jvoisin 42dc36cc10 Escape comment columns names ...

Custom columns of type comments are rendered with `|safe` (disabling Jinja2
auto-escaping) and no `clean_string` sanitization. Compare with regular book
comments which correctly use `{{ entry.comments[0].text|clean_string|safe }}`.

Any user with edit permissions can set a custom comment column to
`<script>alert(document.cookie)</script>` and it will execute for every user who
views the book detail page or the OPDS feed. This is stored XSS with no
authentication barrier beyond edit permission.

2026-04-15 23:03:30 +02:00

..

cw_advocate

Fix error in requirements.txt

2024-11-04 21:20:34 +01:00

cw_login

Generate valid session-cookie-path(s) (fix for #3459)

2026-01-18 15:38:44 +01:00

metadata_provider

Caliblur theme display fix

2025-12-04 18:52:30 +01:00

services

Merge remote-tracking branch 'fixes/escape_ldap'

2026-04-15 19:37:31 +02:00

static

Merge remote-tracking branch 'add-to-shelves-dropdown-menu/add-to-shelves-dropdown-menu'

2026-02-21 09:43:50 +01:00

tasks

Fix traceback encoding

2025-04-12 03:59:32 +08:00

templates

Escape comment columns names

2026-04-15 23:03:30 +02:00

translations

Merge remote-tracking branch 'it/patch-1'

2026-03-07 09:28:14 +01:00

__init__.py

Update translation

2026-02-14 11:30:50 +01:00

about.py

Improved dep check for windows exe version and further fixes for windows exe

2024-11-18 19:47:33 +01:00

admin.py

Better error handling on order parameter for sorting of user and books table

2026-04-06 15:12:09 +02:00

audio.py

Fixes for parallel upload (coverfiles get individual temporary names)

2024-11-30 09:45:46 +01:00

basic.py

Better error handling on series display in basic view

2026-04-06 15:28:10 +02:00

cache_buster.py

Fix Cache Buster

2022-05-22 12:49:00 +01:00

clean_html.py

Clean strings in comments before displaying

2026-04-03 09:01:01 +02:00

cli.py

Simplified version string

2024-09-07 20:07:45 +02:00

comic.py

Sort names before trying to extract coverfile of comics

2025-12-04 14:19:58 +01:00

config_sql.py

Fix typo

2026-04-15 20:31:40 +02:00

constants.py

Cover path is now selected based on correct setting and not if split_path is present or not (fix for #3527)

2026-02-08 12:12:34 +01:00

converter.py

Code cosmetics

2022-05-21 21:52:59 +01:00

cover.py

Transform color space to srgb instead of rgb to prevent dark images

2025-01-05 01:49:46 +01:00

cw_babel.py

List locale alphabetically

2025-03-23 09:18:48 +01:00

db.py

Prevent SQLI via dbpath

2026-04-14 23:23:12 +02:00

debug_info.py

Improved dep check for windows exe version and further fixes for windows exe

2024-11-18 19:47:33 +01:00

dep_check.py

Improved dep check for windows exe version and further fixes for windows exe

2024-11-18 19:47:33 +01:00

editbooks.py

Merge remote-tracking branch 'page_count/fix-series-list-view-sorts-by-name-instead-of-sort-field'

2026-03-07 10:24:58 +01:00

embed_helper.py

Fix for #3131 (Enable/Disable "Separate Book Files from Library" issue)

2024-08-23 10:51:37 +02:00

epub_helper.py

Prevent XXE in epub/fb2/goodreads API

2026-04-14 22:12:57 +02:00

epub.py

Prevent XXE in epub/fb2/goodreads API

2026-04-14 22:12:57 +02:00

error_handler.py

Update translation

2026-02-14 11:30:50 +01:00

fb2.py

Prevent XXE in epub/fb2/goodreads API

2026-04-14 22:12:57 +02:00

file_helper.py

Added logging of ip address (#3237)

