cubicweb: misc/migration/3.16.0

Mercurial Mercurial > pub > hg > cubicweb / file revision

misc/migration/3.16.0_Any.py

author	Julien Cristau <julien.cristau@logilab.fr>
	Wed, 05 Feb 2014 16:34:21 +0100 (2014-02-05)
branch	stable
changeset 9523	cd5738fc440f
parent 8675	b60329e40e26
permissions	-rw-r--r--

[ajax] use a custom tag to handle dynamically loaded js Using <pre class="script"> makes it trivial for a malicious user to inject arbitrary javascript into a html or rest text element (because it looks innocent to the html sanitizer). Using a custom tag we can be sure that it actually comes from our code and not from untrusted user data. IE ignores custom tags, though, so we put it in its own namespace. https://extranet.logilab.fr/1530578

sync_schema_props_perms('EmailAddress')

for source in rql('CWSource X WHERE X type "pyrorql"').entities():
    sconfig = source.dictconfig
    nsid = sconfig.pop('pyro-ns-id', config.appid)
    nshost = sconfig.pop('pyro-ns-host', '')
    nsgroup = sconfig.pop('pyro-ns-group', ':cubicweb')
    if nsgroup:
        nsgroup += '.'
    source.cw_set(url=u'pyro://%s/%s%s' % (nshost, nsgroup, nsid))
    source.update_config(skip_unknown=True, **sconfig)

commit()

cubicweb

RSS Atom