Commit a85fb569 authored by Andreas Jung's avatar Andreas Jung

WebDAV: Zope escaped nested object properties derived from

internal dav__* functions in PropertySheets.py although they
are considered to be safe and do not need any escaping. This
caused Zope to be completely incomplete with Windows XP. Fixed !
parent d13f7c7b
...@@ -91,6 +91,11 @@ Zope Changes ...@@ -91,6 +91,11 @@ Zope Changes
Bugs fixed Bugs fixed
- WebDAV: Zope escaped nested object properties derived from
internal dav__* functions in PropertySheets.py although they
are considered to be safe and do not need any escaping. This
caused Zope to be completely incomplete with Windows XP. Fixed !
- Collector #2532: ZCatalog.availableSplitters is now protected - Collector #2532: ZCatalog.availableSplitters is now protected
by security mechanism. by security mechanism.
......
...@@ -84,7 +84,7 @@ ...@@ -84,7 +84,7 @@
############################################################################## ##############################################################################
"""Property sheets""" """Property sheets"""
__version__='$Revision: 1.78 $'[11:-2] __version__='$Revision: 1.79 $'[11:-2]
import time, string, App.Management, Globals import time, string, App.Management, Globals
from webdav.WriteLockInterface import WriteLockInterface from webdav.WriteLockInterface import WriteLockInterface
...@@ -363,6 +363,7 @@ class PropertySheet(Traversable, Persistent, Implicit): ...@@ -363,6 +363,7 @@ class PropertySheet(Traversable, Persistent, Implicit):
for item in self._propertyMap(): for item in self._propertyMap():
name, type=item['id'], item.get('type','string') name, type=item['id'], item.get('type','string')
value=self.getProperty(name) value=self.getProperty(name)
if type=='tokens': if type=='tokens':
value=join(str(value), ' ') value=join(str(value), ' ')
elif type=='lines': elif type=='lines':
...@@ -376,7 +377,10 @@ class PropertySheet(Traversable, Persistent, Implicit): ...@@ -376,7 +377,10 @@ class PropertySheet(Traversable, Persistent, Implicit):
# Quote non-xml items here? # Quote non-xml items here?
attrs='' attrs=''
prop=' <n:%s%s>%s</n:%s>' % (name, attrs, xml_escape(value), name) if hasattr(self,"dav__"+name):
prop=' <n:%s%s>%s</n:%s>' % (name, attrs, value, name)
else:
prop=' <n:%s%s>%s</n:%s>' % (name, attrs, xml_escape(value), name)
result.append(prop) result.append(prop)
if not result: return '' if not result: return ''
......
Markdown is supported
0%
or
You are about to add 0 people to the discussion. Proceed with caution.
Finish editing this message first!
Please register or to comment