2024-12-07 07:27:00 +01:00

fs.py

Rename CACHE_DIR env var to CACHE_DIRECTORY (#3343)

2025-04-01 01:13:45 -07:00

gdrive.py

Fix a dumb type condition in gdrive.py

2026-04-14 22:51:36 +02:00

gdriveutils.py

Enabled covers with gdrive

2024-07-02 20:53:08 +02:00

gevent_wsgi.py

Log Forwarded for address in accesslog instead of client address for gevent

2024-07-08 14:42:48 +02:00

helper.py

fix: support native UTF-8 downloaded filenames for browsers

2026-02-20 23:07:06 +08:00

iso_language_names.py

Merge remote-tracking branch 'arabic/add-arabic-translation'

2025-06-29 09:46:23 +02:00

isoLanguages.py

Merge branch 'Develop' - Improved compability for python 3.12+

2024-11-02 16:59:19 +01:00

jinjia.py

Clean strings in comments before displaying

2026-04-03 09:01:01 +02:00

kobo_auth.py

Fix an IDOR in kobo tokens

2026-04-14 22:10:30 +02:00

kobo_sync_status.py

Update mass edit

2024-12-13 18:03:14 +01:00

kobo.py

Kobo: include PriorityTimestamp in PUT /state response

2026-03-01 18:19:40 -06:00

logger.py

Updates dependencies

2025-03-23 15:12:06 +01:00

main.py

Fix AttributeError on unauthenticated OPDS requests

2026-02-21 16:54:14 -06:00

MyLoginManager.py

Removed unused imports

2024-07-29 20:08:17 +02:00

oauth_bb.py

Prevent OAuth relinking.

2026-04-14 22:28:06 +02:00

oauth.py

Python 3.13 compatibility

2025-03-30 12:03:12 +02:00

opds.py

Remove debug code

2025-12-20 13:22:20 +01:00

pagination.py

Better epub cover parsing with multiple cover-image items

2022-03-13 19:00:37 +01:00

redirect.py

Updated testresults

2025-11-22 15:06:40 +01:00

remotelogin.py

proxy login is now no longer saving cookies,

2024-07-14 16:24:07 +02:00

render_template.py

Remove Get Parameter sort_param, where it is not valid (#3447)

2026-01-18 16:07:04 +01:00

reverseproxy.py

Generate valid session-cookie-path(s) (fix for #3459)

2026-01-18 15:38:44 +01:00

schedule.py

Clean expired sessions (also old sessions without expiry date)

2024-07-17 20:05:51 +02:00

search_metadata.py

Update search_metadata.py

2026-03-01 15:44:29 +01:00

search.py

Merge remote-tracking branch 'page_count/fix-series-list-view-sorts-by-name-instead-of-sort-field'

2026-03-07 10:24:58 +01:00

server.py

add console process interruption by ctrl C

2025-10-26 21:28:58 +01:00

shelf.py

Don't allow users to edit shelves they don't have permission to edit.

2026-04-14 22:25:36 +02:00

string_helper.py

Marked 2 strings as raw strings to suppress warnings

2024-10-25 14:18:22 +02:00

subproc_wrapper.py

Code cleaning (remove python2)

2021-10-04 19:23:24 +02:00

tasks_status.py

Added error message to task list

2024-08-02 18:08:18 +02:00

tornado_wsgi.py

Log Forwarded for address in accesslog instead of client address for tornado

2024-07-08 15:04:53 +02:00

ub.py

Python 3.13 compatibility

2025-03-30 12:03:12 +02:00

updater.py

Fix for stable update version

2024-11-11 18:46:07 +01:00

uploader.py

Fixes for parallel upload (coverfiles get individual temporary names)

2024-11-30 09:45:46 +01:00

usermanagement.py

Fix for flask limiter 4.0

2026-02-18 18:59:29 +01:00

web.py

Fix access bypass on /show/ (serve_book)

2026-04-14 23:05:18 +02:00