </a> %else: <a class="view-info" href="${h.url_for( controller='admin_toolshed', action='manage_repository', id=encoded_repository_id )}"> - ${tool_shed_repository.name} + ${tool_shed_repository.name|h} </a> %endif </td><td>${tool_shed_repository.description}</td><td>${tool_shed_repository.owner}</td><td>${tool_shed_repository.changeset_revision}</td> - <td><div id="RepositoryStatus-${encoded_repository_id}">${tool_shed_repository.status}</div></td> + <td><div id="RepositoryStatus-${encoded_repository_id}">${tool_shed_repository.status|h}</div></td></tr> %endfor </table> diff -r 5fc83b69fe241d469ad27235a39e93d847764bbc -r f0f1f78b54c55c8569bd1e3ed7fc15726b0b64a4 templates/admin/tool_shed_repository/install_tool_dependencies_with_update.mako --- a/templates/admin/tool_shed_repository/install_tool_dependencies_with_update.mako +++ b/templates/admin/tool_shed_repository/install_tool_dependencies_with_update.mako @@ -20,12 +20,12 @@ <div class="toolForm"><div class="toolFormBody"><form name="install_tool_dependencies_with_update" id="install_tool_dependencies_with_update" action="${h.url_for( controller='admin_toolshed', action='install_tool_dependencies_with_update' )}" method="post" > - <input type="hidden" name="updating_repository_id" value="${updating_repository_id}"/> - <input type="hidden" name="updating_to_ctx_rev" value="${updating_to_ctx_rev}"/> - <input type="hidden" name="updating_to_changeset_revision" value="${updating_to_changeset_revision}"/> - <input type="hidden" name="encoded_updated_metadata" value="${encoded_updated_metadata}"/> - <input type="hidden" name="encoded_relative_install_dir" value="${encoded_relative_install_dir}"/> - <input type="hidden" name="encoded_tool_dependencies_dict" value="${encoded_tool_dependencies_dict}"/> + <input type="hidden" name="updating_repository_id" value="${updating_repository_id|h}"/> + <input type="hidden" name="updating_to_ctx_rev" value="${updating_to_ctx_rev|h}"/> + <input type="hidden" name="updating_to_changeset_revision" value="${updating_to_changeset_revision|h}"/> + <input type="hidden" name="encoded_updated_metadata" value="${encoded_updated_metadata|h}"/> + <input type="hidden" name="encoded_relative_install_dir" value="${encoded_relative_install_dir|h}"/> + <input type="hidden" name="encoded_tool_dependencies_dict" value="${encoded_tool_dependencies_dict|h}"/> %if tool_dependencies_dict: %if install_tool_dependencies_check_box is not None: <div class="form-row"> @@ -71,12 +71,12 @@ %> %if not os.path.exists( install_dir ): <tr> - <td>${key_name}</td> - <td>${key_version}</td> - <td>${install_dir}</td> + <td>${key_name|h}</td> + <td>${key_version|h}</td> + <td>${install_dir|h}</td></tr> %if readme_text: - <tr><td colspan="4" bgcolor="#FFFFCC">${key_name} ${key_version} requirements and installation information</td></tr> + <tr><td colspan="4" bgcolor="#FFFFCC">${key_name|h} ${key_version|h} requirements and installation information</td></tr><tr><td colspan="4"><pre>${readme_text}</pre></td></tr> %endif %endif diff -r 5fc83b69fe241d469ad27235a39e93d847764bbc -r f0f1f78b54c55c8569bd1e3ed7fc15726b0b64a4 templates/admin/tool_shed_repository/manage_repository.mako --- a/templates/admin/tool_shed_repository/manage_repository.mako +++ b/templates/admin/tool_shed_repository/manage_repository.mako @@ -22,50 +22,50 @@ %endif <div class="toolForm"> - <div class="toolFormTitle">Installed tool shed repository '${repository.name}'</div> + <div class="toolFormTitle">Installed tool shed repository '${repository.name|h}'</div><div class="toolFormBody"><form name="edit_repository" id="edit_repository" action="${h.url_for( controller='admin_toolshed', action='manage_repository', id=trans.security.encode_id( repository.id ) )}" method="post" ><div class="form-row"><label>Tool shed:</label> - ${repository.tool_shed} + ${repository.tool_shed|h} <div style="clear: both"></div></div><div class="form-row"><label>Name:</label> - ${repository.name} + ${repository.name|h} <div style="clear: both"></div></div><div class="form-row"><label>Description:</label> %if in_error_state: - ${description} + ${description|h} %else: - <input name="description" type="textfield" value="${description}" size="80"/> + <input name="description" type="textfield" value="${description|h}" size="80"/> %endif <div style="clear: both"></div></div><div class="form-row"><label>Revision:</label> - ${repository.changeset_revision} + ${repository.changeset_revision|h} </div><div class="form-row"><label>Owner:</label> - ${repository.owner} + ${repository.owner|h} </div> %if in_error_state: <div class="form-row"><label>Repository installation error:</label> - ${repository.error_message} + ${repository.error_message|h} </div> %else: <div class="form-row"><label>Location:</label> - ${repo_files_dir} + ${repo_files_dir|h} </div> %endif <div class="form-row"><label>Deleted:</label> - ${repository.deleted} + ${repository.deleted|h} </div> %if not in_error_state: <div class="form-row"> diff -r 5fc83b69fe241d469ad27235a39e93d847764bbc -r f0f1f78b54c55c8569bd1e3ed7fc15726b0b64a4 templates/admin/tool_shed_repository/manage_repository_tool_dependencies.mako --- a/templates/admin/tool_shed_repository/manage_repository_tool_dependencies.mako +++ b/templates/admin/tool_shed_repository/manage_repository_tool_dependencies.mako @@ -20,7 +20,7 @@ %endif <div class="toolForm"> - <div class="toolFormTitle">Tool shed repository '${repository.name}' tool dependencies</div> + <div class="toolFormTitle">Tool shed repository '${repository.name|h}' tool dependencies</div><% can_install = False can_uninstall = False @@ -48,16 +48,16 @@ <td> %if tool_dependency.status not in [ trans.install_model.ToolDependency.installation_status.UNINSTALLED ]: <a target="galaxy_main" href="${h.url_for( controller='admin_toolshed', action='manage_repository_tool_dependencies', operation='browse', tool_dependency_ids=trans.security.encode_id( tool_dependency.id ), repository_id=trans.security.encode_id( repository.id ) )}"> - ${tool_dependency.name} + ${tool_dependency.name|h} </a> %else: - ${tool_dependency.name} + ${tool_dependency.name|h} %endif </td> - <td>${tool_dependency.version}</td> - <td>${tool_dependency.type}</td> - <td>${tool_dependency.status}</td> - <td>${error_message}</td> + <td>${tool_dependency.version|h}</td> + <td>${tool_dependency.type|h}</td> + <td>${tool_dependency.status|h}</td> + <td>${error_message|h}</td></tr> %endfor </table> diff -r 5fc83b69fe241d469ad27235a39e93d847764bbc -r f0f1f78b54c55c8569bd1e3ed7fc15726b0b64a4 templates/admin/tool_shed_repository/purge_repository_confirmation.mako --- a/templates/admin/tool_shed_repository/purge_repository_confirmation.mako +++ b/templates/admin/tool_shed_repository/purge_repository_confirmation.mako @@ -19,14 +19,14 @@ <div class="warningmessage"><p> - Purging the repository named <b>${repository.name}</b> will result in deletion of all records for the + Purging the repository named <b>${repository.name|h}</b> will result in deletion of all records for the following associated items from the database. Click the <b>Purge</b> button to purge this repository and its associated items. </p></div><div class="toolForm"> - <div class="toolFormTitle">Purge tool shed repository <b>${repository.name}</b></div> + <div class="toolFormTitle">Purge tool shed repository <b>${repository.name|h}</b></div><form name="purge_repository" id="purge_repository" action="${h.url_for( controller='admin_toolshed', action='purge_repository', id=trans.security.encode_id( repository.id ) )}" method="post" ><% tool_versions = 0 @@ -59,11 +59,11 @@ orphan_repository_dependency_records += 1 %><table class="grid"> - <tr><td>Tool version records</td><td>${tool_versions}</td><tr> - <tr><td>Tool dependency records</td><td>${tool_dependencies}</td><tr> - <tr><td>Repository dependency records</td><td>${required_repositories}</td><tr> - <tr><td>Orphan repository_repository_dependency_association records</td><td>${orphan_repository_repository_dependency_association_records}</td><tr> - <tr><td>Orphan repository_dependency records</td><td>${orphan_repository_dependency_records}</td><tr> + <tr><td>Tool version records</td><td>${tool_versions|h}</td><tr> + <tr><td>Tool dependency records</td><td>${tool_dependencies|h}</td><tr> + <tr><td>Repository dependency records</td><td>${required_repositories|h}</td><tr> + <tr><td>Orphan repository_repository_dependency_association records</td><td>${orphan_repository_repository_dependency_association_records|h}</td><tr> + <tr><td>Orphan repository_dependency records</td><td>${orphan_repository_dependency_records|h}</td><tr></table><div style="clear: both"></div><div class="form-row"> diff -r 5fc83b69fe241d469ad27235a39e93d847764bbc -r f0f1f78b54c55c8569bd1e3ed7fc15726b0b64a4 templates/admin/tool_shed_repository/repair_repository.mako --- a/templates/admin/tool_shed_repository/repair_repository.mako +++ b/templates/admin/tool_shed_repository/repair_repository.mako @@ -37,9 +37,9 @@ </div><div class="toolForm"> - <div class="toolFormTitle">Repair tool shed repository <b>${repository.name}</b></div> + <div class="toolFormTitle">Repair tool shed repository <b>${repository.name|h}</b></div><form name="repair_repository" id="repair_repository" action="${h.url_for( controller='admin_toolshed', action='repair_repository', id=trans.security.encode_id( repository.id ) )}" method="post" > - <input type="hidden" name="repair_dict" value="${encoded_repair_dict}"/> + <input type="hidden" name="repair_dict" value="${encoded_repair_dict|h}"/><% from tool_shed.util.shed_util_common import get_tool_shed_repository_status_label ordered_repo_info_dicts = repair_dict.get( 'ordered_repo_info_dicts', [] ) diff -r 5fc83b69fe241d469ad27235a39e93d847764bbc -r f0f1f78b54c55c8569bd1e3ed7fc15726b0b64a4 templates/admin/tool_shed_repository/repository_installation_status.mako --- a/templates/admin/tool_shed_repository/repository_installation_status.mako +++ b/templates/admin/tool_shed_repository/repository_installation_status.mako @@ -1,5 +1,6 @@ <%def name="render_repository_status( repository )"><% + from markupsafe import escape if repository.status in [ trans.install_model.ToolShedRepository.installation_status.CLONING, trans.install_model.ToolShedRepository.installation_status.SETTING_TOOL_VERSIONS, trans.install_model.ToolShedRepository.installation_status.INSTALLING_TOOL_DEPENDENCIES, @@ -20,7 +21,7 @@ else: bgcolor = trans.install_model.ToolShedRepository.states.ERROR rval = '<div class="count-box state-color-%s" id="RepositoryStatus-%s">' % ( bgcolor, trans.security.encode_id( repository.id ) ) - rval += '%s</div>' % repository.status + rval += '%s</div>' % escape( repository.status ) return rval %> ${rval} diff -r 5fc83b69fe241d469ad27235a39e93d847764bbc -r f0f1f78b54c55c8569bd1e3ed7fc15726b0b64a4 templates/admin/tool_shed_repository/reselect_tool_panel_section.mako --- a/templates/admin/tool_shed_repository/reselect_tool_panel_section.mako +++ b/templates/admin/tool_shed_repository/reselect_tool_panel_section.mako @@ -62,12 +62,12 @@ <label>Shed tool configuration file:</label> ${shed_tool_conf_select_field.get_html()} <div class="toolParamHelp" style="clear: both;"> - ${select_help} + ${select_help|h} </div></div><div style="clear: both"></div> %else: - <input type="hidden" name="shed_tool_conf" value="${shed_tool_conf}"/> + <input type="hidden" name="shed_tool_conf" value="${shed_tool_conf|h}"/> %endif %if includes_tools_for_display_in_tool_panel: <div style="clear: both"></div> diff -r 5fc83b69fe241d469ad27235a39e93d847764bbc -r f0f1f78b54c55c8569bd1e3ed7fc15726b0b64a4 templates/admin/tool_shed_repository/select_shed_tool_panel_config.mako --- a/templates/admin/tool_shed_repository/select_shed_tool_panel_config.mako +++ b/templates/admin/tool_shed_repository/select_shed_tool_panel_config.mako @@ -71,7 +71,7 @@ <input type="hidden" name="includes_tools" value="${includes_tools}" /><input type="hidden" name="includes_tool_dependencies" value="${includes_tool_dependencies}" /><input type="hidden" name="includes_tools_for_display_in_tool_panel" value="${includes_tools_for_display_in_tool_panel}" /> - <input type="hidden" name="tool_shed_url" value="${tool_shed_url}" /> + <input type="hidden" name="tool_shed_url" value="${tool_shed_url|h}" /></div><div style="clear: both"></div><% readme_files_dict = containers_dict.get( 'readme_files', None ) %> @@ -111,12 +111,12 @@ <label>Shed tool configuration file:</label> ${shed_tool_conf_select_field.get_html()} <div class="toolParamHelp" style="clear: both;"> - ${select_help} + ${select_help|h} </div></div><div style="clear: both"></div> %else: - <input type="hidden" name="shed_tool_conf" value="${shed_tool_conf}"/> + <input type="hidden" name="shed_tool_conf" value="${shed_tool_conf|h}"/> %endif <div class="form-row"><input type="submit" name="select_shed_tool_panel_config_button" value="Install"/> diff -r 5fc83b69fe241d469ad27235a39e93d847764bbc -r f0f1f78b54c55c8569bd1e3ed7fc15726b0b64a4 templates/admin/tool_shed_repository/select_tool_panel_section.mako --- a/templates/admin/tool_shed_repository/select_tool_panel_section.mako +++ b/templates/admin/tool_shed_repository/select_tool_panel_section.mako @@ -111,16 +111,16 @@ <label>Shed tool configuration file:</label> ${shed_tool_conf_select_field.get_html()} <div class="toolParamHelp" style="clear: both;"> - ${select_help} + ${select_help|h} </div></div><div style="clear: both"></div> %else: - <input type="hidden" name="shed_tool_conf" value="${shed_tool_conf}"/> + <input type="hidden" name="shed_tool_conf" value="${shed_tool_conf|h}"/> %endif <div class="form-row"><label>Add new tool panel section:</label> - <input name="new_tool_panel_section_label" type="textfield" value="${new_tool_panel_section_label}" size="40"/> + <input name="new_tool_panel_section_label" type="textfield" value="${new_tool_panel_section_label|h}" size="40"/><div class="toolParamHelp" style="clear: both;"> Add a new tool panel section to contain the installed tools (optional). </div> diff -r 5fc83b69fe241d469ad27235a39e93d847764bbc -r f0f1f78b54c55c8569bd1e3ed7fc15726b0b64a4 templates/admin/tool_shed_repository/uninstall_tool_dependencies.mako --- a/templates/admin/tool_shed_repository/uninstall_tool_dependencies.mako +++ b/templates/admin/tool_shed_repository/uninstall_tool_dependencies.mako @@ -43,10 +43,10 @@ install_dir = "This dependency's installation directory does not exist, click <b>Uninstall</b> to reset for installation." %><tr> - <td>${tool_dependency.name}</td> - <td>${tool_dependency.version}</td> - <td>${tool_dependency.type}</td> - <td>${install_dir}</td> + <td>${tool_dependency.name|h}</td> + <td>${tool_dependency.version|h}</td> + <td>${tool_dependency.type|h}</td> + <td>${install_dir|h}</td></tr> %endfor </table> diff -r 5fc83b69fe241d469ad27235a39e93d847764bbc -r f0f1f78b54c55c8569bd1e3ed7fc15726b0b64a4 templates/admin/tool_shed_repository/view_tool_metadata.mako --- a/templates/admin/tool_shed_repository/view_tool_metadata.mako +++ b/templates/admin/tool_shed_repository/view_tool_metadata.mako @@ -11,7 +11,7 @@ %if tool_metadata: <p/><div class="toolForm"> - <div class="toolFormTitle">${tool_metadata[ 'name' ]} tool metadata</div> + <div class="toolFormTitle">${tool_metadata[ 'name' ]|h} tool metadata</div><div class="toolFormBody"><div class="form-row"><table width="100%"> @@ -20,41 +20,41 @@ </div><div class="form-row"><label>Name:</label> - ${tool_metadata[ 'name' ]} + ${tool_metadata[ 'name' ]|h} <div style="clear: both"></div></div> %if 'description' in tool_metadata: <div class="form-row"><label>Description:</label> - ${tool_metadata[ 'description' ]} + ${tool_metadata[ 'description' ]|h} <div style="clear: both"></div></div> %endif %if 'id' in tool_metadata: <div class="form-row"><label>Id:</label> - ${tool_metadata[ 'id' ]} + ${tool_metadata[ 'id' ]|h} <div style="clear: both"></div></div> %endif %if 'guid' in tool_metadata: <div class="form-row"><label>Guid:</label> - ${tool_metadata[ 'guid' ]} + ${tool_metadata[ 'guid' ]|h} <div style="clear: both"></div></div> %endif %if 'version' in tool_metadata: <div class="form-row"><label>Version:</label> - ${tool_metadata[ 'version' ]} + ${tool_metadata[ 'version' ]|h} <div style="clear: both"></div></div> %endif %if 'version_string_cmd' in tool_metadata: <div class="form-row"><label>Version command string:</label> - ${tool_metadata[ 'version_string_cmd' ]} + ${tool_metadata[ 'version_string_cmd' ]|h} <div style="clear: both"></div></div> %endif @@ -70,9 +70,9 @@ <tr><td> %if guid == tool_metadata[ 'guid' ]: - ${guid} <b>(this tool)</b> + ${guid|h} <b>(this tool)</b> %else: - ${guid} + ${guid|h} %endif </td></tr> @@ -109,9 +109,9 @@ requirement_type = requirement_dict[ 'type' ] or 'not provided' %><tr> - <td>${requirement_name}</td> - <td>${requirement_version}</td> - <td>${requirement_type}</td> + <td>${requirement_name|h}</td> + <td>${requirement_version|h}</td> + <td>${requirement_type|h}</td></tr> %endfor </table> @@ -130,27 +130,27 @@ </div><div class="form-row"><label>Command:</label> - <pre>${tool.command}</pre> + <pre>${tool.command|h}</pre><div style="clear: both"></div></div><div class="form-row"><label>Interpreter:</label> - ${tool.interpreter} + ${tool.interpreter|h} <div style="clear: both"></div></div><div class="form-row"><label>Is multi-byte:</label> - ${tool.is_multi_byte} + ${tool.is_multi_byte|h} <div style="clear: both"></div></div><div class="form-row"><label>Forces a history refresh:</label> - ${tool.force_history_refresh} + ${tool.force_history_refresh|h} <div style="clear: both"></div></div><div class="form-row"><label>Parallelism:</label> - ${tool.parallelism} + ${tool.parallelism|h} <div style="clear: both"></div></div> %endif @@ -181,20 +181,20 @@ required_files = test_dict[ 'required_files' ] %><tr> - <td>${test_dict[ 'name' ]}</td> + <td>${test_dict[ 'name' ]|h}</td><td> %for input in inputs: - <b>${input[0]}:</b> ${input[1]}<br/> + <b>${input[0]|h}:</b> ${input[1]|h}<br/> %endfor </td><td> %for output in outputs: - <b>${output[0]}:</b> ${output[1]}<br/> + <b>${output[0]|h}:</b> ${output[1]|h}<br/> %endfor </td><td> %for required_file in required_files: - ${required_file}<br/> + ${required_file|h}<br/> %endfor </td></tr> diff -r 5fc83b69fe241d469ad27235a39e93d847764bbc -r f0f1f78b54c55c8569bd1e3ed7fc15726b0b64a4 templates/admin/tool_shed_repository/view_workflow.mako --- a/templates/admin/tool_shed_repository/view_workflow.mako +++ b/templates/admin/tool_shed_repository/view_workflow.mako @@ -17,7 +17,7 @@ <%def name="render_workflow( workflow_name, repository_id )"><% center_url = h.url_for( controller='admin_toolshed', action='generate_workflow_image', workflow_name=tool_shed_encode( workflow_name ), repository_id=repository_id ) %> - <iframe name="workflow_image" id="workflow_image" frameborder="0" style="position: absolute; width: 100%; height: 100%;" src="${center_url}"></iframe> + <iframe name="workflow_image" id="workflow_image" frameborder="0" style="position: absolute; width: 100%; height: 100%;" src="${center_url|h}"></iframe></%def> ${render_galaxy_repository_actions( repository )} diff -r 5fc83b69fe241d469ad27235a39e93d847764bbc -r f0f1f78b54c55c8569bd1e3ed7fc15726b0b64a4 templates/admin/user/reset_password.mako --- a/templates/admin/user/reset_password.mako +++ b/templates/admin/user/reset_password.mako @@ -13,7 +13,7 @@ %for user in users: <div class="form-row"><label>Email:</label> - ${user.email} + ${user.email|h} <div style="clear: both"></div></div> %endfor diff -r 5fc83b69fe241d469ad27235a39e93d847764bbc -r f0f1f78b54c55c8569bd1e3ed7fc15726b0b64a4 templates/admin/user/user.mako --- a/templates/admin/user/user.mako +++ b/templates/admin/user/user.mako @@ -11,9 +11,9 @@ </%def><%def name="render_select( name, options )"> - <select name="${name}" id="${name}" style="min-width: 250px; height: 150px;" multiple> + <select name="${name|h}" id="${name|h}" style="min-width: 250px; height: 150px;" multiple> %for option in options: - <option value="${option[0]}">${option[1]}</option> + <option value="${option[0]|h}">${option[1]|h}</option> %endfor </select></%def> @@ -48,29 +48,29 @@ %endif <div class="toolForm"> - <div class="toolFormTitle">User '${user.email}'</div> + <div class="toolFormTitle">User '${user.email|h}'</div><div class="toolFormBody"><form name="associate_user_role_group" id="associate_user_role_group" action="${h.url_for(controller='admin', action='manage_roles_and_groups_for_user', id=trans.security.encode_id( user.id ) )}" method="post" ><div class="form-row"><div style="float: left; margin-right: 10px;"> - <label>Roles associated with '${user.email}'</label> + <label>Roles associated with '${user.email|h}'</label> ${render_select( "in_roles", in_roles )}<br/><input type="submit" id="roles_remove_button" value=">>"/></div><div> - <label>Roles not associated with '${user.email}'</label> + <label>Roles not associated with '${user.email|h}'</label> ${render_select( "out_roles", out_roles )}<br/><input type="submit" id="roles_add_button" value="<<"/></div></div><div class="form-row"><div style="float: left; margin-right: 10px;"> - <label>Groups associated with '${user.email}'</label> + <label>Groups associated with '${user.email|h}'</label> ${render_select( "in_groups", in_groups )}<br/><input type="submit" id="groups_remove_button" value=">>"/></div><div> - <label>Groups not associated with '${user.email}'</label> + <label>Groups not associated with '${user.email|h}'</label> ${render_select( "out_groups", out_groups )}<br/><input type="submit" id="groups_add_button" value="<<"/></div> diff -r 5fc83b69fe241d469ad27235a39e93d847764bbc -r f0f1f78b54c55c8569bd1e3ed7fc15726b0b64a4 templates/admin/view_datatypes_registry.mako --- a/templates/admin/view_datatypes_registry.mako +++ b/templates/admin/view_datatypes_registry.mako @@ -37,16 +37,16 @@ %else: <tr class="tr"> %endif - <td>${datatype.extension}</td> - <td>${datatype.dtype}</td> + <td>${datatype.extension|h}</td> + <td>${datatype.dtype|h}</td><td> %if datatype.mimetype: - ${datatype.mimetype} + ${datatype.mimetype|h} %endif </td><td> %if datatype.display_in_upload: - ${datatype.display_in_upload} + ${datatype.display_in_upload|h} %endif </td></tr> diff -r 5fc83b69fe241d469ad27235a39e93d847764bbc -r f0f1f78b54c55c8569bd1e3ed7fc15726b0b64a4 templates/base.mako --- a/templates/base.mako +++ b/templates/base.mako @@ -39,7 +39,7 @@ <script> Raven.config('${app.config.sentry_dsn_public}').install(); %if trans.user: - Raven.setUser( { email: "${trans.user.email}" } ); + Raven.setUser( { email: "${trans.user.email|h}" } ); %endif </script> %endif diff -r 5fc83b69fe241d469ad27235a39e93d847764bbc -r f0f1f78b54c55c8569bd1e3ed7fc15726b0b64a4 templates/galaxy_client_app.mako --- a/templates/galaxy_client_app.mako +++ b/templates/galaxy_client_app.mako @@ -70,11 +70,12 @@ ## Return a dictionary of user or anonymous user data including: ## email, id, disk space used, quota percent, and tags used <% + from markupsafe import escape user_dict = {} try: if trans.user: user_dict = trans.user.to_dict( view='element', - value_mapper={ 'id': trans.security.encode_id, 'total_disk_usage': float } ) + value_mapper={ 'id': trans.security.encode_id, 'total_disk_usage': float, 'email': escape, 'username': escape } ) user_dict[ 'quota_percent' ] = trans.app.quota_agent.get_percent( trans=trans ) user_dict[ 'is_admin' ] = trans.user_is_admin() diff -r 5fc83b69fe241d469ad27235a39e93d847764bbc -r f0f1f78b54c55c8569bd1e3ed7fc15726b0b64a4 templates/user/index.mako --- a/templates/user/index.mako +++ b/templates/user/index.mako @@ -2,7 +2,7 @@ %if trans.user: <h2>${_('User preferences')}</h2> - <p>You are currently logged in as ${trans.user.email}.</p> + <p>You are currently logged in as ${trans.user.email|h}.</p><ul> %if t.webapp.name == 'galaxy': %if not trans.app.config.use_remote_user: diff -r 5fc83b69fe241d469ad27235a39e93d847764bbc -r f0f1f78b54c55c8569bd1e3ed7fc15726b0b64a4 templates/webapps/galaxy/admin/tool_sheds.mako --- a/templates/webapps/galaxy/admin/tool_sheds.mako +++ b/templates/webapps/galaxy/admin/tool_sheds.mako @@ -22,7 +22,7 @@ <tr class="libraryTitle"><td><div style="float: left; margin-left: 1px;" class="menubutton split popup" id="dataset-${shed_id}-popup"> - <a class="view-info" href="${h.url_for( controller='admin_toolshed', action='browse_tool_shed', tool_shed_url=url )}">${name}</a> + <a class="view-info" href="${h.url_for( controller='admin_toolshed', action='browse_tool_shed', tool_shed_url=url )}">${name|h}</a></div><div popupmenu="dataset-${shed_id}-popup"><a class="action-button" href="${h.url_for( controller='admin_toolshed', action='browse_tool_shed', tool_shed_url=url )}">Browse valid repositories</a> diff -r 5fc83b69fe241d469ad27235a39e93d847764bbc -r f0f1f78b54c55c8569bd1e3ed7fc15726b0b64a4 templates/webapps/galaxy/dataset/errors.mako --- a/templates/webapps/galaxy/dataset/errors.mako +++ b/templates/webapps/galaxy/dataset/errors.mako @@ -95,7 +95,7 @@ <input type="hidden" name="id" value="${trans.security.encode_id( hda.id)}" /><div class="form-row"><label>Your email</label> - <input type="text" name="email" size="40" value="${user_email}" /> + <input type="text" name="email" size="40" value="${user_email|h}" /></div><div class="form-row"><label>Message</label> diff -r 5fc83b69fe241d469ad27235a39e93d847764bbc -r f0f1f78b54c55c8569bd1e3ed7fc15726b0b64a4 templates/webapps/galaxy/galaxy.masthead.mako --- a/templates/webapps/galaxy/galaxy.masthead.mako +++ b/templates/webapps/galaxy/galaxy.masthead.mako @@ -3,6 +3,7 @@ ## masthead head generator <%def name="load(active_view = None)"><% + from markupsafe import escape ## get configuration masthead_config = { ## inject configuration @@ -32,7 +33,7 @@ ## user details 'user' : { 'requests' : bool(trans.user and (trans.user.requests or trans.app.security_agent.get_accessible_request_types(trans, trans.user))), - 'email' : trans.user.email if (trans.user) else "", + 'email' : escape( trans.user.email ) if (trans.user) else "", 'valid' : bool(trans.user != None), 'json' : get_user_dict() } diff -r 5fc83b69fe241d469ad27235a39e93d847764bbc -r f0f1f78b54c55c8569bd1e3ed7fc15726b0b64a4 templates/webapps/galaxy/galaxy.panels.mako --- a/templates/webapps/galaxy/galaxy.panels.mako +++ b/templates/webapps/galaxy/galaxy.panels.mako @@ -49,7 +49,7 @@ <script> Raven.config('${app.config.sentry_dsn_public}').install(); %if trans.user: - Raven.setUser( { email: "${trans.user.email}" } ); + Raven.setUser( { email: "${trans.user.email|h}" } ); %endif </script> %endif diff -r 5fc83b69fe241d469ad27235a39e93d847764bbc -r f0f1f78b54c55c8569bd1e3ed7fc15726b0b64a4 templates/webapps/tool_shed/base_panels.mako --- a/templates/webapps/tool_shed/base_panels.mako +++ b/templates/webapps/tool_shed/base_panels.mako @@ -91,7 +91,8 @@ %> ## User tabs. - <% + <% + from markupsafe import escape # Menu for user who is not logged in. menu_options = [ [ _("Login"), h.url_for( controller='/user', action='login' ), "galaxy_main" ] ] if app.config.allow_user_creation: @@ -101,7 +102,7 @@ tab( "user", _("User"), None, visible=visible, menu_options=menu_options ) # Menu for user who is logged in. if trans.user: - email = trans.user.email + email = escape( trans.user.email ) else: email = "" menu_options = [ [ '<a>Logged in as <span id="user-email">%s</span></a>' % email ] ] Repository URL: https://bitbucket.org/galaxy/galaxy-central/ -- This is a commit notification from bitbucket.org. You are receiving this because you have the service enabled, addressing the recipient of this email.

