Page 1 of 1

user-script html output

Posted: July 19th, 2008, 6:49 pm
by eagle00789
i tried in one of my user-scripts to use html output, but the resulting code was changed. i had the following line in my userscript:
echo [Cleanup] Cleaning up download directory: ^%3^
and that gave me the following output:
[Cleanup] Cleaning up download directory: <a href=">">">"</a>
That means that cherrypy cleans the code before displaying it.
is it possible for cherrypy to detect if html code was in the output and NOT have it change thatpart of the output??

Re: user-script html output

Posted: July 20th, 2008, 10:40 am
by eagle00789
i already have found out that it has something to do with line 2024 in interface.py and the escape(msg) command on that line. but i can't make the necessary changes to it, as i don't understand python that well...

Re: user-script html output

Posted: July 21st, 2008, 1:22 pm
by switch
The output is escaped for a reason: security. Allowing any raw html to be added to the page sounds like an exploit waiting to happen.

We will discuss if it should be allowed or not as the user should have reasonable control over the operation of their user-scripts.