Cyclone-Team/gramps
2
0
Fork 0
Code Issues Pull Requests Packages Projects Releases Wiki Activity

Use escape utility from html rather than cgi module

Browse Source
This commit is contained in:
Nick Hall 2015-05-22 14:49:02 +01:00
parent e5591da496
commit e355a93dc1
13 changed files with 54 additions and 54 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

8
gramps/gen/simple/_simpletable.py
View File

@ -24,7 +24,7 @@
Provide a simplified table creation interface Provide a simplified table creation interface
""" """
import cgi from html import escape
from ..const import GRAMPS_LOCALE as glocale from ..const import GRAMPS_LOCALE as glocale
_ = glocale.translation.sgettext _ = glocale.translation.sgettext
from ..lib import (Person, Family, Event, Source, Place, Citation, from ..lib import (Person, Family, Event, Source, Place, Citation,
@ -153,7 +153,7 @@ class SimpleTable(object):
if item.get_valid(): if item.get_valid():
if item.format: if item.format:
self.set_cell_markup(col, row, self.set_cell_markup(col, row,
item.format % cgi.escape(text)) item.format % escape(text))
self.row_sort_val(col, item.sortval) self.row_sort_val(col, item.sortval)
else: else:
# sort before others: # sort before others:
@ -161,7 +161,7 @@ class SimpleTable(object):
# give formatted version: # give formatted version:
invalid_date_format = config.get('preferences.invalid-date-format') invalid_date_format = config.get('preferences.invalid-date-format')
self.set_cell_markup(col, row, self.set_cell_markup(col, row,
invalid_date_format % cgi.escape(text)) invalid_date_format % escape(text))
if (self._link_col == col or link is None): if (self._link_col == col or link is None):
link = ('Date', item) link = ('Date', item)
elif isinstance(item, Span): elif isinstance(item, Span):
@ -261,7 +261,7 @@ class SimpleTable(object):
elif y in self._cell_markup[x]: elif y in self._cell_markup[x]:
return self._cell_markup[x][y] return self._cell_markup[x][y]
else: else:
return cgi.escape(data) return escape(data)
else: else:
if y is None: if y is None:
return False # no markup for this column return False # no markup for this column

