fixing vulnerability: XXE

quokka/admin/actions.py

@@ -83,8 +83,8 @@ def action_create_userprofile(self, ids):
                 'index', {'content_type': 'block', 'slug': fullslug}
             )
 
-            #fix vulnerabillity here 
-            #test sanity variables values
+            # fix vulnerabillity here
+            # test sanity variables values
 
             if existing_block:
                 blocklink = url_for(

quokka/admin/wtforms_html5.py

@@ -195,7 +195,7 @@ def set_title(field, render_kw=None):
     """
     if render_kw is None:
         render_kw = {}
-    if 'title' not in render_kw and getattr(field, 'description'):
+    if 'title' not in render_kw and getattr(field, 'description', None):
         render_kw['title'] = '{}'.format(field.description)
     return render_kw
 

quokka/core/content/models.py

@@ -230,13 +230,13 @@ def metadata(self):
         # TODO: get metadata from database
         # TODO: implement libratar/gravatar
         # return {
-            # 'cover': 'foo',
-            # 'author_gravatar': 'http://i.pravatar.cc/300',
-            # 'about_author': 'About Author',
-            # 'translations': ['en'],
-            # 'og_image': 'foo',
-            # 'series': 'aa',
-            # 'asides': 'aaa'
+        # 'cover': 'foo',
+        # 'author_gravatar': 'http://i.pravatar.cc/300',
+        # 'about_author': 'About Author',
+        # 'translations': ['en'],
+        # 'og_image': 'foo',
+        # 'series': 'aa',
+        # 'asides': 'aaa'
         # }
         data = {}
         data.update(custom_var_dict(self.data.get('custom_vars')))

quokka/core/content/utils.py

@@ -10,9 +10,10 @@ def url_for_content(content, include_ext=True):
     else:
         data = content
 
+    category_slug_data = data.get('category_slug')
+    category_data = slugify_category(data.get('category') or '')
     category_slug = (
-        data.get('category_slug') or
-        slugify_category(data.get('category') or '')
+        category_slug_data or category_data
     )
     slug = data.get('slug') or slugify(data.get('title'))
 

quokka/core/content/views.py

@@ -255,6 +255,8 @@ def render_rss(self, content_type, templates, **context):
 
         for content in contents:
             content = make_model(content)
+            content_data = content.title.encode('utf-8')
+            content_data += content.url.encode('utf-8')
 
             if content.date > rss_pubdate:
                 rss_pubdate = content.date
@@ -267,8 +269,7 @@ def render_rss(self, content_type, templates, **context):
                     author=str(content.author),
                     categories=[str(content.tags)],
                     guid=hashlib.sha1(
-                        content.title.encode('utf-8') +
-                        content.url.encode('utf-8')
+                        content_data
                     ).hexdigest(),
                     pubDate=content.date,
                 )

quokka/core/db.py

@@ -183,17 +183,14 @@ def page_set(self, *args, **kwargs):
         return self.content_set(*args, **kwargs)
 
     def block_set(self, *args, **kwargs):
-            kwargs.setdefault(
-                'sort',
-                self.app.theme_context.get(
-                    'BLOCK_ORDER_BY', [('title', -1)]
-                )
-            )
-            if not args:
-                args = [{'content_type': 'block'}]
-            elif isinstance(args[0], dict):
-                args[0]['content_type'] = 'block'
-            return self.content_set(*args, **kwargs)
+        kwargs.setdefault('sort', self.app.theme_context.get(
+            'BLOCK_ORDER_BY', [('title', -1)]
+        ))
+        if not args:
+            args = [{'content_type': 'block'}]
+        elif isinstance(args[0], dict):
+            args[0]['content_type'] = 'block'
+        return self.content_set(*args, **kwargs)
 
     def select(self, colname, *args, **kwargs):
         return self.get_collection(colname).find(*args, **kwargs)

quokka/core/views/sitemap.py

@@ -11,12 +11,12 @@ def get_contents(self):
         TODO: Should include extra paths, fixed paths
         config based paths, static paths
         """
+        content = self.get_index() + self.get_categories()
+        content += self.get_tags() + self.get_authors()
+        content += self.get_articles_and_pages()
+
         return (
-            self.get_index() +
-            self.get_categories() +
-            self.get_tags() +
-            self.get_authors() +
-            self.get_articles_and_pages()
+            content
         )
 
     def get_index(self):

quokka/utils/upload.py

@@ -9,7 +9,7 @@
 
 def dated_path(obj, file_data):
     try:
-        prefix = getattr(obj, 'model_name')
+        prefix = getattr(obj, 'model_name', None)
     except BaseException:
         prefix = "undefined"