Escape link info on update

le717 · Aug 17, 2021 · 23a91c3 · 23a91c3
1 parent ed18a5e
commit 23a91c3
Show file tree

Hide file tree

Showing 3 changed files with 8 additions and 2 deletions.
diff --git a/CHANGES.md b/CHANGES.md
@@ -1,3 +1,9 @@
+# 1.0.3
+
+_Unreleased_
+
+- Escape link info on update
+
 # 1.0.2
 
 _Released August 16, 2021_

diff --git a/docker-compose.yml b/docker-compose.yml
@@ -12,5 +12,4 @@ services:
       - 127.0.0.1:5000:80
     environment:
       - FLASK_ENV=production
-      - SYS_VARS_PATH=/app/secrets
       - TIMES_FAILED_THRESHOLD=5
diff --git a/src/core/database/weblink.py b/src/core/database/weblink.py
@@ -61,7 +61,8 @@ def update(data: OrderedDict) -> bool:
         return False
 
     db.session.query(WebLink).filter_by(id=data["id"]).update(
-        data, synchronize_session="fetch"
+        {k: Markup(v).striptags() for k, v in data.items()},
+        synchronize_session="fetch",
     )
     db.session.commit()
     return True