20
gramps/gen/utils/libformatting.py
View File

@ -28,7 +28,7 @@ recompute
# Python modules # Python modules
# #
#------------------------------------------------------------------------- #-------------------------------------------------------------------------
from cgi import escape from html import escape
#------------------------------------------------------------------------- #-------------------------------------------------------------------------
# #
@ -73,17 +73,17 @@ class FormattingHelper(object):
text = "" text = ""
marriage = get_marriage_or_fallback(self.dbstate.db, family) marriage = get_marriage_or_fallback(self.dbstate.db, family)
if marriage and use_markup and marriage.get_type() != EventType.MARRIAGE: if marriage and use_markup and marriage.get_type() != EventType.MARRIAGE:
mdate = "<i>%s %s</i>" % (marriage.get_type().get_abbreviation(), mdate = "<i>%s %s</i>" % (marriage.get_type().get_abbreviation(),
escape(get_date(marriage))) escape(get_date(marriage)))
mplace = "<i>%s</i>" % escape(self.get_place_name(marriage.get_place_handle())) mplace = "<i>%s</i>" % escape(self.get_place_name(marriage.get_place_handle()))
name = "<i>%s</i>" % str(marriage.get_type()) name = "<i>%s</i>" % str(marriage.get_type())
elif marriage and use_markup: elif marriage and use_markup:
mdate = "%s %s" % (marriage.get_type().get_abbreviation(), mdate = "%s %s" % (marriage.get_type().get_abbreviation(),
escape(get_date(marriage))) escape(get_date(marriage)))
mplace = escape(self.get_place_name(marriage.get_place_handle())) mplace = escape(self.get_place_name(marriage.get_place_handle()))
name = str(marriage.get_type()) name = str(marriage.get_type())
elif marriage: elif marriage:
mdate = "%s %s" % (marriage.get_type().get_abbreviation(), mdate = "%s %s" % (marriage.get_type().get_abbreviation(),
get_date(marriage)) get_date(marriage))
mplace = self.get_place_name(marriage.get_place_handle()) mplace = self.get_place_name(marriage.get_place_handle())
name = str(marriage.get_type()) name = str(marriage.get_type())
@ -149,28 +149,28 @@ class FormattingHelper(object):
if line_count >= 3: if line_count >= 3:
birth = get_birth_or_fallback(self.dbstate.db, person) birth = get_birth_or_fallback(self.dbstate.db, person)
if birth and use_markup and birth.get_type() != EventType.BIRTH: if birth and use_markup and birth.get_type() != EventType.BIRTH:
bdate = "<i>%s</i>" % escape(get_date(birth)) bdate = "<i>%s</i>" % escape(get_date(birth))
bplace = "<i>%s</i>" % escape(self.get_place_name( bplace = "<i>%s</i>" % escape(self.get_place_name(
birth.get_place_handle())) birth.get_place_handle()))
elif birth and use_markup: elif birth and use_markup:
bdate = escape(get_date(birth)) bdate = escape(get_date(birth))
bplace = escape(self.get_place_name(birth.get_place_handle())) bplace = escape(self.get_place_name(birth.get_place_handle()))
elif birth: elif birth:
bdate = get_date(birth) bdate = get_date(birth)
bplace = self.get_place_name(birth.get_place_handle()) bplace = self.get_place_name(birth.get_place_handle())
else: else:
bdate = "" bdate = ""
bplace = "" bplace = ""
death = get_death_or_fallback(self.dbstate.db, person) death = get_death_or_fallback(self.dbstate.db, person)
if death and use_markup and death.get_type() != EventType.DEATH: if death and use_markup and death.get_type() != EventType.DEATH:
ddate = "<i>%s</i>" % escape(get_date(death)) ddate = "<i>%s</i>" % escape(get_date(death))
dplace = "<i>%s</i>" % escape(self.get_place_name( dplace = "<i>%s</i>" % escape(self.get_place_name(
death.get_place_handle())) death.get_place_handle()))
elif death and use_markup: elif death and use_markup:
ddate = escape(get_date(death)) ddate = escape(get_date(death))
dplace = escape(self.get_place_name(death.get_place_handle())) dplace = escape(self.get_place_name(death.get_place_handle()))
elif death: elif death:
ddate = get_date(death) ddate = get_date(death)
dplace = self.get_place_name(death.get_place_handle()) dplace = self.get_place_name(death.get_place_handle())
else: else:
ddate = "" ddate = ""

6
gramps/gui/editors/displaytabs/childmodel.py
View File

@ -24,7 +24,7 @@
# #
#------------------------------------------------------------------------- #-------------------------------------------------------------------------
from gi.repository import Gtk from gi.repository import Gtk
import cgi from html import escape
#------------------------------------------------------------------------- #-------------------------------------------------------------------------
# #
@ -76,7 +76,7 @@ class ChildModel(Gtk.ListStore):
if birth.get_type() == EventType.BIRTH: if birth.get_type() == EventType.BIRTH:
return get_date(birth) return get_date(birth)
else: else:
return '<i>%s</i>' % cgi.escape(get_date(birth)) return '<i>%s</i>' % escape(get_date(birth))
else: else:
return "" return ""
@ -99,7 +99,7 @@ class ChildModel(Gtk.ListStore):
if death.get_type() == EventType.DEATH: if death.get_type() == EventType.DEATH:
return get_date(death) return get_date(death)
else: else:
return '<i>%s</i>' % cgi.escape(get_date(death)) return '<i>%s</i>' % escape(get_date(death))
else: else:
return "" return ""

4
gramps/gui/editors/displaytabs/eventrefmodel.py
View File

@ -38,7 +38,7 @@ from gi.repository import Pango
WEIGHT_NORMAL = Pango.Weight.NORMAL WEIGHT_NORMAL = Pango.Weight.NORMAL
WEIGHT_BOLD = Pango.Weight.BOLD WEIGHT_BOLD = Pango.Weight.BOLD
import cgi from html import escape
#------------------------------------------------------------------------- #-------------------------------------------------------------------------
# #
@ -145,7 +145,7 @@ class EventRefModel(Gtk.TreeStore):
event = self.db.get_event_from_handle(event_ref.ref) event = self.db.get_event_from_handle(event_ref.ref)
retval = get_date(event) retval = get_date(event)
if not get_date_valid(event): if not get_date_valid(event):
return invalid_date_format % cgi.escape(retval) return invalid_date_format % escape(retval)
else: else:
return retval return retval

