user-script html output

Want something added? Ask for it here.
Post Reply
eagle00789
Newbie
Newbie
Posts: 30
Joined: July 5th, 2008, 9:40 am

user-script html output

Post by eagle00789 »

i tried in one of my user-scripts to use html output, but the resulting code was changed. i had the following line in my userscript:
echo [Cleanup] Cleaning up download directory: ^%3^
and that gave me the following output:
[Cleanup] Cleaning up download directory: <a href=">">">"</a>
That means that cherrypy cleans the code before displaying it.
is it possible for cherrypy to detect if html code was in the output and NOT have it change thatpart of the output??
eagle00789
Newbie
Newbie
Posts: 30
Joined: July 5th, 2008, 9:40 am

Re: user-script html output

Post by eagle00789 »

i already have found out that it has something to do with line 2024 in interface.py and the escape(msg) command on that line. but i can't make the necessary changes to it, as i don't understand python that well...
User avatar
switch
Moderator
Moderator
Posts: 1380
Joined: January 17th, 2008, 3:55 pm
Location: UK

Re: user-script html output

Post by switch »

The output is escaped for a reason: security. Allowing any raw html to be added to the page sounds like an exploit waiting to happen.

We will discuss if it should be allowed or not as the user should have reasonable control over the operation of their user-scripts.
Post Reply