1 0

commit/galaxy-central: 3 new changesets
by commits-noreply＠bitbucket.org 11 Dec '14

11 Dec '14

3 new commits in galaxy-central: https://bitbucket.org/galaxy/galaxy-central/commits/a4b74b3d6f0d/ Changeset: a4b74b3d6f0d Branch: stable User: davebgx Date: 2014-12-10 16:31:21+00:00 Summary: Escape anything that could be user input in mako templates, add markupsafe.escape to username and email in users API controller. Affected #: 46 files diff -r 2db0fb9594d6c315e4e0a4be70f64373cfc708f6 -r a4b74b3d6f0d14a38a3f17c2a437b8968563a114 lib/galaxy/webapps/galaxy/api/users.py --- a/lib/galaxy/webapps/galaxy/api/users.py +++ b/lib/galaxy/webapps/galaxy/api/users.py @@ -11,6 +11,7 @@ from galaxy.web.base.controller import BaseAPIController, UsesTagsMixin from galaxy.web.base.controller import CreatesApiKeysMixin from galaxy.web.base.controller import CreatesUsersMixin +from markupsafe import escape log = logging.getLogger( __name__ ) @@ -38,10 +39,10 @@ query = query.filter( trans.app.model.User.table.c.deleted == False ) # noqa # special case: user can see only their own user if not trans.user_is_admin(): - item = trans.user.to_dict( value_mapper={ 'id': trans.security.encode_id } ) + item = trans.user.to_dict( value_mapper={ 'id': trans.security.encode_id, 'email': escape } ) return [item] for user in query: - item = user.to_dict( value_mapper={ 'id': trans.security.encode_id } ) + item = user.to_dict( value_mapper={ 'id': trans.security.encode_id, 'email': escape } ) # TODO: move into api_values rval.append( item ) return rval @@ -78,7 +79,9 @@ else: raise HTTPBadRequest( detail='Invalid user id ( %s ) specified' % id ) item = user.to_dict( view='element', value_mapper={ 'id': trans.security.encode_id, - 'total_disk_usage': float } ) + 'total_disk_usage': float, + 'email': escape, + 'username': escape } ) # add a list of tags used by the user (as strings) item[ 'tags_used' ] = self.get_user_tags_used( trans, user=user ) # TODO: move into api_values (needs trans, tho - can we do that with api_keys/@property??) diff -r 2db0fb9594d6c315e4e0a4be70f64373cfc708f6 -r a4b74b3d6f0d14a38a3f17c2a437b8968563a114 templates/admin/dataset_security/group/group.mako --- a/templates/admin/dataset_security/group/group.mako +++ b/templates/admin/dataset_security/group/group.mako @@ -11,9 +11,9 @@ </%def><%def name="render_select( name, options )"> - <select name="${name}" id="${name}" style="min-width: 250px; height: 150px;" multiple> + <select name="${name|h}" id="${name|h}" style="min-width: 250px; height: 150px;" multiple> %for option in options: - <option value="${option[0]}">${option[1]}</option> + <option value="${option[0]|h}">${option[1]|h}</option> %endfor </select></%def> @@ -48,29 +48,29 @@ %endif <div class="toolForm"> - <div class="toolFormTitle">Group '${group.name}'</div> + <div class="toolFormTitle">Group '${group.name|h}'</div><div class="toolFormBody"><form name="associate_group_role_user" id="associate_group_role_user" action="${h.url_for(controller='admin', action='manage_users_and_roles_for_group', id=trans.security.encode_id( group.id ) )}" method="post" ><div class="form-row"><div style="float: left; margin-right: 10px;"> - <label>Roles associated with '${group.name}'</label> + <label>Roles associated with '${group.name|h}'</label> ${render_select( "in_roles", in_roles )}<br/><input type="submit" id="roles_remove_button" value=">>"/></div><div> - <label>Roles not associated with '${group.name}'</label> + <label>Roles not associated with '${group.name|h}'</label> ${render_select( "out_roles", out_roles )}<br/><input type="submit" id="roles_add_button" value="<<"/></div></div><div class="form-row"><div style="float: left; margin-right: 10px;"> - <label>Users associated with '${group.name}'</label> + <label>Users associated with '${group.name|h}'</label> ${render_select( "in_users", in_users )}<br/><input type="submit" id="users_remove_button" value=">>"/></div><div> - <label>Users not associated with '${group.name}'</label> + <label>Users not associated with '${group.name|h}'</label> ${render_select( "out_users", out_users )}<br/><input type="submit" id="users_add_button" value="<<"/></div> diff -r 2db0fb9594d6c315e4e0a4be70f64373cfc708f6 -r a4b74b3d6f0d14a38a3f17c2a437b8968563a114 templates/admin/dataset_security/group/group_create.mako --- a/templates/admin/dataset_security/group/group_create.mako +++ b/templates/admin/dataset_security/group/group_create.mako @@ -11,9 +11,9 @@ </%def><%def name="render_select( name, options )"> - <select name="${name}" id="${name}" style="min-width: 250px; height: 150px;" multiple> + <select name="${name|h}" id="${name|h}" style="min-width: 250px; height: 150px;" multiple> %for option in options: - <option value="${option[0]}">${option[1]}</option> + <option value="${option[0]|h}">${option[1]|h}</option> %endfor </select></%def> @@ -60,7 +60,7 @@ <form name="associate_group_role_user" id="associate_group_role_user" action="${h.url_for(controller='admin', action='create_group' )}" method="post" ><div class="form-row"><label>Name:</label> - <input name="name" type="textfield" value="${name}" size=40"/> + <input name="name" type="textfield" value="${name|h}" size=40"/></div><div class="form-row"><div style="float: left; margin-right: 10px;"> diff -r 2db0fb9594d6c315e4e0a4be70f64373cfc708f6 -r a4b74b3d6f0d14a38a3f17c2a437b8968563a114 templates/admin/dataset_security/group/group_rename.mako --- a/templates/admin/dataset_security/group/group_rename.mako +++ b/templates/admin/dataset_security/group/group_rename.mako @@ -12,7 +12,7 @@ <div class="form-row"><label>Name:</label><div style="float: left; width: 250px; margin-right: 10px;"> - <input type="text" name="name" value="${group.name}" size="40"/> + <input type="text" name="name" value="${group.name|h}" size="40"/></div><div style="clear: both"></div></div> diff -r 2db0fb9594d6c315e4e0a4be70f64373cfc708f6 -r a4b74b3d6f0d14a38a3f17c2a437b8968563a114 templates/admin/dataset_security/role/role.mako --- a/templates/admin/dataset_security/role/role.mako +++ b/templates/admin/dataset_security/role/role.mako @@ -11,9 +11,9 @@ </%def><%def name="render_select( name, options )"> - <select name="${name}" id="${name}" style="min-width: 250px; height: 150px;" multiple> + <select name="${name|h}" id="${name|h}" style="min-width: 250px; height: 150px;" multiple> %for option in options: - <option value="${option[0]}">${option[1]}</option> + <option value="${option[0]|h}">${option[1]|h}</option> %endfor </select></%def> @@ -48,29 +48,29 @@ %endif <div class="toolForm"> - <div class="toolFormTitle">Role '${role.name}'</div> + <div class="toolFormTitle">Role '${role.name|h}'</div><div class="toolFormBody"><form name="associate_role_user_group" id="associate_role_user_group" action="${h.url_for(controller='admin', action='manage_users_and_groups_for_role', id=trans.security.encode_id( role.id ) )}" method="post" ><div class="form-row"><div style="float: left; margin-right: 10px;"> - <label>Users associated with '${role.name}'</label> + <label>Users associated with '${role.name|h}'</label> ${render_select( "in_users", in_users )}<br/><input type="submit" id="users_remove_button" value=">>"/></div><div> - <label>Users not associated with '${role.name}'</label> + <label>Users not associated with '${role.name|h}'</label> ${render_select( "out_users", out_users )}<br/><input type="submit" id="users_add_button" value="<<"/></div></div><div class="form-row"><div style="float: left; margin-right: 10px;"> - <label>Groups associated with '${role.name}'</label> + <label>Groups associated with '${role.name|h}'</label> ${render_select( "in_groups", in_groups )}<br/><input type="submit" id="groups_remove_button" value=">>"/></div><div> - <label>Groups not associated with '${role.name}'</label> + <label>Groups not associated with '${role.name|h}'</label> ${render_select( "out_groups", out_groups )}<br/><input type="submit" id="groups_add_button" value="<<"/></div> @@ -84,7 +84,7 @@ <br clear="left"/><br/> %if len( library_dataset_actions ) > 0: - <h3>Data library datasets associated with role '${role.name}'</h3> + <h3>Data library datasets associated with role '${role.name|h}'</h3><table class="manage-table colored" border="0" cellspacing="0" cellpadding="0" width="100%"><tr><td> @@ -92,16 +92,16 @@ %for ctr, library, in enumerate( library_dataset_actions.keys() ): <li><img src="${h.url_for( '/static/images/silk/book_open.png' )}" class="rowIcon"/> - ${library.name} + ${library.name|h} <ul> %for folder_path, permissions in library_dataset_actions[ library ].items(): <li><img src="/static/images/silk/folder_page.png" class="rowIcon"/> - ${folder_path} + ${folder_path|h} <ul> % for permission in permissions: <ul> - <li>${permission}</li> + <li>${permission|h}</li></ul> %endfor </ul> diff -r 2db0fb9594d6c315e4e0a4be70f64373cfc708f6 -r a4b74b3d6f0d14a38a3f17c2a437b8968563a114 templates/admin/dataset_security/role/role_create.mako --- a/templates/admin/dataset_security/role/role_create.mako +++ b/templates/admin/dataset_security/role/role_create.mako @@ -11,9 +11,9 @@ </%def><%def name="render_select( name, options )"> - <select name="${name}" id="${name}" style="min-width: 250px; height: 150px;" multiple> + <select name="${name|h}" id="${name|h}" style="min-width: 250px; height: 150px;" multiple> %for option in options: - <option value="${option[0]}">${option[1]}</option> + <option value="${option[0]|h}">${option[1]|h}</option> %endfor </select></%def> @@ -60,11 +60,11 @@ <form name="associate_role_group_user" id="associate_role_group_user" action="${h.url_for(controller='admin', action='create_role' )}" method="post" ><div class="form-row"><label>Name:</label> - <input name="name" type="textfield" value="${name}" size=40"/> + <input name="name" type="textfield" value="${name|h}" size=40"/></div><div class="form-row"><label>Description:</label> - <input name="description" type="textfield" value="${description}" size=40"/> + <input name="description" type="textfield" value="${description|h}" size=40"/></div><div class="form-row"><div style="float: left; margin-right: 10px;"> diff -r 2db0fb9594d6c315e4e0a4be70f64373cfc708f6 -r a4b74b3d6f0d14a38a3f17c2a437b8968563a114 templates/admin/dataset_security/role/role_rename.mako --- a/templates/admin/dataset_security/role/role_rename.mako +++ b/templates/admin/dataset_security/role/role_rename.mako @@ -12,14 +12,14 @@ <div class="form-row"><label>Name:</label><div style="float: left; width: 250px; margin-right: 10px;"> - <input type="text" name="name" value="${role.name}" size="40"/> + <input type="text" name="name" value="${role.name|h}" size="40"/></div><div style="clear: both"></div></div><div class="form-row"><label>Description:</label><div style="float: left; width: 250px; margin-right: 10px;"> - <input name="description" type="textfield" value="${role.description}" size=40"/> + <input name="description" type="textfield" value="${role.description|h}" size=40"/></div><div style="clear: both"></div></div> diff -r 2db0fb9594d6c315e4e0a4be70f64373cfc708f6 -r a4b74b3d6f0d14a38a3f17c2a437b8968563a114 templates/admin/external_service/create_external_service.mako --- a/templates/admin/external_service/create_external_service.mako +++ b/templates/admin/external_service/create_external_service.mako @@ -12,10 +12,10 @@ %if widgets: %for i, field in enumerate( widgets ): <div class="form-row"> - <label>${field['label']}:</label> + <label>${field['label']|h}:</label> ${field['widget'].get_html()} <div class="toolParamHelp" style="clear: both;"> - ${field['helptext']} + ${field['helptext']|h} </div><div style="clear: both"></div></div> diff -r 2db0fb9594d6c315e4e0a4be70f64373cfc708f6 -r a4b74b3d6f0d14a38a3f17c2a437b8968563a114 templates/admin/external_service/edit_external_service.mako --- a/templates/admin/external_service/edit_external_service.mako +++ b/templates/admin/external_service/edit_external_service.mako @@ -25,10 +25,10 @@ <div class="toolFormTitle">Edit external service</div> %for i, field in enumerate( widgets ): <div class="form-row"> - <label>${field['label']}:</label> + <label>${field['label']|h}:</label> ${field['widget'].get_html()} <div class="toolParamHelp" style="clear: both;"> - ${field['helptext']} + ${field['helptext']|h} </div><div style="clear: both"></div></div> diff -r 2db0fb9594d6c315e4e0a4be70f64373cfc708f6 -r a4b74b3d6f0d14a38a3f17c2a437b8968563a114 templates/admin/jobs.mako --- a/templates/admin/jobs.mako +++ b/templates/admin/jobs.mako @@ -63,12 +63,12 @@ </td><td>${job.id}</td> %if job.history and job.history.user: - <td>${job.history.user.email}</td> + <td>${job.history.user.email|h}</td> %else: <td>anonymous</td> %endif <td>${last_updated[job.id]} ago</td> - <td>${job.tool_id}</td> + <td>${job.tool_id|h}</td><td>${job.state}</td><% try: @@ -77,8 +77,8 @@ inputs = 'Unable to determine inputs' %><td>${inputs}</td> - <td>${job.command_line}</td> - <td>${job.job_runner_name}</td> + <td>${job.command_line|h}</td> + <td>${job.job_runner_name|h}</td><td>${job.job_runner_external_id}</td></tr> %endfor @@ -131,12 +131,12 @@ %for job in recent_jobs: <td><a href="${h.url_for( controller="admin", action="job_info" )}?jobid=${job.id}">${job.id}</a></td> %if job.history and job.history.user: - <td>${job.history.user.email}</td> + <td>${job.history.user.email|h}</td> %else: <td>anonymous</td> %endif <td>${finished[job.id]} ago</td> - <td>${job.tool_id}</td> + <td>${job.tool_id|h}</td><td>${job.state}</td><% try: @@ -145,9 +145,9 @@ inputs = 'Unable to determine inputs' %><td>${inputs}</td> - <td>${job.command_line}</td> - <td>${job.job_runner_name}</td> - <td>${job.job_runner_external_id}</td> + <td>${job.command_line|h}</td> + <td>${job.job_runner_name|h}</td> + <td>${job.job_runner_external_id|h}</td></tr> %endfor </table> diff -r 2db0fb9594d6c315e4e0a4be70f64373cfc708f6 -r a4b74b3d6f0d14a38a3f17c2a437b8968563a114 templates/admin/memdump.mako --- a/templates/admin/memdump.mako +++ b/templates/admin/memdump.mako @@ -55,7 +55,7 @@ <br/> You are here: ${breadcrumb}<br/> %if breadcrumb.endswith( 'theone' ): - ${heap} + ${heap|h} %else: <nobr> Sort: diff -r 2db0fb9594d6c315e4e0a4be70f64373cfc708f6 -r a4b74b3d6f0d14a38a3f17c2a437b8968563a114 templates/admin/package_tool.mako --- a/templates/admin/package_tool.mako +++ b/templates/admin/package_tool.mako @@ -28,9 +28,9 @@ <select name="tool_id"> %for key, val in toolbox.tool_panel.items(): %if isinstance( val, Tool ): - <option value="${val.id}">${val.name}</option> + <option value="${val.id|h}">${val.name|h}</option> %elif isinstance( val, ToolSection ): - <optgroup label="${val.name}"> + <optgroup label="${val.name|h}"><% section = val %> %for section_key, section_val in section.elems.items(): %if isinstance( section_val, Tool ): @@ -38,7 +38,7 @@ %if section_val.id == tool_id: <% selected_str = " selected=\"selected\"" %> %endif - <option value="${section_val.id}"${selected_str}>${section_val.name}</option> + <option value="${section_val.id|h}"${selected_str}>${section_val.name|h}</option> %endif %endfor %endif diff -r 2db0fb9594d6c315e4e0a4be70f64373cfc708f6 -r a4b74b3d6f0d14a38a3f17c2a437b8968563a114 templates/admin/quota/quota.mako --- a/templates/admin/quota/quota.mako +++ b/templates/admin/quota/quota.mako @@ -11,9 +11,9 @@ </%def><%def name="render_select( name, options )"> - <select name="${name}" id="${name}" style="min-width: 250px; height: 150px;" multiple> + <select name="${name|h}" id="${name|h}" style="min-width: 250px; height: 150px;" multiple> %for option in options: - <option value="${option[0]}">${option[1]}</option> + <option value="${option[0]|h}">${option[1]|h}</option> %endfor </select></%def> @@ -48,29 +48,29 @@ %endif <div class="toolForm"> - <div class="toolFormTitle">Quota '${name}'</div> + <div class="toolFormTitle">Quota '${name|h}'</div><div class="toolFormBody"><form name="associate_quota_user_group" id="associate_quota_user_group" action="${h.url_for(controller='admin', action='manage_users_and_groups_for_quota', id=id )}" method="post" ><div class="form-row"><div style="float: left; margin-right: 10px;"> - <label>Users associated with '${name}'</label> + <label>Users associated with '${name|h}'</label> ${render_select( "in_users", in_users )}<br/><input type="submit" id="users_remove_button" value=">>"/></div><div> - <label>Users not associated with '${name}'</label> + <label>Users not associated with '${name|h}'</label> ${render_select( "out_users", out_users )}<br/><input type="submit" id="users_add_button" value="<<"/></div></div><div class="form-row"><div style="float: left; margin-right: 10px;"> - <label>Groups associated with '${name}'</label> + <label>Groups associated with '${name|h}'</label> ${render_select( "in_groups", in_groups )}<br/><input type="submit" id="groups_remove_button" value=">>"/></div><div> - <label>Groups not associated with '${name}'</label> + <label>Groups not associated with '${name|h}'</label> ${render_select( "out_groups", out_groups )}<br/><input type="submit" id="groups_add_button" value="<<"/></div> diff -r 2db0fb9594d6c315e4e0a4be70f64373cfc708f6 -r a4b74b3d6f0d14a38a3f17c2a437b8968563a114 templates/admin/quota/quota_create.mako --- a/templates/admin/quota/quota_create.mako +++ b/templates/admin/quota/quota_create.mako @@ -11,9 +11,9 @@ </%def><%def name="render_select( name, options )"> - <select name="${name}" id="${name}" style="min-width: 250px; height: 150px;" multiple> + <select name="${name|h}" id="${name|h}" style="min-width: 250px; height: 150px;" multiple> %for option in options: - <option value="${option[0]}">${option[1]}</option> + <option value="${option[0]|h}">${option[1]|h}</option> %endfor </select></%def> @@ -69,15 +69,15 @@ <form name="associate_quota_group_user" id="associate_quota_group_user" action="${h.url_for(controller='admin', action='create_quota' )}" method="post" ><div class="form-row"><label>Name:</label> - <input name="name" type="textfield" value="${name}" size=40"/> + <input name="name" type="textfield" value="${name|h}" size=40"/></div><div class="form-row"><label>Description:</label> - <input name="description" type="textfield" value="${description}" size=40"/> + <input name="description" type="textfield" value="${description|h}" size=40"/></div><div class="form-row"><label>Amount</label> - <input name="amount" type="textfield" value="${amount}" size=40"/> + <input name="amount" type="textfield" value="${amount|h}" size=40"/><div class="toolParamHelp" style="clear: both;"> Examples: "10000MB", "99 gb", "0.2T", "unlimited" </div> diff -r 2db0fb9594d6c315e4e0a4be70f64373cfc708f6 -r a4b74b3d6f0d14a38a3f17c2a437b8968563a114 templates/admin/quota/quota_edit.mako --- a/templates/admin/quota/quota_edit.mako +++ b/templates/admin/quota/quota_edit.mako @@ -29,7 +29,7 @@ <input name="id" type="hidden" value="${id}"/><div class="form-row"><label>Amount</label> - <input name="amount" type="textfield" value="${display_amount}" size=40"/> + <input name="amount" type="textfield" value="${display_amount|h}" size=40"/><div class="toolParamHelp" style="clear: both;"> Examples: "10000MB", "99 gb", "0.2T", "unlimited" </div> diff -r 2db0fb9594d6c315e4e0a4be70f64373cfc708f6 -r a4b74b3d6f0d14a38a3f17c2a437b8968563a114 templates/admin/quota/quota_rename.mako --- a/templates/admin/quota/quota_rename.mako +++ b/templates/admin/quota/quota_rename.mako @@ -21,14 +21,14 @@ <div class="form-row"><label>Name:</label><div style="float: left; width: 250px; margin-right: 10px;"> - <input type="text" name="name" value="${name}" size="40"/> + <input type="text" name="name" value="${name|h}" size="40"/></div><div style="clear: both"></div></div><div class="form-row"><label>Description:</label><div style="float: left; width: 250px; margin-right: 10px;"> - <input name="description" type="textfield" value="${description}" size=40"/> + <input name="description" type="textfield" value="${description|h}" size=40"/></div><div style="clear: both"></div></div> diff -r 2db0fb9594d6c315e4e0a4be70f64373cfc708f6 -r a4b74b3d6f0d14a38a3f17c2a437b8968563a114 templates/admin/reload_tool.mako --- a/templates/admin/reload_tool.mako +++ b/templates/admin/reload_tool.mako @@ -28,9 +28,9 @@ <select name="tool_id"> %for key, val in toolbox.tool_panel.items(): %if isinstance( val, Tool ): - <option value="${val.id}">${val.name}</option> + <option value="${val.id}">${val.name|h}</option> %elif isinstance( val, ToolSection ): - <optgroup label="${val.name}"> + <optgroup label="${val.name|h}"><% section = val %> %for section_key, section_val in section.elems.items(): %if isinstance( section_val, Tool ): @@ -38,7 +38,7 @@ %if section_val.id == tool_id: <% selected_str = " selected=\"selected\"" %> %endif - <option value="${section_val.id}"${selected_str}>${section_val.name}</option> + <option value="${section_val.id}"${selected_str}>${section_val.name|h}</option> %endif %endfor %endif diff -r 2db0fb9594d6c315e4e0a4be70f64373cfc708f6 -r a4b74b3d6f0d14a38a3f17c2a437b8968563a114 templates/admin/review_tool_migration_stages.mako --- a/templates/admin/review_tool_migration_stages.mako +++ b/templates/admin/review_tool_migration_stages.mako @@ -4,7 +4,9 @@ %if message: ${render_msg( message, status )} %endif - +<% +from markupsafe import escape +%><div class="toolForm"><div class="toolFormTitle">Tool migrations that can be performed on this Galaxy instance</div><div class="toolFormBody"> @@ -51,7 +53,7 @@ repository_names.sort() repository_names = ', '.join( repository_names ) %> - <tr><td bgcolor="#D8D8D8"><b>Tool migration stage ${stage} - repositories: ${repository_names}</b></td></tr> + <tr><td bgcolor="#D8D8D8"><b>Tool migration stage ${stage} - repositories: ${repository_names|h}</b></td></tr><tr><td bgcolor="#FFFFCC"><div class="form-row"> @@ -59,11 +61,11 @@ <p> %if tool_dependencies: This migration stage includes tools that have tool dependencies that can be automatically installed. To install them, run:<br/> - <b>${install_dependencies}</b><br/><br/> + <b>${install_dependencies|h}</b><br/><br/> To skip tool dependency installation run:<br/> - <b>${migration_command}</b> + <b>${migration_command|h}</b> %else: - <b>${migration_command}</b> + <b>${migration_command|h}</b> %endif </p></div> @@ -74,7 +76,7 @@ <tr><td bgcolor="#DADFEF"><div class="form-row"> - <b>Repository:</b> ${repository_name} + <b>Repository:</b> ${repository_name|h} </div></td></tr> @@ -88,10 +90,10 @@ </tr> %for tool_dependencies_tup in tool_dependencies: <% - tool_dependency_name = tool_dependencies_tup[0] - tool_dependency_version = tool_dependencies_tup[1] - tool_dependency_type = tool_dependencies_tup[2] - installation_requirements = tool_dependencies_tup[3].replace( '\n', '<br/>' ) + tool_dependency_name = escape( tool_dependencies_tup[0] ) + tool_dependency_version = escape( tool_dependencies_tup[1] ) + tool_dependency_type = escape( tool_dependencies_tup[2] ) + installation_requirements = escape( tool_dependencies_tup[3] ).replace( '\n', '<br/>' ) %><tr><td> diff -r 2db0fb9594d6c315e4e0a4be70f64373cfc708f6 -r a4b74b3d6f0d14a38a3f17c2a437b8968563a114 templates/admin/tool_shed_repository/browse_repository.mako --- a/templates/admin/tool_shed_repository/browse_repository.mako +++ b/templates/admin/tool_shed_repository/browse_repository.mako @@ -21,7 +21,7 @@ %endif <div class="toolForm"> - <div class="toolFormTitle">Browse ${repository.name} revision ${repository.changeset_revision} files</div> + <div class="toolFormTitle">Browse ${repository.name|h} revision ${repository.changeset_revision} files</div><div class="toolFormBody"><div class="form-row" ><label>Contents:</label> diff -r 2db0fb9594d6c315e4e0a4be70f64373cfc708f6 -r a4b74b3d6f0d14a38a3f17c2a437b8968563a114 templates/admin/tool_shed_repository/browse_tool_dependency.mako --- a/templates/admin/tool_shed_repository/browse_tool_dependency.mako +++ b/templates/admin/tool_shed_repository/browse_tool_dependency.mako @@ -23,33 +23,33 @@ %endif <div class="toolForm"> - <div class="toolFormTitle">Browse tool dependency ${tool_dependency.name} installation directory</div> + <div class="toolFormTitle">Browse tool dependency ${tool_dependency.name|h} installation directory</div><div class="toolFormBody"><div class="form-row" ><label>Tool shed repository:</label> - ${repository.name} + ${repository.name|h} <div style="clear: both"></div></div><div class="form-row" ><label>Tool shed repository changeset revision:</label> - ${repository.changeset_revision} + ${repository.changeset_revision|h} <div style="clear: both"></div></div><div class="form-row" ><label>Tool dependency status:</label> - ${tool_dependency.status} + ${tool_dependency.status|h} <div style="clear: both"></div></div> %if tool_dependency.in_error_state: <div class="form-row" ><label>Tool dependency installation error:</label> - ${tool_dependency.error_message} + ${tool_dependency.error_message|h} <div style="clear: both"></div></div> %endif <div class="form-row" ><label>Tool dependency installation directory:</label> - ${tool_dependency.installation_directory( trans.app )} + ${tool_dependency.installation_directory( trans.app )|h} <div style="clear: both"></div></div><div class="form-row" > diff -r 2db0fb9594d6c315e4e0a4be70f64373cfc708f6 -r a4b74b3d6f0d14a38a3f17c2a437b8968563a114 templates/admin/tool_shed_repository/common.mako --- a/templates/admin/tool_shed_repository/common.mako +++ b/templates/admin/tool_shed_repository/common.mako @@ -8,7 +8,7 @@ }); // --- Initialize sample trees $("#tree").dynatree({ - title: "${title_text}", + title: "${title_text|h}", rootVisible: true, minExpandLevel: 0, // 1: root node is not collapsible persist: false, @@ -24,7 +24,7 @@ // initAjax is hard to fake, so we pass the children as object array: initAjax: {url: "${h.url_for( controller='admin_toolshed', action='open_folder' )}", dataType: "json", - data: { folder_path: "${directory_path}" }, + data: { folder_path: "${directory_path|h}" }, }, onLazyRead: function(dtnode){ dtnode.appendAjax({ @@ -45,7 +45,7 @@ var cell = $("#file_contents"); var selected_value; if (dtnode.data.key == 'root') { - selected_value = "${directory_path}/"; + selected_value = "${directory_path|h}/"; } else { selected_value = dtnode.data.key; }; @@ -81,6 +81,7 @@ line-break:strict; } </style><% + from