4
gramps/gui/views/treemodels/citationbasemodel.py
View File

@ -28,7 +28,7 @@ CitationBaseModel classes for GRAMPS.
# python modules # python modules
# #
#------------------------------------------------------------------------- #-------------------------------------------------------------------------
import cgi from html import escape
import logging import logging
log = logging.getLogger(".") log = logging.getLogger(".")
LOG = logging.getLogger(".citation") LOG = logging.getLogger(".citation")
@ -90,7 +90,7 @@ class CitationBaseModel(object):
citation.unserialize(data) citation.unserialize(data)
date_str = get_date(citation) date_str = get_date(citation)
if date_str != "": if date_str != "":
retval = cgi.escape(date_str) retval = escape(date_str)
if not get_date_valid(citation): if not get_date_valid(citation):
return INVALID_DATE_FORMAT % retval return INVALID_DATE_FORMAT % retval
else: else:

4
gramps/gui/views/treemodels/eventmodel.py
View File

@ -23,7 +23,7 @@
# python modules # python modules
# #
#------------------------------------------------------------------------- #-------------------------------------------------------------------------
import cgi from html import escape
import logging import logging
log = logging.getLogger(".") log = logging.getLogger(".")
@ -149,7 +149,7 @@ class EventModel(FlatBaseModel):
event.unserialize(data) event.unserialize(data)
date_str = get_date(event) date_str = get_date(event)
if date_str != "": if date_str != "":
retval = cgi.escape(date_str) retval = escape(date_str)
if not get_date_valid(event): if not get_date_valid(event):
return INVALID_DATE_FORMAT % retval return INVALID_DATE_FORMAT % retval
else: else:

2
gramps/gui/widgets/fanchart.py
View File

@ -44,7 +44,7 @@ import math
import colorsys import colorsys
import sys import sys
import pickle import pickle
from cgi import escape from html import escape
#------------------------------------------------------------------------- #-------------------------------------------------------------------------
# #

2
gramps/gui/widgets/fanchartdesc.py
View File

@ -42,7 +42,7 @@ import cairo
import math import math
import colorsys import colorsys
import pickle import pickle
from cgi import escape from html import escape
#------------------------------------------------------------------------- #-------------------------------------------------------------------------
# #

4
gramps/gui/widgets/labels.py
View File

@ -27,7 +27,7 @@ __all__ = ["LinkLabel", "EditLabel", "BasicLabel", "GenderLabel",
# #
#------------------------------------------------------------------------- #-------------------------------------------------------------------------
import os import os
import cgi from html import escape
from gramps.gen.const import GRAMPS_LOCALE as glocale from gramps.gen.const import GRAMPS_LOCALE as glocale
_ = glocale.translation.gettext _ = glocale.translation.gettext
import logging import logging
@ -112,7 +112,7 @@ class LinkLabel(Gtk.EventBox):
else: else:
raise AttributeError("invalid theme: '%s'" % theme) raise AttributeError("invalid theme: '%s'" % theme)
self.orig_text = cgi.escape(label[0]) self.orig_text = escape(label[0])
self.gender = label[1] self.gender = label[1]
self.decoration = format self.decoration = format
text = '<span %s>%s</span>' % (self.decoration, self.orig_text) text = '<span %s>%s</span>' % (self.decoration, self.orig_text)

10
gramps/plugins/gramplet/pedigreegramplet.py
View File

@ -22,7 +22,7 @@
# Python modules # Python modules
# #
#------------------------------------------------------------------------ #------------------------------------------------------------------------
import cgi from html import escape
#------------------------------------------------------------------------ #------------------------------------------------------------------------
# #
@ -196,11 +196,11 @@ class PedigreeGramplet(Gramplet):
if birth and birth.get_type() != EventType.BIRTH: if birth and birth.get_type() != EventType.BIRTH:
sdate = get_date(birth) sdate = get_date(birth)
if sdate: if sdate:
bdate = "<i>%s</i>" % cgi.escape(sdate) bdate = "<i>%s</i>" % escape(sdate)
else: else:
bdate = "" bdate = ""
elif birth: elif birth:
bdate = cgi.escape(get_date(birth)) bdate = escape(get_date(birth))
else: else:
bdate = "" bdate = ""
@ -208,11 +208,11 @@ class PedigreeGramplet(Gramplet):
if death and death.get_type() != EventType.DEATH: if death and death.get_type() != EventType.DEATH:
sdate = get_date(death) sdate = get_date(death)
if sdate: if sdate:
ddate = "<i>%s</i>" % cgi.escape(sdate) ddate = "<i>%s</i>" % escape(sdate)
else: else:
ddate = "" ddate = ""
elif death: elif death:
ddate = cgi.escape(get_date(death)) ddate = escape(get_date(death))
else: else:
ddate = "" ddate = ""

