##// END OF EJS Templates
upstream » ipython
RSS

Clone from https://github.com/ipython/ipython.git

Fix XSS reported on Security list...
Fix XSS reported on Security list No CVE-ID yet August 18, 2015 ----- Reported to Quantopian by Juan Broullón <thebrowfc@gmail.com>... If you create a new folder in the iPython file browser and set Javascript code as its name the code injected will be executed. So, if I create a folder called "><img src=x onerror=alert(document.cookie)> and then I access to it, the cookies will be prompted. The XSS code is also executed if you access a link pointing directly at the folder. jik ------
Thomas Kluyver - - Load All Authors

File last commit:

r19410:9639b1c3
r21633:3ab41641
Show More
post-checkout
22 lines | 567 B | text/plain | TextLexer
/ git-hooks / post-checkout
History | Annotation | Raw |Copy content |Copy permalink
#!/bin/bash
git submodule init
git submodule update
if [[ "$(basename $0)" == "post-merge" ]]; then
PREVIOUS_HEAD=ORIG_HEAD
else
PREVIOUS_HEAD=$1
fi
# if style changed (and less/invoke available), rebuild sourcemaps
if [[
! -z "$(git diff $PREVIOUS_HEAD IPython/html/static/style/ipython.min.css)"
&& ! -z "$(git diff $PREVIOUS_HEAD IPython/html/static/style/style.min.css)"
&& ! -z $(which 2>/dev/null lessc)
&& ! -z $(which 2>/dev/null invoke)
]]; then
echo "rebuilding sourcemaps"
cd IPython/html
invoke css || echo "failed to compile css"
fi