github/datasette
1
0
Fork 0
mirror of https://github.com/simonw/datasette.git synced 2025-12-10 16:51:24 +01:00
Code Issues Projects Releases Packages Wiki Activity

Correct escaping for HTML display of row links

Browse source
This commit is contained in:
Russ Garrett 2018-04-15 22:48:30 +01:00
commit 317eeadf21
No known key found for this signature in database
GPG key ID: 68880BB652AB0570
2 changed files with 15 additions and 9 deletions
Download patch file Download diff file Expand all files Collapse all files

5
datasette/app.py
View file

@ -524,10 +524,11 @@ class RowTableShared(BaseView):
cells.append({ cells.append({
'column': 'Link', 'column': 'Link',
'value': jinja2.Markup( 'value': jinja2.Markup(
'<a href="/{database}/{table}/{flat_pks}">{flat_pks}</a>'.format( '<a href="/{database}/{table}/{flat_pks_quoted}">{flat_pks}</a>'.format(
database=database, database=database,
table=urllib.parse.quote_plus(table), table=urllib.parse.quote_plus(table),
flat_pks=path_from_row_pks(row, pks, not pks), flat_pks=str(jinja2.escape(path_from_row_pks(row, pks, not pks, False))),
flat_pks_quoted=path_from_row_pks(row, pks, not pks)
) )
), ),
}) })

19
datasette/utils.py
View file

@ -38,14 +38,19 @@ def urlsafe_components(token):
] ]
def path_from_row_pks(row, pks, use_rowid): def path_from_row_pks(row, pks, use_rowid, quote=True):
""" Generate an optionally URL-quoted unique identifier
for a row from its primary keys."""
if use_rowid: if use_rowid:
return urllib.parse.quote_plus(str(row['rowid'])) bits = [row['rowid']]
bits = [] else:
for pk in pks: bits = [row[pk] for pk in pks]
bits.append(
urllib.parse.quote_plus(str(row[pk])) if quote:
) bits = [urllib.parse.quote_plus(str(bit)) for bit in bits]
else:
bits = [str(bit) for bit in bits]
return ','.join(bits) return ','.join(bits)