10
gramps/plugins/view/geoclose.py
View File

@ -33,7 +33,7 @@ _ = glocale.translation.gettext
import operator import operator
from gi.repository import Gtk from gi.repository import Gtk
from math import * from math import *
import cgi from html import escape
#------------------------------------------------------------------------- #-------------------------------------------------------------------------
# #
@ -249,11 +249,11 @@ class GeoClose(GeoGraphyView):
if birth and birth.get_type() != EventType.BIRTH: if birth and birth.get_type() != EventType.BIRTH:
sdate = get_date(birth) sdate = get_date(birth)
if sdate: if sdate:
bdate = "<i>%s</i>" % cgi.escape(sdate) bdate = "<i>%s</i>" % escape(sdate)
else: else:
bdate = "" bdate = ""
elif birth: elif birth:
bdate = cgi.escape(get_date(birth)) bdate = escape(get_date(birth))
else: else:
bdate = "" bdate = ""
return bdate return bdate
@ -266,11 +266,11 @@ class GeoClose(GeoGraphyView):
if death and death.get_type() != EventType.DEATH: if death and death.get_type() != EventType.DEATH:
sdate = get_date(death) sdate = get_date(death)
if sdate: if sdate:
ddate = "<i>%s</i>" % cgi.escape(sdate) ddate = "<i>%s</i>" % escape(sdate)
else: else:
ddate = "" ddate = ""
elif death: elif death:
ddate = cgi.escape(get_date(death)) ddate = escape(get_date(death))
else: else:
ddate = "" ddate = ""
return ddate return ddate

2
gramps/plugins/view/pedigreeview.py
View File

@ -27,7 +27,7 @@
# Python modules # Python modules
# #
#------------------------------------------------------------------------- #-------------------------------------------------------------------------
from cgi import escape from html import escape
import math import math
import os import os
import pickle import pickle

