XSS fix for 'firstof' in folder template

kapt-labs · Jun 15, 2015 · 7bdf210 · 7bdf210
1 parent 5de2c69
commit 7bdf210
Showing 1 changed file with 6 additions and 1 deletion.
diff --git a/cmsplugin_filer_folder/templates/cmsplugin_filer_folder/plugins/folder/default.html b/cmsplugin_filer_folder/templates/cmsplugin_filer_folder/plugins/folder/default.html
@@ -14,7 +14,12 @@
 {% endaddtoblock %}
 
 
-{% firstof object.title object.folder.name  %}
+{# Does not use `firstof` as pre Django1.8, `firstof` does not escape its output. #}
+{% if object.title %}
+    {{ object.title }}
+{% else %}
+    {{ object.folder.name  }}
+{% endif %}
 
 {% if object.view_option == "list" %}
     <div class="cmsplugin_filer_folder_list" id="folder_{{ instance.id }}">