markupsafe import escape class RowCounter( object ): def __init__( self ): self.count = 0 @@ -96,7 +97,7 @@ env_settings_heaader_row_displayed = False package_header_row_displayed = False if revision_label: - revision_label_str = ' revision <b>%s</b> of ' % str( revision_label ) + revision_label_str = ' revision <b>%s</b> of ' % escape( str( revision_label ) ) else: revision_label_str = ' ' %> @@ -104,7 +105,7 @@ <div class="toolParamHelp" style="clear: both;"><p> %if export: - The following additional repositories are required by${revision_label_str}the <b>${repository.name}</b> repository + The following additional repositories are required by${revision_label_str}the <b>${repository.name|h}</b> repository and they can be exported as well. %else: These dependencies can be automatically handled with${revision_label_str}the installed repository, providing significant diff -r 2db0fb9594d6c315e4e0a4be70f64373cfc708f6 -r a4b74b3d6f0d14a38a3f17c2a437b8968563a114 templates/admin/tool_shed_repository/deactivate_or_uninstall_repository.mako --- a/templates/admin/tool_shed_repository/deactivate_or_uninstall_repository.mako +++ b/templates/admin/tool_shed_repository/deactivate_or_uninstall_repository.mako @@ -10,30 +10,30 @@ %endif <div class="toolForm"> - <div class="toolFormTitle">${repository.name}</div> + <div class="toolFormTitle">${repository.name|h}</div><div class="toolFormBody"><form name="deactivate_or_uninstall_repository" id="deactivate_or_uninstall_repository" action="${h.url_for( controller='admin_toolshed', action='deactivate_or_uninstall_repository', id=trans.security.encode_id( repository.id ) )}" method="post" ><div class="form-row"><label>Description:</label> - ${repository.description} + ${repository.description|h} <div style="clear: both"></div></div><div class="form-row"><label>Revision:</label> - ${repository.changeset_revision}</a> + ${repository.changeset_revision|h}</a></div><div class="form-row"><label>Tool shed:</label> - ${repository.tool_shed} + ${repository.tool_shed|h} <div style="clear: both"></div></div><div class="form-row"><label>Owner:</label> - ${repository.owner} + ${repository.owner|h} </div><div class="form-row"><label>Deleted:</label> - ${repository.deleted} + ${repository.deleted|h} </div><div class="form-row"><% @@ -186,7 +186,7 @@ ##hack to mimic check box <input type="hidden" name="remove_from_disk" value="true"/><input type="hidden" name="remove_from_disk" value="true"/> %endif - <input type="submit" name="deactivate_or_uninstall_repository_button" value="${deactivate_uninstall_button_text}"/> + <input type="submit" name="deactivate_or_uninstall_repository_button" value="${deactivate_uninstall_button_text|h}"/></div></form></div> diff -r 2db0fb9594d6c315e4e0a4be70f64373cfc708f6 -r a4b74b3d6f0d14a38a3f17c2a437b8968563a114 templates/admin/tool_shed_repository/initiate_repository_installation.mako --- a/templates/admin/tool_shed_repository/initiate_repository_installation.mako +++ b/templates/admin/tool_shed_repository/initiate_repository_installation.mako @@ -53,18 +53,18 @@ <td> %if link_to_manage_tool_dependencies: <a class="view-info" href="${h.url_for( controller='admin_toolshed', action='manage_tool_dependencies', tool_dependency_ids=ids_of_tool_dependencies_missing_or_being_installed )}"> - ${tool_shed_repository.name} + ${tool_shed_repository.name|h} </a> %else: <a class="view-info" href="${h.url_for( controller='admin_toolshed', action='manage_repository', id=encoded_repository_id )}"> - ${tool_shed_repository.name} + ${tool_shed_repository.name|h} </a> %endif </td><td>${tool_shed_repository.description}</td><td>${tool_shed_repository.owner}</td><td>${tool_shed_repository.changeset_revision}</td> - <td><div id="RepositoryStatus-${encoded_repository_id}">${tool_shed_repository.status}</div></td> + <td><div id="RepositoryStatus-${encoded_repository_id}">${tool_shed_repository.status|h}</div></td></tr> %endfor </table> diff -r 2db0fb9594d6c315e4e0a4be70f64373cfc708f6 -r a4b74b3d6f0d14a38a3f17c2a437b8968563a114 templates/admin/tool_shed_repository/install_tool_dependencies_with_update.mako --- a/templates/admin/tool_shed_repository/install_tool_dependencies_with_update.mako +++ b/templates/admin/tool_shed_repository/install_tool_dependencies_with_update.mako @@ -20,12 +20,12 @@ <div class="toolForm"><div class="toolFormBody"><form name="install_tool_dependencies_with_update" id="install_tool_dependencies_with_update" action="${h.url_for( controller='admin_toolshed', action='install_tool_dependencies_with_update' )}" method="post" > - <input type="hidden" name="updating_repository_id" value="${updating_repository_id}"/> - <input type="hidden" name="updating_to_ctx_rev" value="${updating_to_ctx_rev}"/> - <input type="hidden" name="updating_to_changeset_revision" value="${updating_to_changeset_revision}"/> - <input type="hidden" name="encoded_updated_metadata" value="${encoded_updated_metadata}"/> - <input type="hidden" name="encoded_relative_install_dir" value="${encoded_relative_install_dir}"/> - <input type="hidden" name="encoded_tool_dependencies_dict" value="${encoded_tool_dependencies_dict}"/> + <input type="hidden" name="updating_repository_id" value="${updating_repository_id|h}"/> + <input type="hidden" name="updating_to_ctx_rev" value="${updating_to_ctx_rev|h}"/> + <input type="hidden" name="updating_to_changeset_revision" value="${updating_to_changeset_revision|h}"/> + <input type="hidden" name="encoded_updated_metadata" value="${encoded_updated_metadata|h}"/> + <input type="hidden" name="encoded_relative_install_dir" value="${encoded_relative_install_dir|h}"/> + <input type="hidden" name="encoded_tool_dependencies_dict" value="${encoded_tool_dependencies_dict|h}"/> %if tool_dependencies_dict: %if install_tool_dependencies_check_box is not None: <div class="form-row"> @@ -71,12 +71,12 @@ %> %if not os.path.exists( install_dir ): <tr> - <td>${key_name}</td> - <td>${key_version}</td> - <td>${install_dir}</td> + <td>${key_name|h}</td> + <td>${key_version|h}</td> + <td>${install_dir|h}</td></tr> %if readme_text: - <tr><td colspan="4" bgcolor="#FFFFCC">${key_name} ${key_version} requirements and installation information</td></tr> + <tr><td colspan="4" bgcolor="#FFFFCC">${key_name|h} ${key_version|h} requirements and installation information</td></tr><tr><td colspan="4"><pre>${readme_text}</pre></td></tr> %endif %endif diff -r 2db0fb9594d6c315e4e0a4be70f64373cfc708f6 -r a4b74b3d6f0d14a38a3f17c2a437b8968563a114 templates/admin/tool_shed_repository/manage_repository.mako --- a/templates/admin/tool_shed_repository/manage_repository.mako +++ b/templates/admin/tool_shed_repository/manage_repository.mako @@ -22,50 +22,50 @@ %endif <div class="toolForm"> - <div class="toolFormTitle">Installed tool shed repository '${repository.name}'</div> + <div class="toolFormTitle">Installed tool shed repository '${repository.name|h}'</div><div class="toolFormBody"><form name="edit_repository" id="edit_repository" action="${h.url_for( controller='admin_toolshed', action='manage_repository', id=trans.security.encode_id( repository.id ) )}" method="post" ><div class="form-row"><label>Tool shed:</label> - ${repository.tool_shed} + ${repository.tool_shed|h} <div style="clear: both"></div></div><div class="form-row"><label>Name:</label> - ${repository.name} + ${repository.name|h} <div style="clear: both"></div></div><div class="form-row"><label>Description:</label> %if in_error_state: - ${description} + ${description|h} %else: - <input name="description" type="textfield" value="${description}" size="80"/> + <input name="description" type="textfield" value="${description|h}" size="80"/> %endif <div style="clear: both"></div></div><div class="form-row"><label>Revision:</label> - ${repository.changeset_revision} + ${repository.changeset_revision|h} </div><div class="form-row"><label>Owner:</label> - ${repository.owner} + ${repository.owner|h} </div> %if in_error_state: <div class="form-row"><label>Repository installation error:</label> - ${repository.error_message} + ${repository.error_message|h} </div> %else: <div class="form-row"><label>Location:</label> - ${repo_files_dir} + ${repo_files_dir|h} </div> %endif <div class="form-row"><label>Deleted:</label> - ${repository.deleted} + ${repository.deleted|h} </div> %if not in_error_state: <div class="form-row"> diff -r 2db0fb9594d6c315e4e0a4be70f64373cfc708f6 -r a4b74b3d6f0d14a38a3f17c2a437b8968563a114 templates/admin/tool_shed_repository/manage_repository_tool_dependencies.mako --- a/templates/admin/tool_shed_repository/manage_repository_tool_dependencies.mako +++ b/templates/admin/tool_shed_repository/manage_repository_tool_dependencies.mako @@ -20,7 +20,7 @@ %endif <div class="toolForm"> - <div class="toolFormTitle">Tool shed repository '${repository.name}' tool dependencies</div> + <div class="toolFormTitle">Tool shed repository '${repository.name|h}' tool dependencies</div><% can_install = False can_uninstall = False @@ -48,16 +48,16 @@ <td> %if tool_dependency.status not in [ trans.install_model.ToolDependency.installation_status.UNINSTALLED ]: <a target="galaxy_main" href="${h.url_for( controller='admin_toolshed', action='manage_repository_tool_dependencies', operation='browse', tool_dependency_ids=trans.security.encode_id( tool_dependency.id ), repository_id=trans.security.encode_id( repository.id ) )}"> - ${tool_dependency.name} + ${tool_dependency.name|h} </a> %else: - ${tool_dependency.name} + ${tool_dependency.name|h} %endif </td> - <td>${tool_dependency.version}</td> - <td>${tool_dependency.type}</td> - <td>${tool_dependency.status}</td> - <td>${error_message}</td> + <td>${tool_dependency.version|h}</td> + <td>${tool_dependency.type|h}</td> + <td>${tool_dependency.status|h}</td> + <td>${error_message|h}</td></tr> %endfor </table> diff -r 2db0fb9594d6c315e4e0a4be70f64373cfc708f6 -r a4b74b3d6f0d14a38a3f17c2a437b8968563a114 templates/admin/tool_shed_repository/purge_repository_confirmation.mako --- a/templates/admin/tool_shed_repository/purge_repository_confirmation.mako +++ b/templates/admin/tool_shed_repository/purge_repository_confirmation.mako @@ -19,14 +19,14 @@ <div class="warningmessage"><p> - Purging the repository named <b>${repository.name}</b> will result in deletion of all records for the + Purging the repository named <b>${repository.name|h}</b> will result in deletion of all records for the following associated items from the database. Click the <b>Purge</b> button to purge this repository and its associated items. </p></div><div class="toolForm"> - <div class="toolFormTitle">Purge tool shed repository <b>${repository.name}</b></div> + <div class="toolFormTitle">Purge tool shed repository <b>${repository.name|h}</b></div><form name="purge_repository" id="purge_repository" action="${h.url_for( controller='admin_toolshed', action='purge_repository', id=trans.security.encode_id( repository.id ) )}" method="post" ><% tool_versions = 0 @@ -59,11 +59,11 @@ orphan_repository_dependency_records += 1 %><table class="grid"> - <tr><td>Tool version records</td><td>${tool_versions}</td><tr> - <tr><td>Tool dependency records</td><td>${tool_dependencies}</td><tr> - <tr><td>Repository dependency records</td><td>${required_repositories}</td><tr> - <tr><td>Orphan repository_repository_dependency_association records</td><td>${orphan_repository_repository_dependency_association_records}</td><tr> - <tr><td>Orphan repository_dependency records</td><td>${orphan_repository_dependency_records}</td><tr> + <tr><td>Tool version records</td><td>${tool_versions|h}</td><tr> + <tr><td>Tool dependency records</td><td>${tool_dependencies|h}</td><tr> + <tr><td>Repository dependency records</td><td>${required_repositories|h}</td><tr> + <tr><td>Orphan repository_repository_dependency_association records</td><td>${orphan_repository_repository_dependency_association_records|h}</td><tr> + <tr><td>Orphan repository_dependency records</td><td>${orphan_repository_dependency_records|h}</td><tr></table><div style="clear: both"></div><div class="form-row"> diff -r 2db0fb9594d6c315e4e0a4be70f64373cfc708f6 -r a4b74b3d6f0d14a38a3f17c2a437b8968563a114 templates/admin/tool_shed_repository/repair_repository.mako --- a/templates/admin/tool_shed_repository/repair_repository.mako +++ b/templates/admin/tool_shed_repository/repair_repository.mako @@ -37,9 +37,9 @@ </div><div class="toolForm"> - <div class="toolFormTitle">Repair tool shed repository <b>${repository.name}</b></div> + <div class="toolFormTitle">Repair tool shed repository <b>${repository.name|h}</b></div><form name="repair_repository" id="repair_repository" action="${h.url_for( controller='admin_toolshed', action='repair_repository', id=trans.security.encode_id( repository.id ) )}" method="post" > - <input type="hidden" name="repair_dict" value="${encoded_repair_dict}"/> + <input type="hidden" name="repair_dict" value="${encoded_repair_dict|h}"/><% from tool_shed.util.shed_util_common import get_tool_shed_repository_status_label ordered_repo_info_dicts = repair_dict.get( 'ordered_repo_info_dicts', [] ) diff -r 2db0fb9594d6c315e4e0a4be70f64373cfc708f6 -r a4b74b3d6f0d14a38a3f17c2a437b8968563a114 templates/admin/tool_shed_repository/repository_installation_status.mako --- a/templates/admin/tool_shed_repository/repository_installation_status.mako +++ b/templates/admin/tool_shed_repository/repository_installation_status.mako @@ -1,5 +1,6 @@ <%def name="render_repository_status( repository )"><% + from markupsafe import escape if repository.status in [ trans.install_model.ToolShedRepository.installation_status.CLONING, trans.install_model.ToolShedRepository.installation_status.SETTING_TOOL_VERSIONS, trans.install_model.ToolShedRepository.installation_status.INSTALLING_TOOL_DEPENDENCIES, @@ -20,7 +21,7 @@ else: bgcolor = trans.install_model.ToolShedRepository.states.ERROR rval = '<div class="count-box state-color-%s" id="RepositoryStatus-%s">' % ( bgcolor, trans.security.encode_id( repository.id ) ) - rval += '%s</div>' % repository.status + rval += '%s</div>' % escape( repository.status ) return rval %> ${rval} diff -r 2db0fb9594d6c315e4e0a4be70f64373cfc708f6 -r a4b74b3d6f0d14a38a3f17c2a437b8968563a114 templates/admin/tool_shed_repository/reselect_tool_panel_section.mako --- a/templates/admin/tool_shed_repository/reselect_tool_panel_section.mako +++ b/templates/admin/tool_shed_repository/reselect_tool_panel_section.mako @@ -62,12 +62,12 @@ <label>Shed tool configuration file:</label> ${shed_tool_conf_select_field.get_html()} <div class="toolParamHelp" style="clear: both;"> - ${select_help} + ${select_help|h} </div></div><div style="clear: both"></div> %else: - <input type="hidden" name="shed_tool_conf" value="${shed_tool_conf}"/> + <input type="hidden" name="shed_tool_conf" value="${shed_tool_conf|h}"/> %endif %if includes_tools_for_display_in_tool_panel: <div style="clear: both"></div> diff -r 2db0fb9594d6c315e4e0a4be70f64373cfc708f6 -r a4b74b3d6f0d14a38a3f17c2a437b8968563a114 templates/admin/tool_shed_repository/select_shed_tool_panel_config.mako --- a/templates/admin/tool_shed_repository/select_shed_tool_panel_config.mako +++ b/templates/admin/tool_shed_repository/select_shed_tool_panel_config.mako @@ -71,7 +71,7 @@ <input type="hidden" name="includes_tools" value="${includes_tools}" /><input type="hidden" name="includes_tool_dependencies" value="${includes_tool_dependencies}" /><input type="hidden" name="includes_tools_for_display_in_tool_panel" value="${includes_tools_for_display_in_tool_panel}" /> - <input type="hidden" name="tool_shed_url" value="${tool_shed_url}" /> + <input type="hidden" name="tool_shed_url" value="${tool_shed_url|h}" /></div><div style="clear: both"></div><% readme_files_dict = containers_dict.get( 'readme_files', None ) %> @@ -111,12 +111,12 @@ <label>Shed tool configuration file:</label> ${shed_tool_conf_select_field.get_html()} <div class="toolParamHelp" style="clear: both;"> - ${select_help} + ${select_help|h} </div></div><div style="clear: both"></div> %else: - <input type="hidden" name="shed_tool_conf" value="${shed_tool_conf}"/> + <input type="hidden" name="shed_tool_conf" value="${shed_tool_conf|h}"/> %endif <div class="form-row"><input type="submit" name="select_shed_tool_panel_config_button" value="Install"/> diff -r 2db0fb9594d6c315e4e0a4be70f64373cfc708f6 -r a4b74b3d6f0d14a38a3f17c2a437b8968563a114 templates/admin/tool_shed_repository/select_tool_panel_section.mako --- a/templates/admin/tool_shed_repository/select_tool_panel_section.mako +++ b/templates/admin/tool_shed_repository/select_tool_panel_section.mako @@ -111,16 +111,16 @@ <label>Shed tool configuration file:</label> ${shed_tool_conf_select_field.get_html()} <div class="toolParamHelp" style="clear: both;"> - ${select_help} + ${select_help|h} </div></div><div style="clear: both"></div> %else: - <input type="hidden" name="shed_tool_conf" value="${shed_tool_conf}"/> + <input type="hidden" name="shed_tool_conf" value="${shed_tool_conf|h}"/> %endif <div class="form-row"><label>Add new tool panel section:</label> - <input name="new_tool_panel_section_label" type="textfield" value="${new_tool_panel_section_label}" size="40"/> + <input name="new_tool_panel_section_label" type="textfield" value="${new_tool_panel_section_label|h}" size="40"/><div class="toolParamHelp" style="clear: both;"> Add a new tool panel section to contain the installed tools (optional). </div> diff -r 2db0fb9594d6c315e4e0a4be70f64373cfc708f6 -r a4b74b3d6f0d14a38a3f17c2a437b8968563a114 templates/admin/tool_shed_repository/uninstall_tool_dependencies.mako --- a/templates/admin/tool_shed_repository/uninstall_tool_dependencies.mako +++ b/templates/admin/tool_shed_repository/uninstall_tool_dependencies.mako @@ -43,10 +43,10 @@ install_dir = "This dependency's installation directory does not exist, click <b>Uninstall</b> to reset for installation." %><tr> - <td>${tool_dependency.name}</td> - <td>${tool_dependency.version}</td> - <td>${tool_dependency.type}</td> - <td>${install_dir}</td> + <td>${tool_dependency.name|h}</td> + <td>${tool_dependency.version|h}</td> + <td>${tool_dependency.type|h}</td> + <td>${install_dir|h}</td></tr> %endfor </table> diff -r 2db0fb9594d6c315e4e0a4be70f64373cfc708f6 -r a4b74b3d6f0d14a38a3f17c2a437b8968563a114 templates/admin/tool_shed_repository/view_tool_metadata.mako --- a/templates/admin/tool_shed_repository/view_tool_metadata.mako +++ b/templates/admin/tool_shed_repository/view_tool_metadata.mako @@ -11,7 +11,7 @@ %if tool_metadata: <p/><div class="toolForm"> - <div class="toolFormTitle">${tool_metadata[ 'name' ]} tool metadata</div> + <div class="toolFormTitle">${tool_metadata[ 'name' ]|h} tool metadata</div><div class="toolFormBody"><div class="form-row"><table width="100%"> @@ -20,41 +20,41 @@ </div><div class="form-row"><label>Name:</label> - ${tool_metadata[ 'name' ]} + ${tool_metadata[ 'name' ]|h} <div style="clear: both"></div></div> %if 'description' in tool_metadata: <div class="form-row"><label>Description:</label> - ${tool_metadata[ 'description' ]} + ${tool_metadata[ 'description' ]|h} <div style="clear: both"></div></div> %endif %if 'id' in tool_metadata: <div class="form-row"><label>Id:</label> - ${tool_metadata[ 'id' ]} + ${tool_metadata[ 'id' ]|h} <div style="clear: both"></div></div> %endif %if 'guid' in tool_metadata: <div class="form-row"><label>Guid:</label> - ${tool_metadata[ 'guid' ]} + ${tool_metadata[ 'guid' ]|h} <div style="clear: both"></div></div> %endif %if 'version' in tool_metadata: <div class="form-row"><label>Version:</label> - ${tool_metadata[ 'version' ]} + ${tool_metadata[ 'version' ]|h} <div style="clear: both"></div></div> %endif %if 'version_string_cmd' in tool_metadata: <div class="form-row"><label>Version command string:</label> - ${tool_metadata[ 'version_string_cmd' ]} + ${tool_metadata[ 'version_string_cmd' ]|h} <div style="clear: both"></div></div> %endif @@ -70,9 +70,9 @@ <tr><td> %if guid == tool_metadata[ 'guid' ]: - ${guid} <b>(this tool)</b> + ${guid|h} <b>(this tool)</b> %else: - ${guid} + ${guid|h} %endif </td></tr> @@ -109,9 +109,9 @@ requirement_type = requirement_dict[ 'type' ] or 'not provided' %><tr> - <td>${requirement_name}</td> - <td>${requirement_version}</td> - <td>${requirement_type}</td> + <td>${requirement_name|h}</td> + <td>${requirement_version|h}</td> + <td>${requirement_type|h}</td></tr> %endfor </table> @@ -130,27 +130,27 @@ </div><div class="form-row"><label>Command:</label> - <pre>${tool.command}</pre> + <pre>${tool.command|h}</pre><div style="clear: both"></div></div><div class="form-row"><label>Interpreter:</label> - ${tool.interpreter} + ${tool.interpreter|h} <div style="clear: both"></div></div><div class="form-row"><label>Is multi-byte:</label> - ${tool.is_multi_byte} + ${tool.is_multi_byte|h} <div style="clear: both"></div></div><div class="form-row"><label>Forces a history refresh:</label> - ${tool.force_history_refresh} + ${tool.force_history_refresh|h} <div style="clear: both"></div></div><div class="form-row"><label>Parallelism:</label> - ${tool.parallelism} + ${tool.parallelism|h} <div style="clear: both"></div></div> %endif @@ -181,20 +181,20 @@ required_files = test_dict[ 'required_files' ] %><tr> - <td>${test_dict[ 'name' ]}</td> + <td>${test_dict[ 'name' ]|h}</td><td> %for input in inputs: - <b>${input[0]}:</b> ${input[1]}<br/> + <b>${input[0]|h}:</b> ${input[1]|h}<br/> %endfor </td><td> %for output in outputs: - <b>${output[0]}:</b> ${output[1]}<br/> + <b>${output[0]|h}:</b> ${output[1]|h}<br/> %endfor </td><td> %for required_file in required_files: - ${required_file}<br/> + ${required_file|h}<br/> %endfor </td></tr> diff -r 2db0fb9594d6c315e4e0a4be70f64373cfc708f6 -r a4b74b3d6f0d14a38a3f17c2a437b8968563a114 templates/admin/tool_shed_repository/view_workflow.mako --- a/templates/admin/tool_shed_repository/view_workflow.mako +++ b/templates/admin/tool_shed_repository/view_workflow.mako @@ -17,7 +17,7 @@ <%def name="render_workflow( workflow_name, repository_id )"><% center_url = h.url_for( controller='admin_toolshed', action='generate_workflow_image', workflow_name=tool_shed_encode( workflow_name ), repository_id=repository_id ) %> - <iframe name="workflow_image" id="workflow_image" frameborder="0" style="position: absolute; width: 100%; height: 100%;" src="${center_url}"></iframe> + <iframe name="workflow_image" id="workflow_image" frameborder="0" style="position: absolute; width: 100%; height: 100%;" src="${center_url|h}"></iframe></%def> ${render_galaxy_repository_actions( repository )} diff -r 2db0fb9594d6c315e4e0a4be70f64373cfc708f6 -r a4b74b3d6f0d14a38a3f17c2a437b8968563a114 templates/admin/user/reset_password.mako --- a/templates/admin/user/reset_password.mako +++ b/templates/admin/user/reset_password.mako @@ -13,7 +13,7 @@ %for user in users: <div class="form-row"><label>Email:</label> - ${user.email} + ${user.email|h} <div style="clear: both"></div></div> %endfor diff -r 2db0fb9594d6c315e4e0a4be70f64373cfc708f6 -r a4b74b3d6f0d14a38a3f17c2a437b8968563a114 templates/admin/user/user.mako --- a/templates/admin/user/user.mako +++ b/templates/admin/user/user.mako @@ -11,9 +11,9 @@ </%def><%def name="render_select( name, options )"> - <select name="${name}" id="${name}" style="min-width: 250px; height: 150px;" multiple> + <select name="${name|h}" id="${name|h}" style="min-width: 250px; height: 150px;" multiple> %for option in options: - <option value="${option[0]}">${option[1]}</option> + <option value="${option[0]|h}">${option[1]|h}</option> %endfor </select></%def> @@ -48,29 +48,29 @@ %endif <div class="toolForm"> - <div class="toolFormTitle">User '${user.email}'</div> + <div class="toolFormTitle">User '${user.email|h}'</div><div class="toolFormBody"><form name="associate_user_role_group" id="associate_user_role_group" action="${h.url_for(controller='admin', action='manage_roles_and_groups_for_user', id=trans.security.encode_id( user.id ) )}" method="post" ><div class="form-row"><div style="float: left; margin-right: 10px;"> - <label>Roles associated with '${user.email}'</label> + <label>Roles associated with '${user.email|h}'</label> ${render_select( "in_roles", in_roles )}<br/><input type="submit" id="roles_remove_button" value=">>"/></div><div> - <label>Roles not associated with '${user.email}'</label> + <label>Roles not associated with '${user.email|h}'</label> ${render_select( "out_roles", out_roles )}<br/><input type="submit" id="roles_add_button" value="<<"/></div></div><div class="form-row"><div style="float: left; margin-right: 10px;"> - <label>Groups associated with '${user.email}'</label> + <label>Groups associated with '${user.email|h}'</label> ${render_select( "in_groups", in_groups )}<br/><input type="submit" id="groups_remove_button" value=">>"/></div><div> - <label>Groups not associated with '${user.email}'</label> + <label>Groups not associated with '${user.email|h}'</label> ${render_select( "out_groups", out_groups )}<br/><input type="submit" id="groups_add_button" value="<<"/></div> diff -r 2db0fb9594d6c315e4e0a4be70f64373cfc708f6 -r a4b74b3d6f0d14a38a3f17c2a437b8968563a114 templates/admin/view_datatypes_registry.mako --- a/templates/admin/view_datatypes_registry.mako +++ b/templates/admin/view_datatypes_registry.mako @@ -37,16 +37,16 @@ %else: <tr class="tr"> %endif - <td>${datatype.extension}</td> - <td>${datatype.dtype}</td> + <td>${datatype.extension|h}</td> + <td>${datatype.dtype|h}</td><td> %if datatype.mimetype: - ${datatype.mimetype} + ${datatype.mimetype|h} %endif </td><td> %if datatype.display_in_upload: - ${datatype.display_in_upload} + ${datatype.display_in_upload|h} %endif </td></tr> diff -r 2db0fb9594d6c315e4e0a4be70f64373cfc708f6 -r a4b74b3d6f0d14a38a3f17c2a437b8968563a114 templates/base.mako --- a/templates/base.mako +++ b/templates/base.mako @@ -39,7 +39,7 @@ <script> Raven.config('${app.config.sentry_dsn_public}').install(); %if trans.user: - Raven.setUser( { email: "${trans.user.email}" } ); + Raven.setUser( { email: "${trans.user.email|h}" } ); %endif </script> %endif diff -r 2db0fb9594d6c315e4e0a4be70f64373cfc708f6 -r a4b74b3d6f0d14a38a3f17c2a437b8968563a114 templates/galaxy_client_app.mako --- a/templates/galaxy_client_app.mako +++ b/templates/galaxy_client_app.mako @@ -70,11 +70,12 @@ ## Return a dictionary of user or anonymous user data including: ## email, id, disk space used, quota percent, and tags used <% + from markupsafe import escape user_dict = {} try: if trans.user: user_dict = trans.user.to_dict( view='element', - value_mapper={ 'id': trans.security.encode_id, 'total_disk_usage': float } ) + value_mapper={ 'id': trans.security.encode_id, 'total_disk_usage': float, 'email': escape, 'username': escape } ) user_dict[ 'quota_percent' ] = trans.app.quota_agent.get_percent( trans=trans ) user_dict[ 'is_admin' ] = trans.user_is_admin() diff -r 2db0fb9594d6c315e4e0a4be70f64373cfc708f6 -r a4b74b3d6f0d14a38a3f17c2a437b8968563a114 templates/user/index.mako --- a/templates/user/index.mako +++ b/templates/user/index.mako @@ -2,7 +2,7 @@ %if trans.user: <h2>${_('User preferences')}</h2> - <p>You are currently logged in as ${trans.user.email}.