In allura/lib/macro.py
, several of the macros use string.Template()
with HTML in the python code. This should be refactored to use jinja2 and external .html
files, to get proper escaping of interpolated values and separation of HTML and python.
Created #321: [#6105] Refactor markdown macros to use jinja2 templates instead of string.Template (1cp)
Related
Tickets:
#6105Closed #321.
je/42cc_6105
The
jinja2.escape
calls in macro.py shouldn't be necessary any more. Remove and confirm that the templates escape everything automatically.Created #348: [#6105] Followup to Refactor markdown macros (1cp)
Related
Tickets:
#6105Closed #348.
je/42cc_6105
(forced update)