32
gramps/plugins/view/relview.py
View File

@ -30,7 +30,7 @@ Relationship View
from gramps.gen.const import GRAMPS_LOCALE as glocale from gramps.gen.const import GRAMPS_LOCALE as glocale
_ = glocale.translation.sgettext _ = glocale.translation.sgettext
ngettext = glocale.translation.ngettext # else "nearby" comments are ignored ngettext = glocale.translation.ngettext # else "nearby" comments are ignored
import cgi from html import escape
import pickle import pickle
#------------------------------------------------------------------------- #-------------------------------------------------------------------------
@ -206,7 +206,7 @@ class RelationshipView(NavigationView):
def person_update(self, handle_list): def person_update(self, handle_list):
if self.active: if self.active:
person = self.get_active() person = self.get_active()
if person: if person:
while not self.change_person(person): while not self.change_person(person):
pass pass
@ -219,7 +219,7 @@ class RelationshipView(NavigationView):
"""Large change to person database""" """Large change to person database"""
if self.active: if self.active:
self.bookmarks.redraw() self.bookmarks.redraw()
person = self.get_active() person = self.get_active()
if person: if person:
while not self.change_person(person): while not self.change_person(person):
pass pass
@ -230,7 +230,7 @@ class RelationshipView(NavigationView):
def family_update(self, handle_list): def family_update(self, handle_list):
if self.active: if self.active:
person = self.get_active() person = self.get_active()
if person: if person:
while not self.change_person(person): while not self.change_person(person):
pass pass
@ -241,7 +241,7 @@ class RelationshipView(NavigationView):
def family_add(self, handle_list): def family_add(self, handle_list):
if self.active: if self.active:
person = self.get_active() person = self.get_active()
if person: if person:
while not self.change_person(person): while not self.change_person(person):
pass pass
@ -252,7 +252,7 @@ class RelationshipView(NavigationView):
def family_delete(self, handle_list): def family_delete(self, handle_list):
if self.active: if self.active:
person = self.get_active() person = self.get_active()
if person: if person:
while not self.change_person(person): while not self.change_person(person):
pass pass
@ -263,7 +263,7 @@ class RelationshipView(NavigationView):
def family_rebuild(self): def family_rebuild(self):
if self.active: if self.active:
person = self.get_active() person = self.get_active()
if person: if person:
while not self.change_person(person): while not self.change_person(person):
pass pass
@ -558,7 +558,7 @@ class RelationshipView(NavigationView):
# name and edit button # name and edit button
name = name_displayer.display(person) name = name_displayer.display(person)
fmt = '<span size="larger" weight="bold">%s</span>' fmt = '<span size="larger" weight="bold">%s</span>'
text = fmt % cgi.escape(name) text = fmt % escape(name)
label = widgets.DualMarkupLabel(text, _GenderCode[person.gender], label = widgets.DualMarkupLabel(text, _GenderCode[person.gender],
x_align=1) x_align=1)
if self._config.get('preferences.releditbtn'): if self._config.get('preferences.releditbtn'):
@ -740,7 +740,7 @@ class RelationshipView(NavigationView):
Shows following elements: Shows following elements:
(collapse/expand arrow, Parents/Family title label, Family gramps_id, and add-choose-edit-delete buttons) (collapse/expand arrow, Parents/Family title label, Family gramps_id, and add-choose-edit-delete buttons)
""" """
msg = '<span style="italic" weight="heavy">%s</span>' % cgi.escape(title) msg = '<span style="italic" weight="heavy">%s</span>' % escape(title)
hbox = Gtk.Box() hbox = Gtk.Box()
label = widgets.MarkupLabel(msg, x_align=1) label = widgets.MarkupLabel(msg, x_align=1)
# Draw the collapse/expand button: # Draw the collapse/expand button:
@ -1012,7 +1012,7 @@ class RelationshipView(NavigationView):
else: else:
format = "%s" format = "%s"
label = widgets.MarkupLabel(format % cgi.escape(title), label = widgets.MarkupLabel(format % escape(title),
x_align=1, y_align=0) x_align=1, y_align=0)
if self._config.get('preferences.releditbtn'): if self._config.get('preferences.releditbtn'):
label.set_padding(0, 5) label.set_padding(0, 5)
@ -1111,7 +1111,7 @@ class RelationshipView(NavigationView):
else: else:
format = "%s" format = "%s"
lbl = widgets.MarkupLabel(format % cgi.escape(title), lbl = widgets.MarkupLabel(format % escape(title),
x_align=1, y_align=.5) x_align=1, y_align=.5)
if self._config.get('preferences.releditbtn'): if self._config.get('preferences.releditbtn'):
lbl.set_padding(0, 5) lbl.set_padding(0, 5)
@ -1201,11 +1201,11 @@ class RelationshipView(NavigationView):
if birth and birth.get_type() != EventType.BIRTH: if birth and birth.get_type() != EventType.BIRTH:
sdate = get_date(birth) sdate = get_date(birth)
if sdate: if sdate:
bdate = "<i>%s</i>" % cgi.escape(sdate) bdate = "<i>%s</i>" % escape(sdate)
else: else:
bdate = "" bdate = ""
elif birth: elif birth:
bdate = cgi.escape(get_date(birth)) bdate = escape(get_date(birth))
else: else:
bdate = "" bdate = ""
@ -1213,11 +1213,11 @@ class RelationshipView(NavigationView):
if death and death.get_type() != EventType.DEATH: if death and death.get_type() != EventType.DEATH:
sdate = get_date(death) sdate = get_date(death)
if sdate: if sdate:
ddate = "<i>%s</i>" % cgi.escape(sdate) ddate = "<i>%s</i>" % escape(sdate)
else: else:
ddate = "" ddate = ""
elif death: elif death:
ddate = cgi.escape(get_date(death)) ddate = escape(get_date(death))
else: else:
ddate = "" ddate = ""
@ -1292,7 +1292,7 @@ class RelationshipView(NavigationView):
pass pass
def write_relationship(self, box, family): def write_relationship(self, box, family):
msg = _('Relationship type: %s') % cgi.escape(str(family.get_relationship())) msg = _('Relationship type: %s') % escape(str(family.get_relationship()))
box.add(widgets.MarkupLabel(msg)) box.add(widgets.MarkupLabel(msg))
def write_relationship_events(self, vbox, family): def write_relationship_events(self, vbox, family):