</p> + <p>You are currently logged in as ${trans.user.email|h}.</p><ul> %if t.webapp.name == 'galaxy': %if not trans.app.config.use_remote_user: diff -r 2db0fb9594d6c315e4e0a4be70f64373cfc708f6 -r a4b74b3d6f0d14a38a3f17c2a437b8968563a114 templates/webapps/galaxy/admin/tool_sheds.mako --- a/templates/webapps/galaxy/admin/tool_sheds.mako +++ b/templates/webapps/galaxy/admin/tool_sheds.mako @@ -22,7 +22,7 @@ <tr class="libraryTitle"><td><div style="float: left; margin-left: 1px;" class="menubutton split popup" id="dataset-${shed_id}-popup"> - <a class="view-info" href="${h.url_for( controller='admin_toolshed', action='browse_tool_shed', tool_shed_url=url )}">${name}</a> + <a class="view-info" href="${h.url_for( controller='admin_toolshed', action='browse_tool_shed', tool_shed_url=url )}">${name|h}</a></div><div popupmenu="dataset-${shed_id}-popup"><a class="action-button" href="${h.url_for( controller='admin_toolshed', action='browse_tool_shed', tool_shed_url=url )}">Browse valid repositories</a> diff -r 2db0fb9594d6c315e4e0a4be70f64373cfc708f6 -r a4b74b3d6f0d14a38a3f17c2a437b8968563a114 templates/webapps/galaxy/dataset/errors.mako --- a/templates/webapps/galaxy/dataset/errors.mako +++ b/templates/webapps/galaxy/dataset/errors.mako @@ -95,7 +95,7 @@ <input type="hidden" name="id" value="${trans.security.encode_id( hda.id)}" /><div class="form-row"><label>Your email</label> - <input type="text" name="email" size="40" value="${user_email}" /> + <input type="text" name="email" size="40" value="${user_email|h}" /></div><div class="form-row"><label>Message</label> diff -r 2db0fb9594d6c315e4e0a4be70f64373cfc708f6 -r a4b74b3d6f0d14a38a3f17c2a437b8968563a114 templates/webapps/galaxy/galaxy.masthead.mako --- a/templates/webapps/galaxy/galaxy.masthead.mako +++ b/templates/webapps/galaxy/galaxy.masthead.mako @@ -3,6 +3,7 @@ ## masthead head generator <%def name="load(active_view = None)"><% + from markupsafe import escape ## get configuration masthead_config = { ## inject configuration @@ -32,7 +33,7 @@ ## user details 'user' : { 'requests' : bool(trans.user and (trans.user.requests or trans.app.security_agent.get_accessible_request_types(trans, trans.user))), - 'email' : trans.user.email if (trans.user) else "", + 'email' : escape( trans.user.email ) if (trans.user) else "", 'valid' : bool(trans.user != None), 'json' : get_user_dict() } diff -r 2db0fb9594d6c315e4e0a4be70f64373cfc708f6 -r a4b74b3d6f0d14a38a3f17c2a437b8968563a114 templates/webapps/galaxy/galaxy.panels.mako --- a/templates/webapps/galaxy/galaxy.panels.mako +++ b/templates/webapps/galaxy/galaxy.panels.mako @@ -49,7 +49,7 @@ <script> Raven.config('${app.config.sentry_dsn_public}').install(); %if trans.user: - Raven.setUser( { email: "${trans.user.email}" } ); + Raven.setUser( { email: "${trans.user.email|h}" } ); %endif </script> %endif diff -r 2db0fb9594d6c315e4e0a4be70f64373cfc708f6 -r a4b74b3d6f0d14a38a3f17c2a437b8968563a114 templates/webapps/tool_shed/base_panels.mako --- a/templates/webapps/tool_shed/base_panels.mako +++ b/templates/webapps/tool_shed/base_panels.mako @@ -91,7 +91,8 @@ %> ## User tabs. - <% + <% + from markupsafe import escape # Menu for user who is not logged in. menu_options = [ [ _("Login"), h.url_for( controller='/user', action='login' ), "galaxy_main" ] ] if app.config.allow_user_creation: @@ -101,7 +102,7 @@ tab( "user", _("User"), None, visible=visible, menu_options=menu_options ) # Menu for user who is logged in. if trans.user: - email = trans.user.email + email = escape( trans.user.email ) else: email = "" menu_options = [ [ '<a>Logged in as <span id="user-email">%s</span></a>' % email ] ] https://bitbucket.org/galaxy/galaxy-central/commits/ad38faf1b0b6/ Changeset: ad38faf1b0b6 Branch: stable User: davebgx Date: 2014-12-10 17:49:42+00:00 Summary: Revert html escaping in API controller, per input on pull request. Affected #: 1 file diff -r a4b74b3d6f0d14a38a3f17c2a437b8968563a114 -r ad38faf1b0b6768c31ed972ad5434079a2cd1225 lib/galaxy/webapps/galaxy/api/users.py --- a/lib/galaxy/webapps/galaxy/api/users.py +++ b/lib/galaxy/webapps/galaxy/api/users.py @@ -11,7 +11,6 @@ from galaxy.web.base.controller import BaseAPIController, UsesTagsMixin from galaxy.web.base.controller import CreatesApiKeysMixin from galaxy.web.base.controller import CreatesUsersMixin -from markupsafe import escape log = logging.getLogger( __name__ ) @@ -39,10 +38,10 @@ query = query.filter( trans.app.model.User.table.c.deleted == False ) # noqa # special case: user can see only their own user if not trans.user_is_admin(): - item = trans.user.to_dict( value_mapper={ 'id': trans.security.encode_id, 'email': escape } ) + item = trans.user.to_dict( value_mapper={ 'id': trans.security.encode_id } ) return [item] for user in query: - item = user.to_dict( value_mapper={ 'id': trans.security.encode_id, 'email': escape } ) + item = user.to_dict( value_mapper={ 'id': trans.security.encode_id } ) # TODO: move into api_values rval.append( item ) return rval @@ -79,9 +78,7 @@ else: raise HTTPBadRequest( detail='Invalid user id ( %s ) specified' % id ) item = user.to_dict( view='element', value_mapper={ 'id': trans.security.encode_id, - 'total_disk_usage': float, - 'email': escape, - 'username': escape } ) + 'total_disk_usage': float } ) # add a list of tags used by the user (as strings) item[ 'tags_used' ] = self.get_user_tags_used( trans, user=user ) # TODO: move into api_values (needs trans, tho - can we do that with api_keys/@property??) https://bitbucket.org/galaxy/galaxy-central/commits/f0f1f78b54c5/ Changeset: f0f1f78b54c5 Branch: stable User: dannon Date: 2014-12-11 14:50:35+00:00 Summary: Merged in davebgx/galaxy-central/stable (pull request #603) [STABLE] Escape anything that could be user input in my assigned mako templates, add markupsafe.escape to username and email in users API controller. Affected #: 46 files diff -r 5fc83b69fe241d469ad27235a39e93d847764bbc -r f0f1f78b54c55c8569bd1e3ed7fc15726b0b64a4 templates/admin/dataset_security/group/group.mako --- a/templates/admin/dataset_security/group/group.mako +++ b/templates/admin/dataset_security/group/group.mako @@ -11,9 +11,9 @@ </%def><%def name="render_select( name, options )"> - <select name="${name}" id="${name}" style="min-width: 250px; height: 150px;" multiple> + <select name="${name|h}" id="${name|h}" style="min-width: 250px; height: 150px;" multiple> %for option in options: - <option value="${option[0]}">${option[1]}</option> + <option value="${option[0]|h}">${option[1]|h}</option> %endfor </select></%def> @@ -48,29 +48,29 @@ %endif <div class="toolForm"> - <div class="toolFormTitle">Group '${group.name}'</div> + <div class="toolFormTitle">Group '${group.name|h}'</div><div class="toolFormBody"><form name="associate_group_role_user" id="associate_group_role_user" action="${h.url_for(controller='admin', action='manage_users_and_roles_for_group', id=trans.security.encode_id( group.id ) )}" method="post" ><div class="form-row"><div style="float: left; margin-right: 10px;"> - <label>Roles associated with '${group.name}'</label> + <label>Roles associated with '${group.name|h}'</label> ${render_select( "in_roles", in_roles )}<br/><input type="submit" id="roles_remove_button" value=">>"/></div><div> - <label>Roles not associated with '${group.name}'</label> + <label>Roles not associated with '${group.name|h}'</label> ${render_select( "out_roles", out_roles )}<br/><input type="submit" id="roles_add_button" value="<<"/></div></div><div class="form-row"><div style="float: left; margin-right: 10px;"> - <label>Users associated with '${group.name}'</label> + <label>Users associated with '${group.name|h}'</label> ${render_select( "in_users", in_users )}<br/><input type="submit" id="users_remove_button" value=">>"/></div><div> - <label>Users not associated with '${group.name}'</label> + <label>Users not associated with '${group.name|h}'</label> ${render_select( "out_users", out_users )}<br/><input type="submit" id="users_add_button" value="<<"/></div> diff -r 5fc83b69fe241d469ad27235a39e93d847764bbc -r f0f1f78b54c55c8569bd1e3ed7fc15726b0b64a4 templates/admin/dataset_security/group/group_create.mako --- a/templates/admin/dataset_security/group/group_create.mako +++ b/templates/admin/dataset_security/group/group_create.mako @@ -11,9 +11,9 @@ </%def><%def name="render_select( name, options )"> - <select name="${name}" id="${name}" style="min-width: 250px; height: 150px;" multiple> + <select name="${name|h}" id="${name|h}" style="min-width: 250px; height: 150px;" multiple> %for option in options: - <option value="${option[0]}">${option[1]}</option> + <option value="${option[0]|h}">${option[1]|h}</option> %endfor </select></%def> @@ -60,7 +60,7 @@ <form name="associate_group_role_user" id="associate_group_role_user" action="${h.url_for(controller='admin', action='create_group' )}" method="post" ><div class="form-row"><label>Name:</label> - <input name="name" type="textfield" value="${name}" size=40"/> + <input name="name" type="textfield" value="${name|h}" size=40"/></div><div class="form-row"><div style="float: left; margin-right: 10px;"> diff -r 5fc83b69fe241d469ad27235a39e93d847764bbc -r f0f1f78b54c55c8569bd1e3ed7fc15726b0b64a4 templates/admin/dataset_security/group/group_rename.mako --- a/templates/admin/dataset_security/group/group_rename.mako +++ b/templates/admin/dataset_security/group/group_rename.mako @@ -12,7 +12,7 @@ <div class="form-row"><label>Name:</label><div style="float: left; width: 250px; margin-right: 10px;"> - <input type="text" name="name" value="${group.name}" size="40"/> + <input type="text" name="name" value="${group.name|h}" size="40"/></div><div style="clear: both"></div></div> diff -r 5fc83b69fe241d469ad27235a39e93d847764bbc -r f0f1f78b54c55c8569bd1e3ed7fc15726b0b64a4 templates/admin/dataset_security/role/role.mako --- a/templates/admin/dataset_security/role/role.mako +++ b/templates/admin/dataset_security/role/role.mako @@ -11,9 +11,9 @@ </%def><%def name="render_select( name, options )"> - <select name="${name}" id="${name}" style="min-width: 250px; height: 150px;" multiple> + <select name="${name|h}" id="${name|h}" style="min-width: 250px; height: 150px;" multiple> %for option in options: - <option value="${option[0]}">${option[1]}</option> + <option value="${option[0]|h}">${option[1]|h}</option> %endfor </select></%def> @@ -48,29 +48,29 @@ %endif <div class="toolForm"> - <div class="toolFormTitle">Role '${role.name}'</div> + <div class="toolFormTitle">Role '${role.name|h}'</div><div class="toolFormBody"><form name="associate_role_user_group" id="associate_role_user_group" action="${h.url_for(controller='admin', action='manage_users_and_groups_for_role', id=trans.security.encode_id( role.id ) )}" method="post" ><div class="form-row"><div style="float: left; margin-right: 10px;"> - <label>Users associated with '${role.name}'</label> + <label>Users associated with '${role.name|h}'</label> ${render_select( "in_users", in_users )}<br/><input type="submit" id="users_remove_button" value=">>"/></div><div> - <label>Users not associated with '${role.name}'</label> + <label>Users not associated with '${role.name|h}'</label> ${render_select( "out_users", out_users )}<br/><input type="submit" id="users_add_button" value="<<"/></div></div><div class="form-row"><div style="float: left; margin-right: 10px;"> - <label>Groups associated with '${role.name}'</label> + <label>Groups associated with '${role.name|h}'</label> ${render_select( "in_groups", in_groups )}<br/><input type="submit" id="groups_remove_button" value=">>"/></div><div> - <label>Groups not associated with '${role.name}'</label> + <label>Groups not associated with '${role.name|h}'</label> ${render_select( "out_groups", out_groups )}<br/><input type="submit" id="groups_add_button" value="<<"/></div> @@ -84,7 +84,7 @@ <br clear="left"/><br/> %if len( library_dataset_actions ) > 0: - <h3>Data library datasets associated with role '${role.name}'</h3> + <h3>Data library datasets associated with role '${role.name|h}'</h3><table class="manage-table colored" border="0" cellspacing="0" cellpadding="0" width="100%"><tr><td> @@ -92,16 +92,16 @@ %for ctr, library, in enumerate( library_dataset_actions.keys() ): <li><img src="${h.url_for( '/static/images/silk/book_open.png' )}" class="rowIcon"/> - ${library.name} + ${library.name|h} <ul> %for folder_path, permissions in library_dataset_actions[ library ].items(): <li><img src="/static/images/silk/folder_page.png" class="rowIcon"/> - ${folder_path} + ${folder_path|h} <ul> % for permission in permissions: <ul> - <li>${permission}</li> + <li>${permission|h}</li></ul> %endfor </ul> diff -r 5fc83b69fe241d469ad27235a39e93d847764bbc -r f0f1f78b54c55c8569bd1e3ed7fc15726b0b64a4 templates/admin/dataset_security/role/role_create.mako --- a/templates/admin/dataset_security/role/role_create.mako +++ b/templates/admin/dataset_security/role/role_create.mako @@ -11,9 +11,9 @@ </%def><%def name="render_select( name, options )"> - <select name="${name}" id="${name}" style="min-width: 250px; height: 150px;" multiple> + <select name="${name|h}" id="${name|h}" style="min-width: 250px; height: 150px;" multiple> %for option in options: - <option value="${option[0]}">${option[1]}</option> + <option value="${option[0]|h}">${option[1]|h}</option> %endfor </select></%def> @@ -60,11 +60,11 @@ <form name="associate_role_group_user" id="associate_role_group_user" action="${h.url_for(controller='admin', action='create_role' )}" method="post" ><div class="form-row"><label>Name:</label> - <input name="name" type="textfield" value="${name}" size=40"/> + <input name="name" type="textfield" value="${name|h}" size=40"/></div><div class="form-row"><label>Description:</label> - <input name="description" type="textfield" value="${description}" size=40"/> + <input name="description" type="textfield" value="${description|h}" size=40"/></div><div class="form-row"><div style="float: left; margin-right: 10px;"> diff -r 5fc83b69fe241d469ad27235a39e93d847764bbc -r f0f1f78b54c55c8569bd1e3ed7fc15726b0b64a4 templates/admin/dataset_security/role/role_rename.mako --- a/templates/admin/dataset_security/role/role_rename.mako +++ b/templates/admin/dataset_security/role/role_rename.mako @@ -12,14 +12,14 @@ <div class="form-row"><label>Name:</label><div style="float: left; width: 250px; margin-right: 10px;"> - <input type="text" name="name" value="${role.name}" size="40"/> + <input type="text" name="name" value="${role.name|h}" size="40"/></div><div style="clear: both"></div></div><div class="form-row"><label>Description:</label><div style="float: left; width: 250px; margin-right: 10px;"> - <input name="description" type="textfield" value="${role.description}" size=40"/> + <input name="description" type="textfield" value="${role.description|h}" size=40"/></div><div style="clear: both"></div></div> diff -r 5fc83b69fe241d469ad27235a39e93d847764bbc -r f0f1f78b54c55c8569bd1e3ed7fc15726b0b64a4 templates/admin/external_service/create_external_service.mako --- a/templates/admin/external_service/create_external_service.mako +++ b/templates/admin/external_service/create_external_service.mako @@ -12,10 +12,10 @@ %if widgets: %for i, field in enumerate( widgets ): <div class="form-row"> - <label>${field['label']}:</label> + <label>${field['label']|h}:</label> ${field['widget'].get_html()} <div class="toolParamHelp" style="clear: both;"> - ${field['helptext']} + ${field['helptext']|h} </div><div style="clear: both"></div></div> diff -r 5fc83b69fe241d469ad27235a39e93d847764bbc -r f0f1f78b54c55c8569bd1e3ed7fc15726b0b64a4 templates/admin/external_service/edit_external_service.mako --- a/templates/admin/external_service/edit_external_service.mako +++ b/templates/admin/external_service/edit_external_service.mako @@ -25,10 +25,10 @@ <div class="toolFormTitle">Edit external service</div> %for i, field in enumerate( widgets ): <div class="form-row"> - <label>${field['label']}:</label> + <label>${field['label']|h}:</label> ${field['widget'].get_html()} <div class="toolParamHelp" style="clear: both;"> - ${field['helptext']} + ${field['helptext']|h} </div><div style="clear: both"></div></div> diff -r 5fc83b69fe241d469ad27235a39e93d847764bbc -r f0f1f78b54c55c8569bd1e3ed7fc15726b0b64a4 templates/admin/jobs.mako --- a/templates/admin/jobs.mako +++ b/templates/admin/jobs.mako @@ -63,12 +63,12 @@ </td><td>${job.id}</td> %if job.history and job.history.user: - <td>${job.history.user.email}</td> + <td>${job.history.user.email|h}</td> %else: <td>anonymous</td> %endif <td>${last_updated[job.id]} ago</td> - <td>${job.tool_id}</td> + <td>${job.tool_id|h}</td><td>${job.state}</td><% try: @@ -77,8 +77,8 @@ inputs = 'Unable to determine inputs' %><td>${inputs}</td> - <td>${job.command_line}</td> - <td>${job.job_runner_name}</td> + <td>${job.command_line|h}</td> + <td>${job.job_runner_name|h}</td><td>${job.job_runner_external_id}</td></tr> %endfor @@ -131,12 +131,12 @@ %for job in recent_jobs: <td><a href="${h.url_for( controller="admin", action="job_info" )}?jobid=${job.id}">${job.id}</a></td> %if job.history and job.history.user: - <td>${job.history.user.email}</td> + <td>${job.history.user.email|h}</td> %else: <td>anonymous</td> %endif <td>${finished[job.id]} ago</td> - <td>${job.tool_id}</td> + <td>${job.tool_id|h}</td><td>${job.state}</td><% try: @@ -145,9 +145,9 @@ inputs = 'Unable to determine inputs' %><td>${inputs}</td> - <td>${job.command_line}</td> - <td>${job.job_runner_name}</td> - <td>${job.job_runner_external_id}</td> + <td>${job.command_line|h}</td> + <td>${job.job_runner_name|h}</td> + <td>${job.job_runner_external_id|h}</td></tr> %endfor </table> diff -r 5fc83b69fe241d469ad27235a39e93d847764bbc -r f0f1f78b54c55c8569bd1e3ed7fc15726b0b64a4 templates/admin/memdump.mako --- a/templates/admin/memdump.mako +++ b/templates/admin/memdump.mako @@ -55,7 +55,7 @@ <br/> You are here: ${breadcrumb}<br/> %if breadcrumb.endswith( 'theone' ): - ${heap} + ${heap|h} %else: <nobr> Sort: diff -r 5fc83b69fe241d469ad27235a39e93d847764bbc -r f0f1f78b54c55c8569bd1e3ed7fc15726b0b64a4 templates/admin/package_tool.mako --- a/templates/admin/package_tool.mako +++ b/templates/admin/package_tool.mako @@ -28,9 +28,9 @@ <select name="tool_id"> %for key, val in toolbox.tool_panel.items(): %if isinstance( val, Tool ): - <option value="${val.id}">${val.name}</option> + <option value="${val.id|h}">${val.name|h}</option> %elif isinstance( val, ToolSection ): - <optgroup label="${val.name}"> + <optgroup label="${val.name|h}"><% section = val %> %for section_key, section_val in section.elems.items(): %if isinstance( section_val, Tool ): @@ -38,7 +38,7 @@ %if section_val.id == tool_id: <% selected_str = " selected=\"selected\"" %> %endif - <option value="${section_val.id}"${selected_str}>${section_val.name}</option> + <option value="${section_val.id|h}"${selected_str}>${section_val.name|h}</option> %endif %endfor %endif diff -r 5fc83b69fe241d469ad27235a39e93d847764bbc -r f0f1f78b54c55c8569bd1e3ed7fc15726b0b64a4 templates/admin/quota/quota.mako --- a/templates/admin/quota/quota.mako +++ b/templates/admin/quota/quota.mako @@ -11,9 +11,9 @@ </%def><%def name="render_select( name, options )"> - <select name="${name}" id="${name}" style="min-width: 250px; height: 150px;" multiple> + <select name="${name|h}" id="${name|h}" style="min-width: 250px; height: 150px;" multiple> %for option in options: - <option value="${option[0]}">${option[1]}</option> + <option value="${option[0]|h}">${option[1]|h}</option> %endfor </select></%def> @@ -48,29 +48,29 @@ %endif <div class="toolForm"> - <div class="toolFormTitle">Quota '${name}'</div> + <div class="toolFormTitle">Quota '${name|h}'</div><div class="toolFormBody"><form name="associate_quota_user_group" id="associate_quota_user_group" action="${h.url_for(controller='admin', action='manage_users_and_groups_for_quota', id=id )}" method="post" ><div class="form-row"><div style="float: left; margin-right: 10px;"> - <label>Users associated with '${name}'</label> + <label>Users associated with '${name|h}'</label> ${render_select( "in_users", in_users )}<br/><input type="submit" id="users_remove_button" value=">>"/></div><div> - <label>Users not associated with '${name}'</label> + <label>Users not associated with '${name|h}'</label> ${render_select( "out_users", out_users )}<br/><input type="submit" id="users_add_button" value="<<"/></div></div><div class="form-row"><div style="float: left; margin-right: 10px;"> - <label>Groups associated with '${name}'</label> + <label>Groups associated with '${name|h}'</label> ${render_select( "in_groups", in_groups )}<br/><input type="submit" id="groups_remove_button" value=">>"/></div><div> - <label>Groups not associated with '${name}'</label> + <label>Groups not associated with '${name|h}'</label> ${render_select( "out_groups", out_groups )}<br/><input type="submit" id="groups_add_button" value="<<"/></div> diff -r 5fc83b69fe241d469ad27235a39e93d847764bbc -r f0f1f78b54c55c8569bd1e3ed7fc15726b0b64a4 templates/admin/quota/quota_create.mako --- a/templates/admin/quota/quota_create.mako +++ b/templates/admin/quota/quota_create.mako @@ -11,9 +11,9 @@ </%def><%def name="render_select( name, options )"> - <select name="${name}" id="${name}" style="min-width: 250px; height: 150px;" multiple> + <select name="${name|h}" id="${name|h}" style="min-width: 250px; height: 150px;" multiple> %for option in options: - <option value="${option[0]}">${option[1]}</option> + <option value="${option[0]|h}">${option[1]|h}</option> %endfor </select></%def> @@ -69,15 +69,15 @@ <form name="associate_quota_group_user" id="associate_quota_group_user" action="${h.url_for(controller='admin', action='create_quota' )}" method="post" ><div class="form-row"><label>Name:</label> - <input name="name" type="textfield" value="${name}" size=40"/> + <input name="name" type="textfield" value="${name|h}" size=40"/></div><div class="form-row"><label>Description:</label> - <input name="description" type="textfield" value="${description}" size=40"/> + <input name="description" type="textfield" value="${description|h}" size=40"/></div><div class="form-row"><label>Amount</label> - <input name="amount" type="textfield" value="${amount}" size=40"/> + <input name="amount" type="textfield" value="${amount|h}" size=40"/><div class="toolParamHelp" style="clear: both;"> Examples: "10000MB", "99 gb", "0.2T", "unlimited" </div> diff -r 5fc83b69fe241d469ad27235a39e93d847764bbc -r f0f1f78b54c55c8569bd1e3ed7fc15726b0b64a4 templates/admin/quota/quota_edit.mako --- a/templates/admin/quota/quota_edit.mako +++ b/templates/admin/quota/quota_edit.mako @@ -29,7 +29,7 @@ <input name="id" type="hidden" value="${id}"/><div class="form-row"><label>Amount</label> - <input name="amount" type="textfield" value="${display_amount}" size=40"/> + <input name="amount" type="textfield" value="${display_amount|h}" size=40"/><div class="toolParamHelp" style="clear: both;"> Examples: "10000MB", "99 gb", "0.2T", "unlimited" </div> diff -r 5fc83b69fe241d469ad27235a39e93d847764bbc -r f0f1f78b54c55c8569bd1e3ed7fc15726b0b64a4 templates/admin/quota/quota_rename.mako --- a/templates/admin/quota/quota_rename.mako +++ b/templates/admin/quota/quota_rename.mako @@ -21,14 +21,14 @@ <div class="form-row"><label>Name:</label><div style="float: left; width: 250px; margin-right: 10px;"> - <input type="text" name="name" value="${name}" size="40"/> + <input type="text" name="name" value="${name|h}" size="40"/></div><div style="clear: both"></div></div><div class="form-row"><label>Description:</label><div style="float: left; width: 250px; margin-right: 10px;"> - <input name="description" type="textfield" value="${description}" size=40"/> + <input name="description" type="textfield" value="${description|h}" size=40"/></div><div style="clear: both"></div></div> diff -r 5fc83b69fe241d469ad27235a39e93d847764bbc -r f0f1f78b54c55c8569bd1e3ed7fc15726b0b64a4 templates/admin/reload_tool.mako --- a/templates/admin/reload_tool.mako +++ b/templates/admin/reload_tool.mako @@ -28,9 +28,9 @@ <select name="tool_id"> %for key, val in toolbox.tool_panel.items(): %if isinstance( val, Tool ): - <option value="${val.id}">${val.name}</option> + <option value="${val.id}">${val.name|h}</option> %elif isinstance( val, ToolSection ): - <optgroup label="${val.name}"> + <optgroup label="${val.name|h}"><% section = val %> %for section_key, section_val in section.elems.items(): %if isinstance( section_val, Tool ): @@ -38,7 +38,7 @@ %if section_val.id == tool_id: <% selected_str = " selected=\"selected\"" %> %endif - <option value="${section_val.id}"${selected_str}>${section_val.name}</option> + <option value="${section_val.id}"${selected_str}>${section_val.name|h}</option> %endif %endfor %endif diff -r 5fc83b69fe241d469ad27235a39e93d847764bbc -r f0f1f78b54c55c8569bd1e3ed7fc15726b0b64a4 templates/admin/review_tool_migration_stages.mako --- a/templates/admin/review_tool_migration_stages.mako +++ b/templates/admin/review_tool_migration_stages.mako @@ -4,7 +4,9 @@ %if message: ${render_msg( message, status )} %endif - +<% +from markupsafe import escape +%><div class="toolForm"><div class="toolFormTitle">Tool migrations that can be performed on this Galaxy instance</div><div class="toolFormBody"> @@ -51,7 +53,7 @@ repository_names.sort() repository_names = ', '.join( repository_names ) %> - <tr><td bgcolor="#D8D8D8"><b>Tool migration stage ${stage} - repositories: ${repository_names}</b></td></tr> + <tr><td