diff options
Diffstat (limited to 'addons/web/controllers/main.py')
| -rw-r--r-- | addons/web/controllers/main.py | 7 |
1 files changed, 4 insertions, 3 deletions
diff --git a/addons/web/controllers/main.py b/addons/web/controllers/main.py index d09f5401786..0c9a21a96b8 100644 --- a/addons/web/controllers/main.py +++ b/addons/web/controllers/main.py @@ -102,6 +102,7 @@ db_list = http.db_list db_monodb = http.db_monodb +def clean(name): return name.replace('\x3c', '') def serialize_exception(f): @functools.wraps(f) def wrap(*args, **kwargs): @@ -1550,7 +1551,7 @@ class Binary(http.Controller): ufile.content_type, pycompat.to_text(base64.b64encode(data))] except Exception as e: args = [False, str(e)] - return out % (json.dumps(callback), json.dumps(args)) if callback else json.dumps(args) + return out % (json.dumps(clean(callback)), json.dumps(args)) if callback else json.dumps(args) @http.route('/web/binary/upload_attachment', type='http', auth="user") @serialize_exception @@ -1583,12 +1584,12 @@ class Binary(http.Controller): _logger.exception("Fail to upload attachment %s" % ufile.filename) else: args.append({ - 'filename': filename, + 'filename': clean(filename), 'mimetype': ufile.content_type, 'id': attachment.id, 'size': attachment.file_size }) - return out % (json.dumps(callback), json.dumps(args)) if callback else json.dumps(args) + return out % (json.dumps(clean(callback)), json.dumps(args)) if callback else json.dumps(args) @http.route([ '/web/binary/company_logo', |