CVE-2012-6131

@@ -55,8 +55,10 @@ Fixed:
   backported version of my proposed changes to
   email.header.decode_header in http://bugs.python.org/issue1079
   (Ralf)
-- issue2550711 Fix XSS vulnerability when username contains HTML code,
+- issue2550684 Fix XSS vulnerability when username contains HTML code,
   thanks to Thomas Arendsen Hein for reporting and patch.
+- issue2550711 Fix XSS vulnerability in @action parameter,
+  thanks to "om" for reporting.
 
 
 2011-07-15: 1.4.19

@@ -104,6 +104,7 @@ Stefan Niederhauser,
 Truls E. Næss,
 Bryce L Nordgren,
 Patrick Ohly,
+"om",
 Luke Opperman,
 Eddie Parker,
 Will Partain,

@@ -1171,7 +1171,7 @@ def get_action_class(self, action_name):
                 if name == action_name:
                     break
             else:
-                raise ValueError('No such action "%s"'%action_name)
+                raise ValueError('No such action "%s"'%cgi.escape(action_name))
         return action_klass
 
     def _socket_op(self, call, *args, **kwargs):

@@ -55,6 +55,8 @@ Fixed:
   backported version of my proposed changes to
   email.header.decode_header in http://bugs.python.org/issue1079
   (Ralf)
+- issue2550711 Fix XSS vulnerability when username contains HTML code,
+  thanks to Thomas Arendsen Hein for reporting and patch.
 
 
 2011-07-15: 1.4.19

@@ -1141,7 +1141,7 @@ def history(self, direction='descending', dre=re.compile('^\d+$'),
             if dre.match(user):
                 user = self._db.user.get(user, 'username')
             l.append('<tr><td>%s</td><td>%s</td><td>%s</td><td>%s</td></tr>'%(
-                date_s, user, self._(action), arg_s))
+                date_s, cgi.escape(user), self._(action), arg_s))
         if comments:
             l.append(self._(
                 '<tr><td colspan=4><strong>Note:</strong></td></tr>'))