bgcolor="#D8D8D8"><b>Tool migration stage ${stage} - repositories: ${repository_names|h}</b></td></tr><tr><td bgcolor="#FFFFCC"><div class="form-row"> @@ -59,11 +61,11 @@ <p> %if tool_dependencies: This migration stage includes tools that have tool dependencies that can be automatically installed. To install them, run:<br/> - <b>${install_dependencies}</b><br/><br/> + <b>${install_dependencies|h}</b><br/><br/> To skip tool dependency installation run:<br/> - <b>${migration_command}</b> + <b>${migration_command|h}</b> %else: - <b>${migration_command}</b> + <b>${migration_command|h}</b> %endif </p></div> @@ -74,7 +76,7 @@ <tr><td bgcolor="#DADFEF"><div class="form-row"> - <b>Repository:</b> ${repository_name} + <b>Repository:</b> ${repository_name|h} </div></td></tr> @@ -88,10 +90,10 @@ </tr> %for tool_dependencies_tup in tool_dependencies: <% - tool_dependency_name = tool_dependencies_tup[0] - tool_dependency_version = tool_dependencies_tup[1] - tool_dependency_type = tool_dependencies_tup[2] - installation_requirements = tool_dependencies_tup[3].replace( '\n', '<br/>' ) + tool_dependency_name = escape( tool_dependencies_tup[0] ) + tool_dependency_version = escape( tool_dependencies_tup[1] ) + tool_dependency_type = escape( tool_dependencies_tup[2] ) + installation_requirements = escape( tool_dependencies_tup[3] ).replace( '\n', '<br/>' ) %><tr><td> diff -r 5fc83b69fe241d469ad27235a39e93d847764bbc -r f0f1f78b54c55c8569bd1e3ed7fc15726b0b64a4 templates/admin/tool_shed_repository/browse_repository.mako --- a/templates/admin/tool_shed_repository/browse_repository.mako +++ b/templates/admin/tool_shed_repository/browse_repository.mako @@ -21,7 +21,7 @@ %endif <div class="toolForm"> - <div class="toolFormTitle">Browse ${repository.name} revision ${repository.changeset_revision} files</div> + <div class="toolFormTitle">Browse ${repository.name|h} revision ${repository.changeset_revision} files</div><div class="toolFormBody"><div class="form-row" ><label>Contents:</label> diff -r 5fc83b69fe241d469ad27235a39e93d847764bbc -r f0f1f78b54c55c8569bd1e3ed7fc15726b0b64a4 templates/admin/tool_shed_repository/browse_tool_dependency.mako --- a/templates/admin/tool_shed_repository/browse_tool_dependency.mako +++ b/templates/admin/tool_shed_repository/browse_tool_dependency.mako @@ -23,33 +23,33 @@ %endif <div class="toolForm"> - <div class="toolFormTitle">Browse tool dependency ${tool_dependency.name} installation directory</div> + <div class="toolFormTitle">Browse tool dependency ${tool_dependency.name|h} installation directory</div><div class="toolFormBody"><div class="form-row" ><label>Tool shed repository:</label> - ${repository.name} + ${repository.name|h} <div style="clear: both"></div></div><div class="form-row" ><label>Tool shed repository changeset revision:</label> - ${repository.changeset_revision} + ${repository.changeset_revision|h} <div style="clear: both"></div></div><div class="form-row" ><label>Tool dependency status:</label> - ${tool_dependency.status} + ${tool_dependency.status|h} <div style="clear: both"></div></div> %if tool_dependency.in_error_state: <div class="form-row" ><label>Tool dependency installation error:</label> - ${tool_dependency.error_message} + ${tool_dependency.error_message|h} <div style="clear: both"></div></div> %endif <div class="form-row" ><label>Tool dependency installation directory:</label> - ${tool_dependency.installation_directory( trans.app )} + ${tool_dependency.installation_directory( trans.app )|h} <div style="clear: both"></div></div><div class="form-row" > diff -r 5fc83b69fe241d469ad27235a39e93d847764bbc -r f0f1f78b54c55c8569bd1e3ed7fc15726b0b64a4 templates/admin/tool_shed_repository/common.mako --- a/templates/admin/tool_shed_repository/common.mako +++ b/templates/admin/tool_shed_repository/common.mako @@ -8,7 +8,7 @@ }); // --- Initialize sample trees $("#tree").dynatree({ - title: "${title_text}", + title: "${title_text|h}", rootVisible: true, minExpandLevel: 0, // 1: root node is not collapsible persist: false, @@ -24,7 +24,7 @@ // initAjax is hard to fake, so we pass the children as object array: initAjax: {url: "${h.url_for( controller='admin_toolshed', action='open_folder' )}", dataType: "json", - data: { folder_path: "${directory_path}" }, + data: { folder_path: "${directory_path|h}" }, }, onLazyRead: function(dtnode){ dtnode.appendAjax({ @@ -45,7 +45,7 @@ var cell = $("#file_contents"); var selected_value; if (dtnode.data.key == 'root') { - selected_value = "${directory_path}/"; + selected_value = "${directory_path|h}/"; } else { selected_value = dtnode.data.key; }; @@ -81,6 +81,7 @@ line-break:strict; } </style><% + from markupsafe import escape class RowCounter( object ): def __init__( self ): self.count = 0 @@ -96,7 +97,7 @@ env_settings_heaader_row_displayed = False package_header_row_displayed = False if revision_label: - revision_label_str = ' revision <b>%s</b> of ' % str( revision_label ) + revision_label_str = ' revision <b>%s</b> of ' % escape( str( revision_label ) ) else: revision_label_str = ' ' %> @@ -104,7 +105,7 @@ <div class="toolParamHelp" style="clear: both;"><p> %if export: - The following additional repositories are required by${revision_label_str}the <b>${repository.name}</b> repository + The following additional repositories are required by${revision_label_str}the <b>${repository.name|h}</b> repository and they can be exported as well. %else: These dependencies can be automatically handled with${revision_label_str}the installed repository, providing significant diff -r 5fc83b69fe241d469ad27235a39e93d847764bbc -r f0f1f78b54c55c8569bd1e3ed7fc15726b0b64a4 templates/admin/tool_shed_repository/deactivate_or_uninstall_repository.mako --- a/templates/admin/tool_shed_repository/deactivate_or_uninstall_repository.mako +++ b/templates/admin/tool_shed_repository/deactivate_or_uninstall_repository.mako @@ -10,30 +10,30 @@ %endif <div class="toolForm"> - <div class="toolFormTitle">${repository.name}</div> + <div class="toolFormTitle">${repository.name|h}</div><div class="toolFormBody"><form name="deactivate_or_uninstall_repository" id="deactivate_or_uninstall_repository" action="${h.url_for( controller='admin_toolshed', action='deactivate_or_uninstall_repository', id=trans.security.encode_id( repository.id ) )}" method="post" ><div class="form-row"><label>Description:</label> - ${repository.description} + ${repository.description|h} <div style="clear: both"></div></div><div class="form-row"><label>Revision:</label> - ${repository.changeset_revision}</a> + ${repository.changeset_revision|h}</a></div><div class="form-row"><label>Tool shed:</label> - ${repository.tool_shed} + ${repository.tool_shed|h} <div style="clear: both"></div></div><div class="form-row"><label>Owner:</label> - ${repository.owner} + ${repository.owner|h} </div><div class="form-row"><label>Deleted:</label> - ${repository.deleted} + ${repository.deleted|h} </div><div class="form-row"><% @@ -186,7 +186,7 @@ ##hack to mimic check box <input type="hidden" name="remove_from_disk" value="true"/><input type="hidden" name="remove_from_disk" value="true"/> %endif - <input type="submit" name="deactivate_or_uninstall_repository_button" value="${deactivate_uninstall_button_text}"/> + <input type="submit" name="deactivate_or_uninstall_repository_button" value="${deactivate_uninstall_button_text|h}"/></div></form></div> diff -r 5fc83b69fe241d469ad27235a39e93d847764bbc -r f0f1f78b54c55c8569bd1e3ed7fc15726b0b64a4 templates/admin/tool_shed_repository/initiate_repository_installation.mako --- a/templates/admin/tool_shed_repository/initiate_repository_installation.mako +++ b/templates/admin/tool_shed_repository/initiate_repository_installation.mako @@ -53,18 +53,18 @@ <td> %if link_to_manage_tool_dependencies: <a class="view-info" href="${h.url_for( controller='admin_toolshed', action='manage_tool_dependencies', tool_dependency_ids=ids_of_tool_dependencies_missing_or_being_installed )}"> - ${tool_shed_repository.name} + ${tool_shed_repository.name|h} </a> %else: <a class="view-info" href="${h.url_for( controller='admin_toolshed', action='manage_repository', id=encoded_repository_id )}"> - ${tool_shed_repository.name} + ${tool_shed_repository.name|h} </a> %endif </td><td>${tool_shed_repository.description}</td><td>${tool_shed_repository.owner}</td><td>${tool_shed_repository.changeset_revision}</td> - <td><div id="RepositoryStatus-${encoded_repository_id}">${tool_shed_repository.status}</div></td> + <td><div id="RepositoryStatus-${encoded_repository_id}">${tool_shed_repository.status|h}</div></td></tr> %endfor </table> diff -r 5fc83b69fe241d469ad27235a39e93d847764bbc -r f0f1f78b54c55c8569bd1e3ed7fc15726b0b64a4 templates/admin/tool_shed_repository/install_tool_dependencies_with_update.mako --- a/templates/admin/tool_shed_repository/install_tool_dependencies_with_update.mako +++ b/templates/admin/tool_shed_repository/install_tool_dependencies_with_update.mako @@ -20,12 +20,12 @@ <div class="toolForm"><div class="toolFormBody"><form name="install_tool_dependencies_with_update" id="install_tool_dependencies_with_update" action="${h.url_for( controller='admin_toolshed', action='install_tool_dependencies_with_update' )}" method="post" > - <input type="hidden" name="updating_repository_id" value="${updating_repository_id}"/> - <input type="hidden" name="updating_to_ctx_rev" value="${updating_to_ctx_rev}"/> - <input type="hidden" name="updating_to_changeset_revision" value="${updating_to_changeset_revision}"/> - <input type="hidden" name="encoded_updated_metadata" value="${encoded_updated_metadata}"/> - <input type="hidden" name="encoded_relative_install_dir" value="${encoded_relative_install_dir}"/> - <input type="hidden" name="encoded_tool_dependencies_dict" value="${encoded_tool_dependencies_dict}"/> + <input type="hidden" name="updating_repository_id" value="${updating_repository_id|h}"/> + <input type="hidden" name="updating_to_ctx_rev" value="${updating_to_ctx_rev|h}"/> + <input type="hidden" name="updating_to_changeset_revision" value="${updating_to_changeset_revision|h}"/> + <input type="hidden" name="encoded_updated_metadata" value="${encoded_updated_metadata|h}"/> + <input type="hidden" name="encoded_relative_install_dir" value="${encoded_relative_install_dir|h}"/> + <input type="hidden" name="encoded_tool_dependencies_dict" value="${encoded_tool_dependencies_dict|h}"/> %if tool_dependencies_dict: %if install_tool_dependencies_check_box is not None: <div class="form-row"> @@ -71,12 +71,12 @@ %> %if not os.path.exists( install_dir ): <tr> - <td>${key_name}</td> - <td>${key_version}</td> - <td>${install_dir}</td> + <td>${key_name|h}</td> + <td>${key_version|h}</td> + <td>${install_dir|h}</td></tr> %if readme_text: - <tr><td colspan="4" bgcolor="#FFFFCC">${key_name} ${key_version} requirements and installation information</td></tr> + <tr><td colspan="4" bgcolor="#FFFFCC">${key_name|h} ${key_version|h} requirements and installation information</td></tr><tr><td colspan="4"><pre>${readme_text}</pre></td></tr> %endif %endif diff -r 5fc83b69fe241d469ad27235a39e93d847764bbc -r f0f1f78b54c55c8569bd1e3ed7fc15726b0b64a4 templates/admin/tool_shed_repository/manage_repository.mako --- a/templates/admin/tool_shed_repository/manage_repository.mako +++ b/templates/admin/tool_shed_repository/manage_repository.mako @@ -22,50 +22,50 @@ %endif <div class="toolForm"> - <div class="toolFormTitle">Installed tool shed repository '${repository.name}'</div> + <div class="toolFormTitle">Installed tool shed repository '${repository.name|h}'</div><div class="toolFormBody"><form name="edit_repository" id="edit_repository" action="${h.url_for( controller='admin_toolshed', action='manage_repository', id=trans.security.encode_id( repository.id ) )}" method="post" ><div class="form-row"><label>Tool shed:</label> - ${repository.tool_shed} + ${repository.tool_shed|h} <div style="clear: both"></div></div><div class="form-row"><label>Name:</label> - ${repository.name} + ${repository.name|h} <div style="clear: both"></div></div><div class="form-row"><label>Description:</label> %if in_error_state: - ${description} + ${description|h} %else: - <input name="description" type="textfield" value="${description}" size="80"/> + <input name="description" type="textfield" value="${description|h}" size="80"/> %endif <div style="clear: both"></div></div><div class="form-row"><label>Revision:</label> - ${repository.changeset_revision} + ${repository.changeset_revision|h} </div><div class="form-row"><label>Owner:</label> - ${repository.owner} + ${repository.owner|h} </div> %if in_error_state: <div class="form-row"><label>Repository installation error:</label> - ${repository.error_message} + ${repository.error_message|h} </div> %else: <div class="form-row"><label>Location:</label> - ${repo_files_dir} + ${repo_files_dir|h} </div> %endif <div class="form-row"><label>Deleted:</label> - ${repository.deleted} + ${repository.deleted|h} </div> %if not in_error_state: <div class="form-row"> diff -r 5fc83b69fe241d469ad27235a39e93d847764bbc -r f0f1f78b54c55c8569bd1e3ed7fc15726b0b64a4 templates/admin/tool_shed_repository/manage_repository_tool_dependencies.mako --- a/templates/admin/tool_shed_repository/manage_repository_tool_dependencies.mako +++ b/templates/admin/tool_shed_repository/manage_repository_tool_dependencies.mako @@ -20,7 +20,7 @@ %endif <div class="toolForm"> - <div class="toolFormTitle">Tool shed repository '${repository.name}' tool dependencies</div> + <div class="toolFormTitle">Tool shed repository '${repository.name|h}' tool dependencies</div><% can_install = False can_uninstall = False @@ -48,16 +48,16 @@ <td> %if tool_dependency.status not in [ trans.install_model.ToolDependency.installation_status.UNINSTALLED ]: <a target="galaxy_main" href="${h.url_for( controller='admin_toolshed', action='manage_repository_tool_dependencies', operation='browse', tool_dependency_ids=trans.security.encode_id( tool_dependency.id ), repository_id=trans.security.encode_id( repository.id ) )}"> - ${tool_dependency.name} + ${tool_dependency.name|h} </a> %else: - ${tool_dependency.name} + ${tool_dependency.name|h} %endif </td> - <td>${tool_dependency.version}</td> - <td>${tool_dependency.type}</td> - <td>${tool_dependency.status}</td> - <td>${error_message}</td> + <td>${tool_dependency.version|h}</td> + <td>${tool_dependency.type|h}</td> + <td>${tool_dependency.status|h}</td> + <td>${error_message|h}</td></tr> %endfor </table> diff -r 5fc83b69fe241d469ad27235a39e93d847764bbc -r f0f1f78b54c55c8569bd1e3ed7fc15726b0b64a4 templates/admin/tool_shed_repository/purge_repository_confirmation.mako --- a/templates/admin/tool_shed_repository/purge_repository_confirmation.mako +++ b/templates/admin/tool_shed_repository/purge_repository_confirmation.mako @@ -19,14 +19,14 @@ <div class="warningmessage"><p> - Purging the repository named <b>${repository.name}</b> will result in deletion of all records for the + Purging the repository named <b>${repository.name|h}</b> will result in deletion of all records for the following associated items from the database. Click the <b>Purge</b> button to purge this repository and its associated items. </p></div><div class="toolForm"> - <div class="toolFormTitle">Purge tool shed repository <b>${repository.name}</b></div> + <div class="toolFormTitle">Purge tool shed repository <b>${repository.name|h}</b></div><form name="purge_repository" id="purge_repository" action="${h.url_for( controller='admin_toolshed', action='purge_repository', id=trans.security.encode_id( repository.id ) )}" method="post" ><% tool_versions = 0 @@ -59,11 +59,11 @@ orphan_repository_dependency_records += 1 %><table class="grid"> - <tr><td>Tool version records</td><td>${tool_versions}</td><tr> - <tr><td>Tool dependency records</td><td>${tool_dependencies}</td><tr> - <tr><td>Repository dependency records</td><td>${required_repositories}</td><tr> - <tr><td>Orphan repository_repository_dependency_association records</td><td>${orphan_repository_repository_dependency_association_records}</td><tr> - <tr><td>Orphan repository_dependency records</td><td>${orphan_repository_dependency_records}</td><tr> + <tr><td>Tool version records</td><td>${tool_versions|h}</td><tr> + <tr><td>Tool dependency records</td><td>${tool_dependencies|h}</td><tr> + <tr><td>Repository dependency records</td><td>${required_repositories|h}</td><tr> + <tr><td>Orphan repository_repository_dependency_association records</td><td>${orphan_repository_repository_dependency_association_records|h}</td><tr> + <tr><td>Orphan repository_dependency records</td><td>${orphan_repository_dependency_records|h}</td><tr></table><div style="clear: both"></div><div class="form-row"> diff -r 5fc83b69fe241d469ad27235a39e93d847764bbc -r f0f1f78b54c55c8569bd1e3ed7fc15726b0b64a4 templates/admin/tool_shed_repository/repair_repository.mako --- a/templates/admin/tool_shed_repository/repair_repository.mako +++ b/templates/admin/tool_shed_repository/repair_repository.mako @@ -37,9 +37,9 @@ </div><div class="toolForm"> - <div class="toolFormTitle">Repair tool shed repository <b>${repository.name}</b></div> + <div class="toolFormTitle">Repair tool shed repository <b>${repository.name|h}</b></div><form name="repair_repository" id="repair_repository" action="${h.url_for( controller='admin_toolshed', action='repair_repository', id=trans.security.encode_id( repository.id ) )}" method="post" > - <input type="hidden" name="repair_dict" value="${encoded_repair_dict}"/> + <input type="hidden" name="repair_dict" value="${encoded_repair_dict|h}"/><% from tool_shed.util.shed_util_common import get_tool_shed_repository_status_label ordered_repo_info_dicts = repair_dict.get( 'ordered_repo_info_dicts', [] ) diff -r 5fc83b69fe241d469ad27235a39e93d847764bbc -r f0f1f78b54c55c8569bd1e3ed7fc15726b0b64a4 templates/admin/tool_shed_repository/repository_installation_status.mako --- a/templates/admin/tool_shed_repository/repository_installation_status.mako +++ b/templates/admin/tool_shed_repository/repository_installation_status.mako @@ -1,5 +1,6 @@ <%def name="render_repository_status( repository )"><% + from markupsafe import escape if repository.status in [ trans.install_model.ToolShedRepository.installation_status.CLONING, trans.install_model.ToolShedRepository.installation_status.SETTING_TOOL_VERSIONS, trans.install_model.ToolShedRepository.installation_status.INSTALLING_TOOL_DEPENDENCIES, @@ -20,7 +21,7 @@ else: bgcolor = trans.install_model.ToolShedRepository.states.ERROR rval = '<div class="count-box state-color-%s" id="RepositoryStatus-%s">' % ( bgcolor, trans.security.encode_id( repository.id ) ) - rval += '%s</div>' % repository.status + rval += '%s</div>' % escape( repository.status ) return rval %> ${rval} diff -r 5fc83b69fe241d469ad27235a39e93d847764bbc -r f0f1f78b54c55c8569bd1e3ed7fc15726b0b64a4 templates/admin/tool_shed_repository/reselect_tool_panel_section.mako --- a/templates/admin/tool_shed_repository/reselect_tool_panel_section.mako +++ b/templates/admin/tool_shed_repository/reselect_tool_panel_section.mako @@ -62,12 +62,12 @@ <label>Shed tool configuration file:</label> ${shed_tool_conf_select_field.get_html()} <div class="toolParamHelp" style="clear: both;"> - ${select_help} + ${select_help|h} </div></div><div style="clear: both"></div> %else: - <input type="hidden" name="shed_tool_conf" value="${shed_tool_conf}"/> + <input type="hidden" name="shed_tool_conf" value="${shed_tool_conf|h}"/> %endif %if includes_tools_for_display_in_tool_panel: <div style="clear: both"></div> diff -r 5fc83b69fe241d469ad27235a39e93d847764bbc -r f0f1f78b54c55c8569bd1e3ed7fc15726b0b64a4 templates/admin/tool_shed_repository/select_shed_tool_panel_config.mako --- a/templates/admin/tool_shed_repository/select_shed_tool_panel_config.mako +++ b/templates/admin/tool_shed_repository/select_shed_tool_panel_config.mako @@ -71,7 +71,7 @@ <input type="hidden" name="includes_tools" value="${includes_tools}" /><input type="hidden" name="includes_tool_dependencies" value="${includes_tool_dependencies}" /><input type="hidden" name="includes_tools_for_display_in_tool_panel" value="${includes_tools_for_display_in_tool_panel}" /> - <input type="hidden" name="tool_shed_url" value="${tool_shed_url}" /> + <input type="hidden" name="tool_shed_url" value="${tool_shed_url|h}" /></div><div style="clear: both"></div><% readme_files_dict = containers_dict.get( 'readme_files', None ) %> @@ -111,12 +111,12 @@ <label>Shed tool configuration file:</label> ${shed_tool_conf_select_field.get_html()} <div class="toolParamHelp" style="clear: both;"> - ${select_help} + ${select_help|h} </div></div><div style="clear: both"></div> %else: - <input type="hidden" name="shed_tool_conf" value="${shed_tool_conf}"/> + <input type="hidden" name="shed_tool_conf" value="${shed_tool_conf|h}"/> %endif <div class="form-row"><input type="submit" name="select_shed_tool_panel_config_button" value="Install"/> diff -r 5fc83b69fe241d469ad27235a39e93d847764bbc -r f0f1f78b54c55c8569bd1e3ed7fc15726b0b64a4 templates/admin/tool_shed_repository/select_tool_panel_section.mako --- a/templates/admin/tool_shed_repository/select_tool_panel_section.mako +++ b/templates/admin/tool_shed_repository/select_tool_panel_section.mako @@ -111,16 +111,16 @@ <label>Shed tool configuration file:</label> ${shed_tool_conf_select_field.get_html()} <div class="toolParamHelp" style="clear: both;"> - ${select_help} + ${select_help|h} </div></div><div style="clear: both"></div> %else: - <input type="hidden" name="shed_tool_conf" value="${shed_tool_conf}"/> + <input type="hidden" name="shed_tool_conf" value="${shed_tool_conf|h}"/> %endif <div class="form-row"><label>Add new tool panel section:</label> - <input name="new_tool_panel_section_label" type="textfield" value="${new_tool_panel_section_label}" size="40"/> + <input name="new_tool_panel_section_label" type="textfield" value="${new_tool_panel_section_label|h}" size="40"/><div class="toolParamHelp" style="clear: both;"> Add a new tool panel section to contain the installed tools (optional). </div> diff -r 5fc83b69fe241d469ad27235a39e93d847764bbc -r f0f1f78b54c55c8569bd1e3ed7fc15726b0b64a4 templates/admin/tool_shed_repository/uninstall_tool_dependencies.mako --- a/templates/admin/tool_shed_repository/uninstall_tool_dependencies.mako +++ b/templates/admin/tool_shed_repository/uninstall_tool_dependencies.mako @@ -43,10 +43,10 @@ install_dir = "This dependency's installation directory does not exist, click <b>Uninstall</b> to reset for installation." %><tr> - <td>${tool_dependency.name}</td> - <td>${tool_dependency.version}</td> - <td>${tool_dependency.type}</td> - <td>${install_dir}</td> + <td>${tool_dependency.name|h}</td> + <td>${tool_dependency.version|h}</td> + <td>${tool_dependency.type|h}</td> + <td>${install_dir|h}</td></tr> %endfor </table> diff -r 5fc83b69fe241d469ad27235a39e93d847764bbc -r f0f1f78b54c55c8569bd1e3ed7fc15726b0b64a4 templates/admin/tool_shed_repository/view_tool_metadata.mako --- a/templates/admin/tool_shed_repository/view_tool_metadata.mako +++ b/templates/admin/tool_shed_repository/view_tool_metadata.mako @@ -11,7 +11,7 @@ %if tool_metadata: <p/><div class="toolForm"> - <div class="toolFormTitle">${tool_metadata[ 'name' ]} tool metadata</div> + <div class="toolFormTitle">${tool_metadata[ 'name' ]|h} tool metadata</div><div class="toolFormBody"><div class="form-row"><table width="100%"> @@ -20,41 +20,41 @@ </div><div class="form-row"><label>Name:</label> - ${tool_metadata[ 'name' ]} + ${tool_metadata[ 'name' ]|h} <div style="clear: both"></div></div> %if 'description' in tool_metadata: <div class="form-row"><label>Description:</label> - ${tool_metadata[ 'description' ]} + ${tool_metadata[ 'description' ]|h} <div style="clear: both"></div></div> %endif %if 'id' in tool_metadata: <div class="form-row"><label>Id:</label> - ${tool_metadata[ 'id' ]} + ${tool_metadata[ 'id' ]|h} <div style="clear: both"></div></div> %endif %if 'guid' in tool_metadata: <div class="form-row"><label>Guid:</label> - ${tool_metadata[ 'guid' ]} + ${tool_metadata[ 'guid' ]|h} <div style="clear: both"></div></div> %endif %if 'version' in tool_metadata: <div class="form-row"><label>Version:</label> - ${tool_metadata[ 'version' ]} + ${tool_metadata[ 'version' ]|h} <div style="clear: both"></div></div> %endif %if 'version_string_cmd' in tool_metadata: <div class="form-row"><label>Version command string:</label> - ${tool_metadata[ 'version_string_cmd' ]} + ${tool_metadata[ 'version_string_cmd' ]|h} <div style="clear: both"></div></div> %endif @@ -70,9 +70,9 @@ <tr><td> %if guid == tool_metadata[ 'guid' ]: - ${guid} <b>(this tool)</b> + ${guid|h} <b>(this tool)</b> %else: - ${guid} + ${guid|h} %endif </td></tr> @@ -109,9 +109,9 @@ requirement_type = requirement_dict[ 'type' ] or 'not provided' %><tr> - <td>${requirement_name}</td> - <td>${requirement_version}</td> - <td>${requirement_type}</td> + <td>${requirement_name|h}</td> + <td>${requirement_version|h}</td> + <td>${requirement_type|h}</td></tr> %endfor </table> @@ -130,27 +130,27 @@ </div><div class="form-row"><label>Command:</label> - <pre>${tool.command}</pre> + <pre>${tool.command|h}</pre><div style="clear: both"></div></div><div class="form-row"><label>Interpreter:</label> - ${tool.interpreter} + ${tool.interpreter|h} <div style="clear: both"></div></div><div class="form-row"><label>Is multi-byte:</label> - ${tool.is_multi_byte} + ${tool.is_multi_byte|h} <div style="clear: both"></div></div><div class="form-row"><label>Forces a history refresh:</label> - ${tool.force_history_refresh} + ${tool.force_history_refresh|h} <div style="clear: both"></div></div><div class="form-row"><label>Parallelism:</label> - ${tool.parallelism} + ${tool.parallelism|h} <div style="clear: both"></div></div> %endif @@ -181,20 +181,20 @@ required_files = test_dict[ 'required_files' ] %><tr> - <td>${test_dict[ 'name' ]}</td> + <td>${test_dict[ 'name' ]|h}</td><td> %for input in inputs: - <b>${input[0]}:</b> ${input[1]}<br/> + <b>${input[0]|h}:</b> ${input[1]|h}<br/> %endfor </td><td> %for output in outputs: - <b>${output[0]}:</b> ${output[1]}<br/> + <b>${output[0]|h}:</b> ${output[1]|h}<br/> %endfor </td><td> %for required_file in required_files: - ${required_file}<br/> + ${required_file|h}<br/> %endfor </td></tr> diff -r 5fc83b69fe241d469ad27235a39e93d847764bbc -r f0f1f78b54c55c8569bd1e3ed7fc15726b0b64a4 templates/admin/tool_shed_repository/view_workflow.mako --- a/templates/admin/tool_shed_repository/view_workflow.mako +++ b/templates/admin/tool_shed_repository/view_workflow.mako @@ -17,7 +17,7 @@ <%def name="render_workflow( workflow_name, repository_id )"><% center_url = h.url_for( controller='admin_toolshed', action='generate_workflow_image', workflow_name=tool_shed_encode( workflow_name ), repository_id=repository_id ) %> - <iframe name="workflow_image" id="workflow_image" frameborder="0" style="position: absolute; width: 100%; height: 100%;" src="${center_url}"></iframe> + <iframe name="workflow_image" id="workflow_image" frameborder="0" style="position: absolute; width: 100%; height: 100%;" src="${center_url|h}"></iframe></%def> ${render_galaxy_repository_actions( repository )} diff -r 5fc83b69fe241d469ad27235a39e93d847764bbc -r f0f1f78b54c55c8569bd1e3ed7fc15726b0b64a4 templates/admin/user/reset_password.mako --- a/templates/admin/user/reset_password.mako +++ b/templates/admin/user/reset_password.mako @@ -13,7 +13,7 @@ %for user in users: <div class="form-row"><label>Email:</label> - ${user.email} + ${user.email|h} <div style="clear: both"></div></div> %endfor diff -r 5fc83b69fe241d469ad27235a39e93d847764bbc -r f0f1f78b54c55c8569bd1e3ed7fc15726b0b64a4 templates/admin/user/user.mako --- a/templates/admin/user/user.mako +++ b/templates/admin/user/user.mako @@ -11,9 +11,9 @@ </%def><%def name="render_select( name, options )"> - <select name="${name}" id="${name}" style="min-width: 250px; height: 150px;" multiple> + <select name="${name|h}" id="${name|h}" style="min-width: 250px; height: 150px;" multiple> %for option in options: - <option value="${option[0]}">${option[1]}</option> + <option value="${option[0]|h}">${option[1]|h}</option> %endfor </select></%def> @@ -48,29 +48,29 @@ %endif <div class="toolForm"> - <div class="toolFormTitle">User '${user.email}'</div> + <div class="toolFormTitle">User '${user.email|h}'</div><div class="toolFormBody"><form name="associate_user_role_group" id="associate_user_role_group" action="${h.url_for(controller='admin', action='manage_roles_and_groups_for_user', id=trans.security.encode_id( user.id ) )}" method="post" ><div class="form-row"><div style="float: left; margin-right: 10px;"> - <label>Roles associated with '${user.email}'</label> + <label>Roles associated with '${user.email|h}'</label> ${render_select( "in_roles", in_roles )}<br/><input type="submit" id="roles_remove_button" value=">>"/></div><div> - <label>Roles not associated with '${user.email}'</label> + <label>Roles not associated with '${user.email|h}'</label> ${render_select( "out_roles", out_roles )}<br/><input type="submit" id="roles_add_button" value="<<"/></div></div><div class="form-row"><div style="float: left; margin-right: 10px;"> - <label>Groups associated with '${user.email}'</label> + <label>Groups associated with '${user.email|h}'</label> ${render_select( "in_groups", in_groups )}<br/><input type="submit" id="groups_remove_button" value=">>"/></div><div> - <label>Groups not associated with '${user.email}'</label> + <label>Groups not associated with '${user.email|h}'</label> ${render_select( "out_groups", out_groups )}<br/><input type="submit" id="groups_add_button" value="<<"/></div> diff -r 5fc83b69fe241d469ad27235a39e93d847764bbc -r f0f1f78b54c55c8569bd1e3ed7fc15726b0b64a4 templates/admin/view_datatypes_registry.mako --- a/templates/admin/view_datatypes_registry.mako +++ b/templates/admin/view_datatypes_registry.mako @@ -37,16 +37,16 @@ %else: <tr class="tr"> %endif - <td>${datatype.extension}</td> - <td>${datatype.dtype}</td> + <td>${datatype.extension|h}</td> + <td>${datatype.dtype|h}</td><td> %if datatype.mimetype: - ${datatype.mimetype} + ${datatype.mimetype|h} %endif </td><td> %if datatype.display_in_upload: - ${datatype.display_in_upload} + ${datatype.display_in_upload|h} %endif </td></tr> diff -r 5fc83b69fe241d469ad27235a39e93d847764bbc -r f0f1f78b54c55c8569bd1e3ed7fc15726b0b64a4 templates/base.mako --- a/templates/base.mako +++ b/templates/base.mako @@ -39,7 +39,7 @@ <script> Raven.config('${app.config.sentry_dsn_public}').install(); %if trans.user: - Raven.setUser( { email: "${trans.user.email}" } ); + Raven.setUser( { email: "${trans.user.email|h}" } ); %endif </script> %endif diff -r 5fc83b69fe241d469ad27235a39e93d847764bbc -r f0f1f78b54c55c8569bd1e3ed7fc15726b0b64a4 templates/galaxy_client_app.mako --- a/templates/galaxy_client_app.mako +++ b/templates/galaxy_client_app.mako @@ -70,11 +70,12 @@ ## Return a dictionary of user or anonymous user data including: ## email, id, disk space used, quota percent, and tags used <% + from markupsafe import escape user_dict = {} try: if trans.user: user_dict = trans.user.to_dict( view='element', - value_mapper={ 'id': trans.security.encode_id, 'total_disk_usage': float } ) + value_mapper={ 'id': trans.security.encode_id, 'total_disk_usage': float, 'email': escape, 'username': escape } ) user_dict[ 'quota_percent' ] = trans.app.quota_agent.get_percent( trans=trans ) user_dict[ 'is_admin' ] = trans.user_is_admin() diff -r 5fc83b69fe241d469ad27235a39e93d847764bbc -r f0f1f78b54c55c8569bd1e3ed7fc15726b0b64a4 templates/user/index.mako --- a/templates/user/index.mako +++ b/templates/user/index.mako @@ -2,7 +2,7 @@ %if trans.user: <h2>${_('User preferences')}</h2> - <p>You are currently logged in as ${trans.user.email}.</p> + <p>You are currently logged in as ${trans.user.email|h}.</p><ul> %if t.webapp.name == 'galaxy': %if not trans.app.config.use_remote_user: diff -r 5fc83b69fe241d469ad27235a39e93d847764bbc -r f0f1f78b54c55c8569bd1e3ed7fc15726b0b64a4 templates/webapps/galaxy/admin/tool_sheds.mako --- a/templates/webapps/galaxy/admin/tool_sheds.mako +++ b/templates/webapps/galaxy/admin/tool_sheds.mako @@ -22,7 +22,7 @@ <tr class="libraryTitle"><td><div style="float: left; margin-left: 1px;" class="menubutton split popup" id="dataset-${shed_id}-popup"> - <a class="view-info" href="${h.url_for( controller='admin_toolshed', action='browse_tool_shed', tool_shed_url=url )}">${name}</a> + <a class="view-info" href="${h.url_for( controller='admin_toolshed', action='browse_tool_shed', tool_shed_url=url )}">${name|h}</a></div><div popupmenu="dataset-${shed_id}-popup"><a class="action-button" href="${h.url_for( controller='admin_toolshed', action='browse_tool_shed', tool_shed_url=url )}">Browse valid repositories</a> diff -r 5fc83b69fe241d469ad27235a39e93d847764bbc -r f0f1f78b54c55c8569bd1e3ed7fc15726b0b64a4 templates/webapps/galaxy/dataset/errors.mako --- a/templates/webapps/galaxy/dataset/errors.mako +++ b/templates/webapps/galaxy/dataset/errors.mako @@ -95,7 +95,7 @@ <input type="hidden" name="id" value="${trans.security.encode_id( hda.id)}" /><div class="form-row"><label>Your email</label> - <input type="text" name="email" size="40" value="${user_email}" /> + <input type="text" name="email" size="40" value="${user_email|h}" /></div><div class="form-row"><label>Message</label> diff -r 5fc83b69fe241d469ad27235a39e93d847764bbc -r f0f1f78b54c55c8569bd1e3ed7fc15726b0b64a4 templates/webapps/galaxy/galaxy.masthead.mako --- a/templates/webapps/galaxy/galaxy.masthead.mako +++ b/templates/webapps/galaxy/galaxy.masthead.mako @@ -3,6 +3,7 @@ ## masthead head generator <%def name="load(active_view = None)"><% + from markupsafe import escape ## get configuration masthead_config = { ## inject configuration @@ -32,7 +33,7 @@ ## user details 'user' : { 'requests' : bool(trans.user and (trans.user.requests or trans.app.security_agent.get_accessible_request_types(trans, trans.user))), - 'email' : trans.user.email if (trans.user) else "", + 'email' : escape( trans.user.email ) if (trans.user) else "", 'valid' : bool(trans.user != None), 'json' : get_user_dict() } diff -r 5fc83b69fe241d469ad27235a39e93d847764bbc -r f0f1f78b54c55c8569bd1e3ed7fc15726b0b64a4 templates/webapps/galaxy/galaxy.panels.mako --- a/templates/webapps/galaxy/galaxy.panels.mako +++ b/templates/webapps/galaxy/galaxy.panels.mako @@ -49,7 +49,7 @@ <script> Raven.config('${app.config.sentry_dsn_public}').install(); %if trans.user: - Raven.setUser( { email: "${trans.user.email}" } ); + Raven.setUser( { email: "${trans.user.email|h}" } ); %endif </script> %endif diff -r 5fc83b69fe241d469ad27235a39e93d847764bbc -r f0f1f78b54c55c8569bd1e3ed7fc15726b0b64a4 templates/webapps/tool_shed/base_panels.mako --- a/templates/webapps/tool_shed/base_panels.mako +++ b/templates/webapps/tool_shed/base_panels.mako @@ -91,7 +91,8 @@ %> ## User tabs. - <% + <% + from markupsafe import escape # Menu for user who is not logged in. menu_options = [ [ _("Login"), h.url_for( controller='/user', action='login' ), "galaxy_main" ] ] if app.config.allow_user_creation: @@ -101,7 +102,7 @@ tab( "user", _("User"), None, visible=visible, menu_options=menu_options ) # Menu for user who is logged in. if trans.user: - email = trans.user.email + email = escape( trans.user.email ) else: email = "" menu_options = [ [ '<a>Logged in as <span id="user-email">%s</span></a>' % email ] ] Repository URL: https://bitbucket.org/galaxy/galaxy-central/ -- This is a commit notification from bitbucket.org. You are receiving this because you have the service enabled, addressing the recipient of this email.

1 0

commit/galaxy-central: natefoo: Update tag latest_2014.10.06 for changeset 212e1d5e9be5
by commits-noreply＠bitbucket.org 11 Dec '14

11 Dec '14

1 new commit in galaxy-central: https://bitbucket.org/galaxy/galaxy-central/commits/5fc83b69fe24/ Changeset: 5fc83b69fe24 Branch: stable User: natefoo Date: 2014-12-11 14:00:20+00:00 Summary: Update tag latest_2014.10.06 for changeset 212e1d5e9be5 Affected #: 1 file diff -r 212e1d5e9be5a9a1e12c834bd545de504753c9fe -r 5fc83b69fe241d469ad27235a39e93d847764bbc .hgtags --- a/.hgtags +++ b/.hgtags @@ -20,4 +20,4 @@ ca45b78adb4152fc6e7395514d46eba6b7d0b838 release_2014.08.11 548ab24667d6206780237bd807f7d857a484c461 latest_2014.08.11 2092948937ac30ef82f71463a235c66d34987088 release_2014.10.06 -3e7adbbe91a06d30a96e7a7101707e040376aba1 latest_2014.10.06 +212e1d5e9be5a9a1e12c834bd545de504753c9fe latest_2014.10.06 Repository URL: https://bitbucket.org/galaxy/galaxy-central/ -- This is a commit notification from bitbucket.org. You are receiving this because you have the service enabled, addressing the recipient of this email.

1 0

commit/galaxy-central: jmchilton: Refactoring: Start abstracting XML processing out of Tool and param classes.
by commits-noreply＠bitbucket.org 10 Dec '14

10 Dec '14

1 new commit in galaxy-central: https://bitbucket.org/galaxy/galaxy-central/commits/2dc383cbb700/ Changeset: 2dc383cbb700 User: jmchilton Date: 2014-12-11 05:26:13+00:00 Summary: Refactoring: Start abstracting XML processing out of Tool and param classes. Long term this could allow Galaxy to support - multiple tooling formats (Galaxy-like YAML, CWL http://bit.ly/cwltooldesc, etc...). But I think it is also important from a purely design perspective - this is a core logic class integrating different components - they should not also be doing XML parsing. To verify the interface for parsing tools is expressive enough to allow multiple useful implementations, I built a test YAML tool description that implements many of the same features as Galaxy but smooths out rough edges (uses exit codes for job failure by default for instance). Loading these tools is disabled by default and it is not documented how to enable them because they are not intended to be part of Galaxy's public API. Affected #: 22 files diff -r b9c5b028e389678c1a073f11c9aba5104ae17e89 -r 2dc383cbb700f9d8d6a30eb976b70e8dcf1832db lib/galaxy/config.py --- a/lib/galaxy/config.py +++ b/lib/galaxy/config.py @@ -200,6 +200,9 @@ # workflows built using these modules may not function in the # future. self.enable_beta_workflow_modules = string_as_bool( kwargs.get( 'enable_beta_workflow_modules', 'False' ) ) + # These are not even beta - just experiments - don't use them unless + # you want yours tools to be broken in the future. + self.enable_beta_tool_formats = string_as_bool( kwargs.get( 'enable_beta_tool_formats', 'False' ) ) # Certain modules such as the pause module will automatically cause # workflows to be scheduled in job handlers the way all workflows will diff -r b9c5b028e389678c1a073f11c9aba5104ae17e89 -r 2dc383cbb700f9d8d6a30eb976b70e8dcf1832db lib/galaxy/tools/__init__.py --- a/lib/galaxy/tools/__init__.py +++ b/lib/galaxy/tools/__init__.py @@ -44,7 +44,6 @@ from galaxy.tools.actions.data_source import DataSourceToolAction from galaxy.tools.actions.data_manager import DataManagerToolAction from galaxy.tools.deps import build_dependency_manager -from galaxy.tools.deps.requirements import parse_requirements_from_xml from galaxy.tools.parameters import check_param, params_from_strings, params_to_strings from galaxy.tools.parameters import output_collect from galaxy.tools.parameters.basic import (BaseURLToolParameter, @@ -56,7 +55,9 @@ from galaxy.tools.parameters.output import ToolOutputActionGroup from galaxy.tools.parameters.validation import LateValidationError from galaxy.tools.filters import FilterFactory -from galaxy.tools.test import parse_tests_elem +from galaxy.tools.test import parse_tests +from galaxy.tools.parser import get_tool_source +from galaxy.tools.parser.xml import XmlPageSource from galaxy.util import listify, parse_xml, rst_to_html, string_as_bool, string_to_object, xml_text, xml_to_string from galaxy.tools.parameters.meta import expand_meta_parameters from galaxy.util.bunch import Bunch @@ -742,21 +743,23 @@ def load_tool( self, config_file, guid=None, repository_id=None, **kwds ): """Load a single tool from the file named by `config_file` and return an instance of `Tool`.""" # Parse XML configuration file and get the root element - tree = load_tool( config_file ) - root = tree.getroot() + tool_source = get_tool_source( config_file, getattr( self.app.config, "enable_beta_tool_formats", False ) ) # Allow specifying a different tool subclass to instantiate - if root.find( "type" ) is not None: - type_elem = root.find( "type" ) - module = type_elem.get( 'module', 'galaxy.tools' ) - cls = type_elem.get( 'class' ) + tool_module = tool_source.parse_tool_module() + if tool_module is not None: + module, cls = tool_module mod = __import__( module, globals(), locals(), [cls] ) ToolClass = getattr( mod, cls ) - elif root.get( 'tool_type', None ) is not None: - ToolClass = tool_types.get( root.get( 'tool_type' ) ) + elif tool_source.parse_tool_type(): + tool_type = tool_source.parse_tool_type() + ToolClass = tool_types.get( tool_type ) else: # Normal tool - only insert dynamic resource parameters for these # tools. - if hasattr( self.app, "job_config" ): # toolshed may not have job_config? + root = getattr( tool_source, "root", None ) + # TODO: mucking with the XML directly like this is terrible, + # modify inputs directly post load if possible. + if root and hasattr( self.app, "job_config" ): # toolshed may not have job_config? tool_id = root.get( 'id' ) if root else None parameters = self.app.job_config.get_tool_resource_parameters( tool_id ) if parameters: @@ -773,7 +776,7 @@ inputs.append( conditional_element ) ToolClass = Tool - tool = ToolClass( config_file, root, self.app, guid=guid, repository_id=repository_id, **kwds ) + tool = ToolClass( config_file, tool_source, self.app, guid=guid, repository_id=repository_id, **kwds ) tool_id = tool.id if not tool_id.startswith("__"): # do not monitor special tools written to tmp directory - no reason @@ -1238,7 +1241,7 @@ dict_collection_visible_keys = ( 'id', 'name', 'version', 'description' ) default_template = 'tool_form.mako' - def __init__( self, config_file, root, app, guid=None, repository_id=None ): + def __init__( self, config_file, tool_source, app, guid=None, repository_id=None ): """Load a tool from the config named by `config_file`""" # Determine the full path of the directory where the tool config is self.config_file = config_file @@ -1282,7 +1285,7 @@ #populate toolshed repository info, if available self.populate_tool_shed_info() # Parse XML element containing configuration - self.parse( root, guid=guid ) + self.parse( tool_source, guid=guid ) self.external_runJob_script = app.config.drmaa_external_runjob_script @property @@ -1388,47 +1391,55 @@ return section_id, section_name return None, None - def parse( self, root, guid=None ): + def parse( self, tool_source, guid=None ): """ Read tool configuration from the element `root` and fill in `self`. """ # Get the (user visible) name of the tool - self.name = root.get( "name" ) + self.name = tool_source.parse_name() if not self.name: raise Exception( "Missing tool 'name'" ) # Get the UNIQUE id for the tool - self.old_id = root.get( "id" ) + self.old_id = tool_source.parse_id() if guid is None: self.id = self.old_id else: self.id = guid if not self.id: raise Exception( "Missing tool 'id'" ) - self.version = root.get( "version" ) + self.version = tool_source.parse_version() if not self.version: # For backward compatibility, some tools may not have versions yet. self.version = "1.0.0" + # Support multi-byte tools - self.is_multi_byte = string_as_bool( root.get( "is_multi_byte", False ) ) + self.is_multi_byte = tool_source.parse_is_multi_byte() # Legacy feature, ignored by UI. self.force_history_refresh = False - self.display_interface = string_as_bool( root.get( 'display_interface', str( self.display_interface ) ) ) - self.require_login = string_as_bool( root.get( 'require_login', str( self.require_login ) ) ) - # Load input translator, used by datasource tools to change names/values of incoming parameters - self.input_translator = root.find( "request_param_translation" ) - if self.input_translator: - self.input_translator = ToolInputTranslator.from_element( self.input_translator ) + + self.display_interface = tool_source.parse_display_interface( default=self.display_interface ) + + self.require_login = tool_source.parse_require_login( self.require_login ) + + request_param_translation_elem = tool_source.parse_request_param_translation_elem() + if request_param_translation_elem is not None: + # Load input translator, used by datasource tools to change names/values of incoming parameters + self.input_translator = ToolInputTranslator.from_element( request_param_translation_elem ) + else: + self.input_translator = None + # Command line (template). Optional for tools that do not invoke a local program - command = root.find("command") - if command is not None and command.text is not None: - self.command = command.text.lstrip() # get rid of leading whitespace + command = tool_source.parse_command() + if command is not None: + self.command = command.lstrip() # get rid of leading whitespace # Must pre-pend this AFTER processing the cheetah command template - self.interpreter = command.get( "interpreter", None ) + self.interpreter = tool_source.parse_interpreter() else: self.command = '' self.interpreter = None + # Parameters used to build URL for redirection to external app - redirect_url_params = root.find( "redirect_url_params" ) + redirect_url_params = tool_source.parse_redirect_url_params_elem() if redirect_url_params is not None and redirect_url_params.text is not None: # get rid of leading / trailing white space redirect_url_params = redirect_url_params.text.strip() @@ -1437,25 +1448,26 @@ self.redirect_url_params = redirect_url_params.replace( ' ', '**^**' ) else: self.redirect_url_params = '' + # Short description of the tool - self.description = xml_text(root, "description") + self.description = tool_source.parse_description() + # Versioning for tools self.version_string_cmd = None - version_cmd = root.find("version_command") - if version_cmd is not None: - self.version_string_cmd = version_cmd.text.strip() - version_cmd_interpreter = version_cmd.get( "interpreter", None ) + version_command = tool_source.parse_version_command() + if version_command is not None: + self.version_string_cmd = version_command.strip() + + version_cmd_interpreter = tool_source.parse_version_command_interpreter() if version_cmd_interpreter: executable = self.version_string_cmd.split()[0] abs_executable = os.path.abspath(os.path.join(self.tool_dir, executable)) command_line = self.version_string_cmd.replace(executable, abs_executable, 1) self.version_string_cmd = version_cmd_interpreter + " " + command_line + # Parallelism for tasks, read from tool config. - parallelism = root.find("parallelism") - if parallelism is not None and parallelism.get("method"): - self.parallelism = ParallelismInfo(parallelism) - else: - self.parallelism = None + self.parallelism = tool_source.parse_parallelism() + # Get JobToolConfiguration(s) valid for this particular Tool. At least # a 'default' will be provided that uses the 'default' handler and # 'default' destination. I thought about moving this to the @@ -1468,15 +1480,65 @@ # In the toolshed context, there is no job config. if 'job_config' in dir(self.app): self.job_tool_configurations = self.app.job_config.get_job_tool_configurations(self_ids) + # Is this a 'hidden' tool (hidden in tool menu) - self.hidden = xml_text(root, "hidden") - if self.hidden: - self.hidden = string_as_bool(self.hidden) + self.hidden = tool_source.parse_hidden() + + self.__parse_legacy_features(tool_source) + + # Load any tool specific options (optional) + self.options = dict( sanitize=True, refresh=False ) + self.__update_options_dict( tool_source ) + self.options = Bunch(** self.options) + + # Parse tool inputs (if there are any required) + self.parse_inputs( tool_source ) + + # Parse tool help + self.parse_help( tool_source ) + + # Description of outputs produced by an invocation of the tool + self.parse_outputs( tool_source ) + + # Parse result handling for tool exit codes and stdout/stderr messages: + self.parse_stdio( tool_source ) + # Any extra generated config files for the tool + self.__parse_config_files(tool_source) + # Action + action = tool_source.parse_action_module() + if action is None: + self.tool_action = self.default_tool_action() + else: + module, cls = action + mod = __import__( module, globals(), locals(), [cls]) + self.tool_action = getattr( mod, cls )() + # Tests + self.__parse_tests(tool_source) + + # Requirements (dependencies) + requirements, containers = tool_source.parse_requirements_and_containers() + self.requirements = requirements + self.containers = containers + + self.citations = self._parse_citations( tool_source ) + + # Determine if this tool can be used in workflows + self.is_workflow_compatible = self.check_workflow_compatible(tool_source) + self.__parse_trackster_conf( tool_source ) + + def __parse_legacy_features(self, tool_source): + self.code_namespace = dict() + self.hook_map = {} + self.uihints = {} + + if not hasattr(tool_source, 'root'): + return + + # TODO: Move following logic into XmlToolSource. + root = tool_source.root # Load any tool specific code (optional) Edit: INS 5/29/2007, # allow code files to have access to the individual tool's # "module" if it has one. Allows us to reuse code files, etc. - self.code_namespace = dict() - self.hook_map = {} for code_elem in root.findall("code"): for hook_elem in code_elem.findall("hook"): for key, value in hook_elem.items(): @@ -1485,25 +1547,36 @@ file_name = code_elem.get("file") code_path = os.path.join( self.tool_dir, file_name ) execfile( code_path, self.code_namespace ) - # Load any tool specific options (optional) - self.options = dict( sanitize=True, refresh=False ) + + # User interface hints + uihints_elem = root.find( "uihints" ) + if uihints_elem is not None: + for key, value in uihints_elem.attrib.iteritems(): + self.uihints[ key ] = value + + def __update_options_dict(self, tool_source): + # TODO: Move following logic into ToolSource abstraction. + if not hasattr(tool_source, 'root'): + return + + root = tool_source.root for option_elem in root.findall("options"): for option, value in self.options.copy().items(): if isinstance(value, type(False)): self.options[option] = string_as_bool(option_elem.get(option, str(value))) else: self.options[option] = option_elem.get(option, str(value)) - self.options = Bunch(** self.options) - # Parse tool inputs (if there are any required) - self.parse_inputs( root ) - # Parse tool help - self.parse_help( root ) - # Description of outputs produced by an invocation of the tool - self.parse_outputs( root ) - # Parse result handling for tool exit codes and stdout/stderr messages: - self.parse_stdio( root ) - # Any extra generated config files for the tool + + def __parse_tests(self, tool_source): + self.__tests_source = tool_source + self.__tests_populated = False + + def __parse_config_files(self, tool_source): self.config_files = [] + if not hasattr(tool_source, 'root'): + return + + root = tool_source.root conf_parent_elem = root.find("configfiles") if conf_parent_elem: for conf_elem in conf_parent_elem.findall( "configfile" ): @@ -1511,87 +1584,65 @@ filename = conf_elem.get( "filename", None ) text = conf_elem.text self.config_files.append( ( name, filename, text ) ) - # Action - action_elem = root.find( "action" ) - if action_elem is None: - self.tool_action = self.default_tool_action() - else: - module = action_elem.get( 'module' ) - cls = action_elem.get( 'class' ) - mod = __import__( module, globals(), locals(), [cls]) - self.tool_action = getattr( mod, cls )() - # User interface hints - self.uihints = {} - uihints_elem = root.find( "uihints" ) - if uihints_elem is not None: - for key, value in uihints_elem.attrib.iteritems(): - self.uihints[ key ] = value - # Tests - self.__tests_elem = root.find( "tests" ) - self.__tests_populated = False - # Requirements (dependencies) - requirements, containers = parse_requirements_from_xml( root ) - self.requirements = requirements - self.containers = containers + def __parse_trackster_conf(self, tool_source): + self.trackster_conf = None + if not hasattr(tool_source, 'root'): + return - self.citations = self._parse_citations( root ) - - # Determine if this tool can be used in workflows - self.is_workflow_compatible = self.check_workflow_compatible(root) # Trackster configuration. - trackster_conf = root.find( "trackster_conf" ) + trackster_conf = tool_source.root.find( "trackster_conf" ) if trackster_conf is not None: self.trackster_conf = TracksterConfig.parse( trackster_conf ) - else: - self.trackster_conf = None @property def tests( self ): if not self.