vassili/seitime-frappe
1
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions 1

fix: sanitize user input during setup wizard

Browse source
This commit is contained in:
Sanket322 2024-12-23 16:32:28 +05:30
parent 21a6d2a717
commit b119513dc1
1 changed files with 14 additions and 1 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

15
frappe/desk/page/setup_wizard/setup_wizard.py
View file

@ -50,7 +50,7 @@ def setup_complete(args):
if cint(frappe.db.get_single_value("System Settings", "setup_complete")):
return {"status": "ok"}
args = parse_args(args)
args = parse_args(sanitize_input(args))
stages = get_setup_stages(args)
is_background_task = frappe.conf.get("trigger_site_setup_in_background")
@ -253,6 +253,19 @@ def parse_args(args): # nosemgrep
return args
def sanitize_input(args):
from frappe.utils import is_html, strip_html_tags
if isinstance(args, str):
args = json.loads(args)
for key, value in args.items():
if is_html(value):
args[key] = strip_html_tags(value)
return args
def add_all_roles_to(name):
user = frappe.get_doc("User", name)
user.append_roles(*_get_default_roles())