OpenUpSA / wazimap-ng

Backend for Wazimap-NG. See also https://github.com/OpenUpSA/wazimap-ng-ui/
https://geo.vulekamali.gov.za/
Apache License 2.0
11 stars 16 forks source link

Sanitize location admin action name to ignore format strings #416

Closed goyal1092 closed 2 years ago

goyal1092 commented 2 years ago

Description

In location admin we are using category name in action description It threw error if there was a % sing in name as python treated it as format string. Fixed by adding double % sign if % is present. https://stackoverflow.com/questions/26393895/python-how-to-escape-s/26393941#26393941 I think it's most feasible solution as we do not want to remove % sign

Related Issue

https://wazimap.atlassian.net/browse/WNCM-447

How to test it locally

Changelog

Added

Updated

Removed

Checklist

Pull Request

Commits

Code Quality

Testing

jbothma commented 2 years ago

Please add a test that verifies that a category with % in its name does indeed result in being rendered as % on the location list view to detect if/when they change this.

As far as I can tell, replacing % with %% should make this safe.

goyal1092 commented 2 years ago

Fixed failing test and added comment according jd's review @michaelglenister