__tests_populated: - tests_elem = self.__tests_elem - if tests_elem: + tests_source = self.__tests_source + if tests_source: try: - self.__tests = parse_tests_elem( self, tests_elem ) + self.__tests = parse_tests( self, tests_source ) except: + self.__tests = None log.exception( "Failed to parse tool tests" ) else: self.__tests = None self.__tests_populated = True return self.__tests - def parse_inputs( self, root ): + def parse_inputs( self, tool_source ): """ Parse the "<inputs>" element and create appropriate `ToolParameter`s. This implementation supports multiple pages and grouping constructs. """ # Load parameters (optional) - input_elem = root.find("inputs") + pages = tool_source.parse_input_pages() enctypes = set() - if input_elem is not None: - # Handle properties of the input form - self.check_values = string_as_bool( input_elem.get("check_values", self.check_values ) ) - self.nginx_upload = string_as_bool( input_elem.get( "nginx_upload", self.nginx_upload ) ) - self.action = input_elem.get( 'action', self.action ) - # If we have an nginx upload, save the action as a tuple instead of - # a string. The actual action needs to get url_for run to add any - # prefixes, and we want to avoid adding the prefix to the - # nginx_upload_path. This logic is handled in the tool_form.mako - # template. - if self.nginx_upload and self.app.config.nginx_upload_path: - if '?' in urllib.unquote_plus( self.action ): - raise Exception( 'URL parameters in a non-default tool action can not be used ' - 'in conjunction with nginx upload. Please convert them to ' - 'hidden POST parameters' ) - self.action = (self.app.config.nginx_upload_path + '?nginx_redir=', - urllib.unquote_plus(self.action)) - self.target = input_elem.get( "target", self.target ) - self.method = input_elem.get( "method", self.method ) - # Parse the actual parameters - # Handle multiple page case - pages = input_elem.findall( "page" ) - for page in ( pages or [ input_elem ] ): - display, inputs = self.parse_input_page( page, enctypes ) + if pages.inputs_defined: + if hasattr(pages, "input_elem"): + input_elem = pages.input_elem + # Handle properties of the input form + self.check_values = string_as_bool( input_elem.get("check_values", self.check_values ) ) + self.nginx_upload = string_as_bool( input_elem.get( "nginx_upload", self.nginx_upload ) ) + self.action = input_elem.get( 'action', self.action ) + # If we have an nginx upload, save the action as a tuple instead of + # a string. The actual action needs to get url_for run to add any + # prefixes, and we want to avoid adding the prefix to the + # nginx_upload_path. This logic is handled in the tool_form.mako + # template. + if self.nginx_upload and self.app.config.nginx_upload_path: + if '?' in urllib.unquote_plus( self.action ): + raise Exception( 'URL parameters in a non-default tool action can not be used ' + 'in conjunction with nginx upload. Please convert them to ' + 'hidden POST parameters' ) + self.action = (self.app.config.nginx_upload_path + '?nginx_redir=', + urllib.unquote_plus(self.action)) + self.target = input_elem.get( "target", self.target ) + self.method = input_elem.get( "method", self.method ) + # Parse the actual parameters + # Handle multiple page case + for page_source in pages.page_sources: + display, inputs = self.parse_input_page( page_source, enctypes ) self.inputs_by_page.append( inputs ) self.inputs.update( inputs ) self.display_by_page.append( display ) @@ -1613,24 +1664,28 @@ # thus hardcoded) FIXME: hidden parameters aren't # parameters at all really, and should be passed in a different # way, making this check easier. - self.template_macro_params = template_macro_params(root) + template_macros = {} + if hasattr(tool_source, 'root'): + template_macros = template_macro_params(tool_source.root) + self.template_macro_params = template_macros for param in self.inputs.values(): if not isinstance( param, ( HiddenToolParameter, BaseURLToolParameter ) ): self.input_required = True break - def parse_help( self, root ): + def parse_help( self, tool_source ): """ Parse the help text for the tool. Formatted in reStructuredText, but stored as Mako to allow for dynamic image paths. This implementation supports multiple pages. """ # TODO: Allow raw HTML or an external link. - self.help = root.find("help") + self.help = None self.help_by_page = list() help_header = "" help_footer = "" - if self.help is not None: + if hasattr( tool_source, 'root' ) and tool_source.root.find( 'help' ) is not None: + self.help = tool_source.root.find( 'help' ) if self.repository_id and self.help.text.find( '.. image:: ' ) >= 0: # Handle tool help image display for tools that are contained in repositories in the tool shed or installed into Galaxy. lock = threading.Lock() @@ -1667,203 +1722,32 @@ while len( self.help_by_page ) < self.npages: self.help_by_page.append( self.help ) - def parse_outputs( self, root ): + def parse_outputs( self, tool_source ): """ Parse <outputs> elements and fill in self.outputs (keyed by name) """ self.outputs = odict() - out_elem = root.find("outputs") - if not out_elem: - return - for data_elem in out_elem.findall("data"): - output = ToolOutput( data_elem.get("name") ) - output.format = data_elem.get("format", "data") - output.change_format = data_elem.findall("change_format") - output.format_source = data_elem.get("format_source", None) - output.metadata_source = data_elem.get("metadata_source", "") - output.parent = data_elem.get("parent", None) - output.label = xml_text( data_elem, "label" ) - output.count = int( data_elem.get("count", 1) ) - output.filters = data_elem.findall( 'filter' ) - output.from_work_dir = data_elem.get("from_work_dir", None) - output.hidden = string_as_bool( data_elem.get("hidden", "") ) - output.tool = self - output.actions = ToolOutputActionGroup( output, data_elem.find( 'actions' ) ) - output.dataset_collectors = output_collect.dataset_collectors_from_elem( data_elem ) + for output in tool_source.parse_outputs(self): self.outputs[ output.name ] = output # TODO: Include the tool's name in any parsing warnings. - def parse_stdio( self, root ): + def parse_stdio( self, tool_source ): """ Parse <stdio> element(s) and fill in self.return_codes, self.stderr_rules, and self.stdout_rules. Return codes have a range and an error type (fault or warning). Stderr and stdout rules have a regular expression and an error level (fault or warning). """ - try: - self.stdio_exit_codes = list() - self.stdio_regexes = list() + exit_codes, regexes = tool_source.parse_stdio() + self.stdio_exit_codes = exit_codes + self.stdio_regexes = regexes - # We should have a single <stdio> element, but handle the case for - # multiples. - # For every stdio element, add all of the exit_code and regex - # subelements that we find: - for stdio_elem in ( root.findall( 'stdio' ) ): - self.parse_stdio_exit_codes( stdio_elem ) - self.parse_stdio_regexes( stdio_elem ) - except Exception: - log.error( "Exception in parse_stdio! " + str(sys.exc_info()) ) + def _parse_citations( self, tool_source ): + # TODO: Move following logic into ToolSource abstraction. + if not hasattr(tool_source, 'root'): + return [] - def parse_stdio_exit_codes( self, stdio_elem ): - """ - Parse the tool's <stdio> element's <exit_code> subelements. - This will add all of those elements, if any, to self.stdio_exit_codes. - """ - try: - # Look for all <exit_code> elements. Each exit_code element must - # have a range/value. - # Exit-code ranges have precedence over a single exit code. - # So if there are value and range attributes, we use the range - # attribute. If there is neither a range nor a value, then print - # a warning and skip to the next. - for exit_code_elem in ( stdio_elem.findall( "exit_code" ) ): - exit_code = ToolStdioExitCode() - # Each exit code has an optional description that can be - # part of the "desc" or "description" attributes: - exit_code.desc = exit_code_elem.get( "desc" ) - if None == exit_code.desc: - exit_code.desc = exit_code_elem.get( "description" ) - # Parse the error level: - exit_code.error_level = ( - self.parse_error_level( exit_code_elem.get( "level" ))) - code_range = exit_code_elem.get( "range", "" ) - if None == code_range: - code_range = exit_code_elem.get( "value", "" ) - if None == code_range: - log.warning( "Tool stdio exit codes must have " - + "a range or value" ) - continue - # Parse the range. We look for: - # :Y - # X: - # X:Y - Split on the colon. We do not allow a colon - # without a beginning or end, though we could. - # Also note that whitespace is eliminated. - # TODO: Turn this into a single match - it should be - # more efficient. - code_range = re.sub( "\s", "", code_range ) - code_ranges = re.split( ":", code_range ) - if ( len( code_ranges ) == 2 ): - if ( None == code_ranges[0] or '' == code_ranges[0] ): - exit_code.range_start = float( "-inf" ) - else: - exit_code.range_start = int( code_ranges[0] ) - if ( None == code_ranges[1] or '' == code_ranges[1] ): - exit_code.range_end = float( "inf" ) - else: - exit_code.range_end = int( code_ranges[1] ) - # If we got more than one colon, then ignore the exit code. - elif ( len( code_ranges ) > 2 ): - log.warning( "Invalid tool exit_code range %s - ignored" - % code_range ) - continue - # Else we have a singular value. If it's not an integer, then - # we'll just write a log message and skip this exit_code. - else: - try: - exit_code.range_start = int( code_range ) - except: - log.error( code_range ) - log.warning( "Invalid range start for tool's exit_code %s: exit_code ignored" % code_range ) - continue - exit_code.range_end = exit_code.range_start - # TODO: Check if we got ">", ">=", "<", or "<=": - # Check that the range, regardless of how we got it, - # isn't bogus. If we have two infinite values, then - # the start must be -inf and the end must be +inf. - # So at least warn about this situation: - if ( isinf( exit_code.range_start ) and - isinf( exit_code.range_end ) ): - log.warning( "Tool exit_code range %s will match on " - + "all exit codes" % code_range ) - self.stdio_exit_codes.append( exit_code ) - except Exception: - log.error( "Exception in parse_stdio_exit_codes! " - + str(sys.exc_info()) ) - trace = sys.exc_info()[2] - if ( None != trace ): - trace_msg = repr( traceback.format_tb( trace ) ) - log.error( "Traceback: %s" % trace_msg ) - - def parse_stdio_regexes( self, stdio_elem ): - """ - Look in the tool's <stdio> elem for all <regex> subelements - that define how to look for warnings and fatal errors in - stdout and stderr. This will add all such regex elements - to the Tols's stdio_regexes list. - """ - try: - # Look for every <regex> subelement. The regular expression - # will have "match" and "source" (or "src") attributes. - for regex_elem in ( stdio_elem.findall( "regex" ) ): - # TODO: Fill in ToolStdioRegex - regex = ToolStdioRegex() - # Each regex has an optional description that can be - # part of the "desc" or "description" attributes: - regex.desc = regex_elem.get( "desc" ) - if None == regex.desc: - regex.desc = regex_elem.get( "description" ) - # Parse the error level - regex.error_level = ( - self.parse_error_level( regex_elem.get( "level" ) ) ) - regex.match = regex_elem.get( "match", "" ) - if None == regex.match: - # TODO: Convert the offending XML element to a string - log.warning( "Ignoring tool's stdio regex element %s - " - "the 'match' attribute must exist" ) - continue - # Parse the output sources. We look for the "src", "source", - # and "sources" attributes, in that order. If there is no - # such source, then the source defaults to stderr & stdout. - # Look for a comma and then look for "err", "error", "out", - # and "output": - output_srcs = regex_elem.get( "src" ) - if None == output_srcs: - output_srcs = regex_elem.get( "source" ) - if None == output_srcs: - output_srcs = regex_elem.get( "sources" ) - if None == output_srcs: - output_srcs = "output,error" - output_srcs = re.sub( "\s", "", output_srcs ) - src_list = re.split( ",", output_srcs ) - # Just put together anything to do with "out", including - # "stdout", "output", etc. Repeat for "stderr", "error", - # and anything to do with "err". If neither stdout nor - # stderr were specified, then raise a warning and scan both. - for src in src_list: - if re.search( "both", src, re.IGNORECASE ): - regex.stdout_match = True - regex.stderr_match = True - if re.search( "out", src, re.IGNORECASE ): - regex.stdout_match = True - if re.search( "err", src, re.IGNORECASE ): - regex.stderr_match = True - if (not regex.stdout_match and not regex.stderr_match): - log.warning( "Tool id %s: unable to determine if tool " - "stream source scanning is output, error, " - "or both. Defaulting to use both." % self.id ) - regex.stdout_match = True - regex.stderr_match = True - self.stdio_regexes.append( regex ) - except Exception: - log.error( "Exception in parse_stdio_exit_codes! " - + str(sys.exc_info()) ) - trace = sys.exc_info()[2] - if ( None != trace ): - trace_msg = repr( traceback.format_tb( trace ) ) - log.error( "Traceback: %s" % trace_msg ) - - def _parse_citations( self, root ): + root = tool_source.root citations = [] citations_elem = root.find("citations") if not citations_elem: @@ -1877,49 +1761,18 @@ citations.append( citation ) return citations - # TODO: This method doesn't have to be part of the Tool class. - def parse_error_level( self, err_level ): - """ - Parses error level and returns error level enumeration. If - unparsable, returns 'fatal' - """ - return_level = StdioErrorLevel.FATAL - try: - if err_level: - if ( re.search( "log", err_level, re.IGNORECASE ) ): - return_level = StdioErrorLevel.LOG - elif ( re.search( "warning", err_level, re.IGNORECASE ) ): - return_level = StdioErrorLevel.WARNING - elif ( re.search( "fatal", err_level, re.IGNORECASE ) ): - return_level = StdioErrorLevel.FATAL - else: - log.debug( "Tool %s: error level %s did not match log/warning/fatal" % - ( self.id, err_level ) ) - except Exception: - log.error( "Exception in parse_error_level " - + str(sys.exc_info() ) ) - trace = sys.exc_info()[2] - if ( None != trace ): - trace_msg = repr( traceback.format_tb( trace ) ) - log.error( "Traceback: %s" % trace_msg ) - return return_level - - def parse_input_page( self, input_elem, enctypes ): + def parse_input_page( self, page_source, enctypes ): """ Parse a page of inputs. This basically just calls 'parse_input_elem', but it also deals with possible 'display' elements which are supported only at the top/page level (not in groups). """ - inputs = self.parse_input_elem( input_elem, enctypes ) + inputs = self.parse_input_elem( page_source, enctypes ) # Display - display_elem = input_elem.find("display") - if display_elem is not None: - display = xml_to_string(display_elem) - else: - display = None + display = page_source.parse_display() return display, inputs - def parse_input_elem( self, parent_elem, enctypes, context=None ): + def parse_input_elem( self, page_source, enctypes, context=None ): """ Parse a parent element whose children are inputs -- these could be groups (repeat, conditional) or param elements. Groups will be parsed @@ -1927,29 +1780,31 @@ """ rval = odict() context = ExpressionContext( rval, context ) - for elem in parent_elem: + for input_source in page_source.parse_input_sources(): # Repeat group - if elem.tag == "repeat": + input_type = input_source.parse_input_type() + if input_type == "repeat": group = Repeat() - group.name = elem.get( "name" ) - group.title = elem.get( "title" ) - group.help = elem.get( "help", None ) - group.inputs = self.parse_input_elem( elem, enctypes, context ) - group.default = int( elem.get( "default", 0 ) ) - group.min = int( elem.get( "min", 0 ) ) + group.name = input_source.get( "name" ) + group.title = input_source.get( "title" ) + group.help = input_source.get( "help", None ) + page_source = input_source.parse_nested_inputs_source() + group.inputs = self.parse_input_elem( page_source, enctypes, context ) + group.default = int( input_source.get( "default", 0 ) ) + group.min = int( input_source.get( "min", 0 ) ) # Use float instead of int so that 'inf' can be used for no max - group.max = float( elem.get( "max", "inf" ) ) + group.max = float( input_source.get( "max", "inf" ) ) assert group.min <= group.max, \ ValueError( "Min repeat count must be less-than-or-equal to the max." ) # Force default to be within min-max range group.default = min( max( group.default, group.min ), group.max ) rval[group.name] = group - elif elem.tag == "conditional": + elif input_type == "conditional": group = Conditional() - group.name = elem.get( "name" ) - group.value_ref = elem.get( 'value_ref', None ) - group.value_ref_in_group = string_as_bool( elem.get( 'value_ref_in_group', 'True' ) ) - value_from = elem.get( "value_from" ) + group.name = input_source.get( "name" ) + group.value_ref = input_source.get( 'value_ref', None ) + group.value_ref_in_group = input_source.get_bool( 'value_ref_in_group', True ) + value_from = input_source.get("value_from", None) if value_from: value_from = value_from.split( ':' ) group.value_from = locals().get( value_from[0] ) @@ -1961,24 +1816,23 @@ case = ConditionalWhen() case.value = case_value if case_inputs: - case.inputs = self.parse_input_elem( - ElementTree.XML( "<when>%s</when>" % case_inputs ), enctypes, context ) + page_source = XmlPageSource( ElementTree.XML( "<when>%s</when>" % case_inputs ) ) + case.inputs = self.parse_input_elem( page_source, enctypes, context ) else: case.inputs = odict() group.cases.append( case ) else: # Should have one child "input" which determines the case - input_elem = elem.find( "param" ) - assert input_elem is not None, "<conditional> must have a child <param>" - group.test_param = self.parse_param_elem( input_elem, enctypes, context ) + test_param_input_source = input_source.parse_test_input_source() + group.test_param = self.parse_param_elem( test_param_input_source, enctypes, context ) possible_cases = list( group.test_param.legal_values ) # store possible cases, undefined whens will have no inputs # Must refresh when test_param changes group.test_param.refresh_on_change = True # And a set of possible cases - for case_elem in elem.findall( "when" ): + for (value, case_inputs_source) in input_source.parse_when_input_sources(): case = ConditionalWhen() - case.value = case_elem.get( "value" ) - case.inputs = self.parse_input_elem( case_elem, enctypes, context ) + case.value = value + case.inputs = self.parse_input_elem( case_inputs_source, enctypes, context ) group.cases.append( case ) try: possible_cases.remove( case.value ) @@ -1993,7 +1847,8 @@ case.inputs = odict() group.cases.append( case ) rval[group.name] = group - elif elem.tag == "upload_dataset": + elif input_type == "upload_dataset": + elem = input_source.elem() group = UploadDataset() group.name = elem.get( "name" ) group.title = elem.get( "title" ) @@ -2003,23 +1858,24 @@ rval[ group.file_type_name ].refresh_on_change = True rval[ group.file_type_name ].refresh_on_change_values = \ self.app.datatypes_registry.get_composite_extensions() - group.inputs = self.parse_input_elem( elem, enctypes, context ) + group_page_source = XmlPageSource(elem) + group.inputs = self.parse_input_elem( group_page_source, enctypes, context ) rval[ group.name ] = group - elif elem.tag == "param": - param = self.parse_param_elem( elem, enctypes, context ) + elif input_type == "param": + param = self.parse_param_elem( input_source, enctypes, context ) rval[param.name] = param if hasattr( param, 'data_ref' ): param.ref_input = context[ param.data_ref ] self.input_params.append( param ) return rval - def parse_param_elem( self, input_elem, enctypes, context ): + def parse_param_elem( self, input_source, enctypes, context ): """ Parse a single "<param>" element and return a ToolParameter instance. Also, if the parameter has a 'required_enctype' add it to the set enctypes. """ - param = ToolParameter.build( self, input_elem ) + param = ToolParameter.build( self, input_source ) param_enctype = param.get_required_enctype() if param_enctype: enctypes.add( param_enctype ) @@ -2039,7 +1895,7 @@ self.repository_owner = tool_shed_repository.owner self.installed_changeset_revision = tool_shed_repository.installed_changeset_revision - def check_workflow_compatible( self, root ): + def check_workflow_compatible( self, tool_source ): """ Determine if a tool can be used in workflows. External tools and the upload tool are currently not supported by workflows. @@ -2052,8 +1908,11 @@ # right now if self.tool_type.startswith( 'data_source' ): return False - if not string_as_bool( root.get( "workflow_compatible", "True" ) ): - return False + + if hasattr( tool_source, "root"): + root = tool_source.root + if not string_as_bool( root.get( "workflow_compatible", "True" ) ): + return False # TODO: Anyway to capture tools that dynamically change their own # outputs? return True @@ -3263,8 +3122,8 @@ def _build_GALAXY_URL_parameter( self ): return ToolParameter.build( self, ElementTree.XML( '<param name="GALAXY_URL" type="baseurl" value="/tool_runner?tool_id=%s" />' % self.id ) ) - def parse_inputs( self, root ): - super( DataSourceTool, self ).parse_inputs( root ) + def parse_inputs( self, tool_source ): + super( DataSourceTool, self ).parse_inputs( tool_source ) if 'GALAXY_URL' not in self.inputs: self.inputs[ 'GALAXY_URL' ] = self._build_GALAXY_URL_parameter() self.inputs_by_page[0][ 'GALAXY_URL' ] = self.inputs[ 'GALAXY_URL' ] @@ -3503,6 +3362,33 @@ self.desc = "" +class TestCollectionDef( object ): + + def __init__( self, elem, parse_param_elem ): + self.elements = [] + attrib = dict( elem.attrib ) + self.collection_type = attrib[ "type" ] + self.name = attrib.get( "name", "Unnamed Collection" ) + for element in elem.findall( "element" ): + element_attrib = dict( element.attrib ) + element_identifier = element_attrib[ "name" ] + nested_collection_elem = element.find( "collection" ) + if nested_collection_elem: + self.elements.append( ( element_identifier, TestCollectionDef( nested_collection_elem, parse_param_elem ) ) ) + else: + self.elements.append( ( element_identifier, parse_param_elem( element ) ) ) + + def collect_inputs( self ): + inputs = [] + for element in self.elements: + value = element[ 1 ] + if isinstance( value, TestCollectionDef ): + inputs.extend( value.collect_inputs() ) + else: + inputs.append( value ) + return inputs + + def json_fix( val ): if isinstance( val, list ): return [ json_fix( v ) for v in val ] diff -r b9c5b028e389678c1a073f11c9aba5104ae17e89 -r 2dc383cbb700f9d8d6a30eb976b70e8dcf1832db lib/galaxy/tools/deps/requirements.py --- a/lib/galaxy/tools/deps/requirements.py +++ b/lib/galaxy/tools/deps/requirements.py @@ -45,6 +45,12 @@ return ContainerDescription( identifier=identifier, type=type ) +def parse_requirements_from_dict( root_dict ): + requirements = root_dict.get("requirements", []) + containers = root_dict.get("containers", []) + return map(ToolRequirement.from_dict, requirements), map(ContainerDescription.from_dict, containers) + + def parse_requirements_from_xml( xml_root ): """ diff -r b9c5b028e389678c1a073f11c9aba5104ae17e89 -r 2dc383cbb700f9d8d6a30eb976b70e8dcf1832db lib/galaxy/tools/imp_exp/__init__.py --- a/lib/galaxy/tools/imp_exp/__init__.py +++ b/lib/galaxy/tools/imp_exp/__init__.py @@ -13,12 +13,7 @@ log = logging.getLogger(__name__) - -def load_history_imp_exp_tools( toolbox ): - """ Adds tools for importing/exporting histories to archives. """ - # Use same process as that used in load_external_metadata_tool; see that - # method for why create tool description files on the fly. - tool_xml_text = """ +EXPORT_HISTORY_TEXT = """ <tool id="__EXPORT_HISTORY__" name="Export History" version="0.1" tool_type="export_history"><type class="ExportHistoryTool" module="galaxy.tools"/><action module="galaxy.tools.actions.history_imp_exp" class="ExportHistoryToolAction"/> @@ -32,7 +27,14 @@ <data format="gzip" name="output_file"/></outputs></tool> - """ +""" + + +def load_history_imp_exp_tools( toolbox ): + """ Adds tools for importing/exporting histories to archives. """ + # Use same process as that used in load_external_metadata_tool; see that + # method for why create tool description files on the fly. + tool_xml_text = EXPORT_HISTORY_TEXT # Load export tool. tmp_name = tempfile.NamedTemporaryFile() diff -r b9c5b028e389678c1a073f11c9aba5104ae17e89 -r 2dc383cbb700f9d8d6a30eb976b70e8dcf1832db lib/galaxy/tools/parameters/basic.py --- a/lib/galaxy/tools/parameters/basic.py +++ b/lib/galaxy/tools/parameters/basic.py @@ -18,6 +18,8 @@ from sanitize import ToolParameterSanitizer import validation import dynamic_options +import galaxy.tools.parser +from ..parser import get_input_source as ensure_input_source from ..parameters import history_query from .dataset_matcher import DatasetMatcher from .dataset_matcher import DatasetCollectionMatcher @@ -37,24 +39,34 @@ """ dict_collection_visible_keys = ( 'name', 'type', 'label', 'help' ) - def __init__( self, tool, param, context=None ): + def __init__( self, tool, input_source, context=None ): + input_source = ensure_input_source(input_source) self.tool = tool self.refresh_on_change = False self.refresh_on_change_values = [] - self.name = param.get("name") - self.type = param.get("type") - self.label = util.xml_text(param, "label") - self.help = util.xml_text(param, "help") - self.sanitizer = param.find( "sanitizer" ) - if self.sanitizer is not None: - self.sanitizer = ToolParameterSanitizer.from_element( self.sanitizer ) + self.name = input_source.get("name") + self.type = input_source.get("type") + self.label = input_source.parse_label() + self.help = input_source.parse_help() + sanitizer_elem = input_source.parse_sanitizer_elem() + if sanitizer_elem: + self.sanitizer = ToolParameterSanitizer.from_element( sanitizer_elem ) + else: + self.sanitizer = None self.html = "no html set" - self.repeat = param.get("repeat", None) - self.condition = param.get( "condition", None ) + try: + # These don't do anything right? These we should + # delete these two lines and eliminate checks for + # self.repeat in this file. -John + self.repeat = input_source.elem().get("repeat", None) + self.condition = input_source.elem().get( "condition", None ) + except Exception: + self.repeat = None + # Optional DataToolParameters are used in tools like GMAJ and LAJ - self.optional = string_as_bool( param.get( 'optional', False ) ) + self.optional = input_source.parse_optional() self.validators = [] - for elem in param.findall("validator"): + for elem in input_source.parse_validator_elems(): self.validators.append( validation.Validator.from_element( self, elem ) ) @property @@ -232,11 +244,12 @@ >>> print p.get_html( value="meh" ) <input type="text" name="blah" size="4" value="meh"> """ - def __init__( self, tool, elem ): - ToolParameter.__init__( self, tool, elem ) - self.size = elem.get( 'size' ) - self.value = elem.get( 'value' ) - self.area = string_as_bool( elem.get( 'area', False ) ) + def __init__( self, tool, input_source ): + input_source = ensure_input_source(input_source) + ToolParameter.__init__( self, tool, input_source ) + self.size = input_source.get( 'size' ) + self.value = input_source.get( 'value' ) + self.area = input_source.get_bool( 'area', False ) def get_html_field( self, trans=None, value=None, other_values={} ): if value is None: @@ -274,8 +287,9 @@ dict_collection_visible_keys = ToolParameter.dict_collection_visible_keys + ( 'min', 'max' ) - def __init__( self, tool, elem ): - TextToolParameter.__init__( self, tool, elem ) + def __init__( self, tool, input_source ): + input_source = ensure_input_source(input_source) + TextToolParameter.__init__( self, tool, input_source ) if self.value: try: int( self.value ) @@ -283,8 +297,8 @@ raise ValueError( "An integer is required" ) elif self.value is None and not self.optional: raise ValueError( "The settings for the field named '%s' require a 'value' setting and optionally a default value which must be an integer" % self.name ) - self.min = elem.get( 'min' ) - self.max = elem.get( 'max' ) + self.min = input_source.get( 'min' ) + self.max = input_source.get( 'max' ) if self.min: try: self.min = int( self.min ) @@ -352,10 +366,11 @@ dict_collection_visible_keys = ToolParameter.dict_collection_visible_keys + ( 'min', 'max' ) - def __init__( self, tool, elem ): - TextToolParameter.__init__( self, tool, elem ) - self.min = elem.get( 'min' ) - self.max = elem.get( 'max' ) + def __init__( self, tool, input_source ): + input_source = ensure_input_source(input_source) + TextToolParameter.__init__( self, tool, input_source ) + self.min = input_source.get( 'min' ) + self.max = input_source.get( 'max' ) if self.value: try: float( self.value ) @@ -429,11 +444,12 @@ >>> print p.to_param_dict_string( False ) cellophane chests """ - def __init__( self, tool, elem ): - ToolParameter.__init__( self, tool, elem ) - self.truevalue = elem.get( 'truevalue', 'true' ) - self.falsevalue = elem.get( 'falsevalue', 'false' ) - self.checked = string_as_bool( elem.get( 'checked' ) ) + def __init__( self, tool, input_source ): + input_source = ensure_input_source(input_source) + ToolParameter.__init__( self, tool, input_source ) + self.truevalue = input_source.get( 'truevalue', 'true' ) + self.falsevalue = input_source.get( 'falsevalue', 'false' ) + self.checked = input_source.get_bool( 'checked', False ) def get_html_field( self, trans=None, value=None, other_values={} ): checked = self.checked @@ -490,12 +506,13 @@ >>> print p.get_html() <input type="file" name="blah" galaxy-ajax-upload="true"> """ - def __init__( self, tool, elem ): + def __init__( self, tool, input_source ): """ Example: C{<param name="bins" type="file" />} """ - ToolParameter.__init__( self, tool, elem ) - self.ajax = string_as_bool( elem.get( 'ajax-upload' ) ) + input_source = ensure_input_source(input_source) + ToolParameter.__init__( self, tool, input_source ) + self.ajax = input_source.get_bool( 'ajax-upload', False ) def get_html_field( self, trans=None, value=None, other_values={} ): return form_builder.FileField( self.name, ajax=self.ajax, value=value ) @@ -553,11 +570,12 @@ """ Parameter that takes a file uploaded via FTP as a value. """ - def __init__( self, tool, elem ): + def __init__( self, tool, input_source ): """ Example: C{<param name="bins" type="file" />} """ - ToolParameter.__init__( self, tool, elem ) + input_source = ensure_input_source(input_source) + ToolParameter.__init__( self, tool, input_source ) @property def visible( self ): @@ -608,9 +626,10 @@ >>> print p.get_html() <input type="hidden" name="blah" value="wax so rockin"> """ - def __init__( self, tool, elem ): - ToolParameter.__init__( self, tool, elem ) - self.value = elem.get( 'value' ) + def __init__( self, tool, input_source ): + input_source = ensure_input_source( input_source ) + ToolParameter.__init__( self, tool, input_source ) + self.value = input_source.get( 'value' ) def get_html_field( self, trans=None, value=None, other_values={} ): return form_builder.HiddenField( self.name, self.value ) @@ -632,9 +651,10 @@ current server base url. Used in all redirects. """ - def __init__( self, tool, elem ): - ToolParameter.__init__( self, tool, elem ) - self.value = elem.get( 'value', '' ) + def __init__( self, tool, input_source ): + input_source = ensure_input_source( input_source ) + ToolParameter.__init__( self, tool, input_source ) + self.value = input_source.get( 'value', '' ) def get_value( self, trans ): # url = trans.request.base + self.value @@ -737,30 +757,25 @@ >>> print p.to_param_dict_string( ["y", "z"] ) y,z """ - def __init__( self, tool, elem, context=None ): - ToolParameter.__init__( self, tool, elem ) - self.multiple = string_as_bool( elem.get( 'multiple', False ) ) + def __init__( self, tool, input_source, context=None ): + input_source = ensure_input_source( input_source ) + ToolParameter.__init__( self, tool, input_source ) + self.multiple = input_source.get_bool( 'multiple', False ) # Multiple selects are optional by default, single selection is the inverse. - self.optional = string_as_bool( elem.get( 'optional', self.multiple ) ) - self.display = elem.get( 'display', None ) - self.separator = elem.get( 'separator', ',' ) + self.optional = input_source.parse_optional( self.multiple ) + self.display = input_source.get( 'display', None ) + self.separator = input_source.get( 'separator', ',' ) self.legal_values = set() # TODO: the <dynamic_options> tag is deprecated and should be replaced with the <options> tag. - self.dynamic_options = elem.get( "dynamic_options", None ) - options = elem.find( 'options' ) - if options is None: - self.options = None - else: - self.options = dynamic_options.DynamicOptions( options, self ) + self.dynamic_options = input_source.get( "dynamic_options", None ) + self.options = input_source.parse_dynamic_options(self) + if self.options is not None: for validator in self.options.validators: self.validators.append( validator ) if self.dynamic_options is None and self.options is None: - self.static_options = list() - for index, option in enumerate( elem.findall( "option" ) ): - value = option.get( "value" ) + self.static_options = input_source.parse_static_options() + for (title, value, selected) in self.static_options: self.legal_values.add( value ) - selected = string_as_bool( option.get( "selected", False ) ) - self.static_options.append( ( option.text or value, value, selected ) ) self.is_dynamic = ( ( self.dynamic_options is not None ) or ( self.options is not None ) ) def get_options( self, trans, other_values ): @@ -1133,29 +1148,24 @@ >>> print clp.name numerical_column """ - def __init__( self, tool, elem ): - SelectToolParameter.__init__( self, tool, elem ) + def __init__( self, tool, input_source ): + input_source = ensure_input_source( input_source ) + SelectToolParameter.__init__( self, tool, input_source ) self.tool = tool - self.numerical = string_as_bool( elem.get( "numerical", False )) - # Allow specifing force_select for backward compat., but probably - # should use optional going forward for consistency with other - # parameters. - if "force_select" in elem.attrib: - self.force_select = string_as_bool( elem.get( "force_select" ) ) - else: - self.force_select = not string_as_bool( elem.get( "optional", False ) ) - self.accept_default = string_as_bool( elem.get( "accept_default", False )) - self.data_ref = elem.get( "data_ref", None ) + self.numerical = input_source.get_bool( "numerical", False ) + self.force_select = not input_source.parse_optional( False ) + self.accept_default = input_source.get_bool( "accept_default", False ) + self.data_ref = input_source.get( "data_ref", None ) self.ref_input = None # Legacy style default value specification... - self.default_value = elem.get( "default_value", None ) + self.default_value = input_source.get( "default_value", None ) if self.default_value is None: # Newer style... more in line with other parameters. - self.default_value = elem.get( "value", None ) + self.default_value = input_source.get( "value", None ) if self.default_value is not None: self.default_value = ColumnListParameter._strip_c( self.default_value ) self.is_dynamic = True - self.usecolnames = string_as_bool( elem.get( "use_header_names", False )) + self.usecolnames = input_source.get_bool( "use_header_names", False ) def from_html( self, value, trans=None, context={} ): """ @@ -1413,13 +1423,18 @@ >>> print p.options [{'selected': False, 'name': 'Heading 1', 'value': 'heading1', 'options': [{'selected': False, 'name': 'Option 1', 'value': 'option1', 'options': []}, {'selected': False, 'name': 'Option 2', 'value': 'option2', 'options': []}, {'selected': False, 'name': 'Heading 1', 'value': 'heading1', 'options': [{'selected': False, 'name': 'Option 3', 'value': 'option3', 'options': []}, {'selected': False, 'name': 'Option 4', 'value': 'option4', 'options': []}]}]}, {'selected': False, 'name': 'Option 5', 'value': 'option5', 'options': []}] """ - def __init__( self, tool, elem, context=None ): + def __init__( self, tool, input_source, context=None ): + input_source = ensure_input_source( input_source ) + def recurse_option_elems( cur_options, option_elems ): for option_elem in option_elems: selected = string_as_bool( option_elem.get( 'selected', False ) ) cur_options.append( { 'name': option_elem.get( 'name' ), 'value': option_elem.get( 'value' ), 'options': [], 'selected': selected } ) recurse_option_elems( cur_options[-1]['options'], option_elem.findall( 'option' ) ) - ToolParameter.__init__( self, tool, elem ) + ToolParameter.__init__( self, tool, input_source ) + # TODO: abstract XML out of here - so non-XML InputSources can + # specify DrillDown parameters. + elem = input_source.elem() self.multiple = string_as_bool( elem.get( 'multiple', False ) ) self.display = elem.get( 'display', None ) self.hierarchy = elem.get( 'hierarchy', 'exact' ) # exact or recurse @@ -1653,8 +1668,8 @@ class BaseDataToolParameter( ToolParameter ): - def __init__( self, tool, elem, trans ): - super(BaseDataToolParameter, self).__init__( tool, elem ) + def __init__( self, tool, input_source, trans ): + super(BaseDataToolParameter, self).__init__( tool, input_source ) def _get_history( self, trans, history=None ): class_name = self.__class__.__name__ @@ -1693,32 +1708,27 @@ datatypes_registry = tool.app.datatypes_registry return datatypes_registry - def _parse_formats( self, trans, tool, elem ): + def _parse_formats( self, trans, tool, input_source ): datatypes_registry = self._datatypes_registery( trans, tool ) # Build tuple of classes for supported data formats formats = [] - self.extensions = elem.get( 'format', 'data' ).split( "," ) + self.extensions = input_source.get( 'format', 'data' ).split( "," ) normalized_extensions = [extension.strip().lower() for extension in self.extensions] for extension in normalized_extensions: formats.append( datatypes_registry.get_datatype_by_extension( extension ) ) self.formats = formats - def _parse_options( self, elem ): + def _parse_options( self, input_source ): # TODO: Enhance dynamic options for DataToolParameters. Currently, # only the special case key='build' of type='data_meta' is # a valid filter - options = elem.find( 'options' ) - if options is None: - self.options = None - self.options_filter_attribute = None - else: - self.options = dynamic_options.DynamicOptions( options, self ) - - #HACK to get around current hardcoded limitation of when a set of dynamic options is defined for a DataToolParameter - #it always causes available datasets to be filtered by dbkey - #this behavior needs to be entirely reworked (in a backwards compatible manner) - self.options_filter_attribute = options.get( 'options_filter_attribute', None ) + self.options_filter_attribute = None + self.options = input_source.parse_dynamic_options( self ) + if self.options: + # TODO: Abstract away XML handling here. + options_elem = input_source.elem().find('options') + self.options_filter_attribute = options_elem.get( 'options_filter_attribute', None ) self.is_dynamic = self.options is not None def _switch_fields( self, fields, default_field ): @@ -1743,21 +1753,19 @@ security stuff will dramatically alter this anyway. """ - def __init__( self, tool, elem, trans=None): - super(DataToolParameter, self).__init__( tool, elem, trans ) + def __init__( self, tool, input_source, trans=None): + input_source = ensure_input_source( input_source ) + super(DataToolParameter, self).__init__( tool, input_source, trans ) # Add metadata validator - if not string_as_bool( elem.get( 'no_validation', False ) ): + if not input_source.get_bool( 'no_validation', False ): self.validators.append( validation.MetadataValidator() ) - self._parse_formats( trans, tool, elem ) - self.multiple = string_as_bool( elem.get( 'multiple', False ) ) - self._parse_options( elem ) + self._parse_formats( trans, tool, input_source ) + self.multiple = input_source.get_bool('multiple', False) + self._parse_options( input_source ) # Load conversions required for the dataset input self.conversions = [] - for conv_elem in elem.findall( "conversion" ): - name = conv_elem.get( "name" ) # name for commandline substitution - conv_extensions = conv_elem.get( "type" ) # target datatype extension - # FIXME: conv_extensions should be able to be an ordered list - assert None not in [ name, type ], 'A name (%s) and type (%s) are required for explicit conversion' % ( name, type ) + for name, conv_extensions in input_source.parse_conversion_tuples(): + assert None not in [ name, conv_extensions ], 'A name (%s) and type (%s) are required for explicit conversion' % ( name, conv_extensions ) conv_types = [ tool.app.datatypes_registry.get_datatype_by_extension( conv_extensions.lower() ) ] self.conversions.append( ( name, conv_extensions, conv_types ) ) @@ -2149,16 +2157,17 @@ """ """ - def __init__( self, tool, elem, trans=None ): - super(DataCollectionToolParameter, self).__init__( tool, elem, trans ) - self.elem = elem - self._parse_formats( trans, tool, elem ) + def __init__( self, tool, input_source, trans=None ): + input_source = ensure_input_source( input_source ) + super(DataCollectionToolParameter, self).__init__( tool, input_source, trans ) + self._parse_formats( trans, tool, input_source ) + self._collection_type = input_source.get("collection_type", None) self.multiple = False # Accessed on DataToolParameter a lot, may want in future - self._parse_options( elem ) # TODO: Review and test. + self._parse_options( input_source ) # TODO: Review and test. @property def collection_type( self ): - return self.elem.get( "collection_type", None ) + return self._collection_type def _history_query( self, trans ): dataset_collection_type_descriptions = trans.app.dataset_collections_service.collection_type_descriptions diff -r b9c5b028e389678c1a073f11c9aba5104ae17e89 -r 2dc383cbb700f9d8d6a30eb976b70e8dcf1832db lib/galaxy/tools/parameters/history_query.py --- a/lib/galaxy/tools/parameters/history_query.py +++ b/lib/galaxy/tools/parameters/history_query.py @@ -11,10 +11,10 @@ self.collection_type_description = kwargs.get( "collection_type_description", None ) @staticmethod - def from_parameter_elem( elem, collection_type_descriptions ): + def from_parameter( param, collection_type_descriptions ): """ Take in a tool parameter element. """ - collection_type = elem.get( "collection_type", None ) + collection_type = param.collection_type if collection_type: collection_type_description = collection_type_descriptions.for_collection_type( collection_type ) else: diff -r b9c5b028e389678c1a073f11c9aba5104ae17e89 -r 2dc383cbb700f9d8d6a30eb976b70e8dcf1832db lib/galaxy/tools/parameters/output_collect.py --- a/lib/galaxy/tools/parameters/output_collect.py +++ b/lib/galaxy/tools/parameters/output_collect.py @@ -186,6 +186,10 @@ return map( lambda elem: DatasetCollector( **elem.attrib ), primary_dataset_elems ) +def dataset_collectors_from_list( discover_datasets_dicts ): + return map( lambda kwds: DatasetCollector( **kwds ), discover_datasets_dicts ) + + class DatasetCollector( object ): def __init__( self, **kwargs ): diff -r b9c5b028e389678c1a073f11c9aba5104ae17e89 -r 2dc383cbb700f9d8d6a30eb976b70e8dcf1832db lib/galaxy/tools/parser/__init__.py --- /dev/null +++ b/lib/galaxy/tools/parser/__init__.py @@ -0,0 +1,7 @@ +""" Package responsible for parsing tools from files/abstract tool sources. +""" +from .interface import ToolSource +from .factory import get_tool_source +from .factory import get_input_source + +__all__ = ["ToolSource", "get_tool_source", "get_input_source"] diff -r b9c5b028e389678c1a073f11c9aba5104ae17e89 -r 2dc383cbb700f9d8d6a30eb976b70e8dcf1832db lib/galaxy/tools/parser/factory.py --- /dev/null +++ b/lib/galaxy/tools/parser/factory.py @@ -0,0 +1,47 @@ +from __future__ import absolute_import + +try: + from galaxy import eggs + eggs.require("PyYAML") +except ImportError: + pass + +import yaml + +from .yaml import YamlToolSource +from .xml import XmlToolSource +from .xml import XmlInputSource +from .interface import InputSource + + +from galaxy.tools.loader import load_tool as load_tool_xml + + +import logging +log = logging.getLogger(__name__) + + +def get_tool_source(config_file, enable_beta_formats=True): + if not enable_beta_formats: + tree = load_tool_xml(config_file) + root = tree.getroot() + return XmlToolSource(root) + + if config_file.endswith(".yml"): + log.info("Loading tool from YAML - this is experimental - tool will not function in future.") + with open(config_file, "r") as f: + as_dict = yaml.load(f) + return YamlToolSource(as_dict) + else: + tree = load_tool_xml(config_file) + root = tree.getroot() + return XmlToolSource(root) + + +def get_input_source(content): + """ Wraps XML elements in a XmlInputSource until everything + is consumed using the tool source interface. + """ + if not isinstance(content, InputSource): + content = XmlInputSource(content) + return content diff -r b9c5b028e389678c1a073f11c9aba5104ae17e89 -r 2dc383cbb700f9d8d6a30eb976b70e8dcf1832db lib/galaxy/tools/parser/interface.py --- /dev/null +++ b/lib/galaxy/tools/parser/interface.py @@ -0,0 +1,246 @@ +from abc import ABCMeta +from abc import abstractmethod + +NOT_IMPLEMENTED_MESSAGE = "Galaxy tool format does not yet support this tool feature." + + +class ToolSource(object): + """ This interface represents an abstract source to parse tool + information from. + """ + __metaclass__ = ABCMeta + default_is_multi_byte = False + + @abstractmethod + def parse_id(self): + """ Parse an ID describing the abstract tool. This is not the + GUID tracked by the tool shed but the simple id (there may be + multiple tools loaded in Galaxy with this same simple id). + """ + + @abstractmethod + def parse_version(self): + """ Parse a version describing the abstract tool. + """ + + def parse_tool_module(self): + """ Load Tool class from a custom module. (Optional). + + If not None, return pair containing module and class (as strings). + """ + return None + + def parse_action_module(self): + """ Load Tool class from a custom module. (Optional). + + If not None, return pair containing module and class (as strings). + """ + return None + + def parse_tool_type(self): + """ Load simple tool type string (e.g. 'data_source', 'default'). + """ + return None + + @abstractmethod + def parse_name(self): + """ Parse a short name for tool (required). """ + + @abstractmethod + def parse_description(self): + """ Parse a description for tool. Longer than name, shorted than help. """ + + def parse_is_multi_byte(self): + """ Parse is_multi_byte from tool - TODO: figure out what this is and + document. + """ + return self.default_is_multi_byte + + def parse_display_interface(self, default): + """ Parse display_interface - fallback to default for the tool type + (supplied as default parameter) if not specified. + """ + return default + + def parse_require_login(self, default): + """ Parse whether the tool requires login (as a bool). + """ + return default + + def parse_request_param_translation_elem(self): + """ Return an XML element describing require parameter translation. + + If we wish to support this feature for non-XML based tools this should + be converted to return some sort of object interface instead of a RAW + XML element. + """ + return None + + @abstractmethod + def parse_command(self): + """ Return string contianing command to run. + """ + + @abstractmethod + def parse_interpreter(self): + """ Return string containing the interpreter to prepend to the command + (for instance this might be 'python' to run a Python wrapper located + adjacent to the tool). + """ + + def parse_redirect_url_params_elem(self): + """ Return an XML element describing redirect_url_params. + + If we wish to support this feature for non-XML based tools this should + be converted to return some sort of object interface instead of a RAW + XML element. + """ + return None + + def parse_version_command(self): + """ Parse command used to determine version of primary application + driving the tool. Return None to not generate or record such a command. + """ + return None + + def parse_version_command_interpreter(self): + """ Parse command used to determine version of primary application + driving the tool. Return None to not generate or record such a command. + """ + return None + + def parse_parallelism(self): + """ Return a galaxy.jobs.ParallismInfo object describing task splitting + or None. + """ + return None + + def parse_hidden(self): + """ Return boolean indicating whether tool should be hidden in the tool menu. + """ + return False + + @abstractmethod + def parse_requirements_and_containers(self): + """ Return pair of ToolRequirement and ContainerDescription lists. """ + + @abstractmethod + def parse_input_pages(self): + """ Return a PagesSource representing inputs by page for tool. """ + + @abstractmethod + def parse_outputs(self, tool): + """ Return a list of ToolOutput objects. + """ + + @abstractmethod + def parse_stdio(self): + """ Builds lists of ToolStdioExitCode and ToolStdioRegex objects + to describe tool execution error conditions. + """ + return [], [] + + def parse_tests_to_dict(self): + return {'tests': []} + + +class PagesSource(object): + """ Contains a list of Pages - each a list of InputSources - + each item in the outer list representing a page of inputs. + Pages are deprecated so ideally this outer list will always + be exactly a singleton. + """ + def __init__(self, page_sources): + self.page_sources = page_sources + + @property + def inputs_defined(self): + return True + + +class PageSource(object): + __metaclass__ = ABCMeta + + def parse_display(self): + return None + + @abstractmethod + def parse_input_sources(self): + """ Return a list of InputSource objects. """ + + +class InputSource(object): + __metaclass__ = ABCMeta + default_optional = False + + def elem(self): + # For things in transition that still depend on XML - provide a way + # to grab it and just throw an error if feature is attempted to be + # used with other tool sources. + raise NotImplementedError(NOT_IMPLEMENTED_MESSAGE) + + @abstractmethod + def get(self, key, value=None): + """ Return simple named properties as string for this input source. + keys to be supported depend on the parameter type. + """ + + @abstractmethod + def get_bool(self, key, default): + """ Return simple named properties as boolean for this input source. + keys to be supported depend on the parameter type. + """ + + def parse_label(self): + return self.get("label") + + def parse_help(self): + return self.get("label") + + def parse_sanitizer_elem(self): + """ Return an XML description of sanitizers. This is a stop gap + until we can rework galaxy.tools.parameters.sanitize to not + explicitly depend on XML. + """ + return None + + def parse_validator_elems(self): + """ Return an XML description of sanitizers. This is a stop gap + until we can rework galaxy.tools.parameters.validation to not + explicitly depend on XML. + """ + return [] + + def parse_optional(self, default=None): + """ Return boolean indicating wheter parameter is optional. """ + if default is None: + default = self.default_optional + return self.get_bool( "optional", default ) + + def parse_dynamic_options(self, param): + """ Return a galaxy.tools.parameters.dynamic_options.DynamicOptions + if appropriate. + """ + return None + + def parse_static_options(self): + """ Return list of static options if this is a select type without + defining a dynamic options. + """ + return [] + + def parse_conversion_tuples(self): + """ Return list of (name, extension) to describe explicit conversions. + """ + return [] + + def parse_nested_inputs_source(self): + # For repeats + raise NotImplementedError(NOT_IMPLEMENTED_MESSAGE) + + def parse_test_input_source(self): + # For conditionals + raise NotImplementedError(NOT_IMPLEMENTED_MESSAGE) + + def parse_when_input_sources(self): + raise NotImplementedError(NOT_IMPLEMENTED_MESSAGE) This diff is so big that we needed to truncate the remainder. Repository URL: https://bitbucket.org/galaxy/galaxy-central/ -- This is a commit notification from bitbucket.org. You are receiving this because you have the service enabled, addressing the recipient of this email.

1 0