mirror of
https://github.com/retspen/webvirtcloud
synced 2026-11-08 11:16:47 +00:00
d816d8d09f
The settings page took the posted theme name as it came and wrote it into the @import lines of wvc-main.scss and the compiled CSS: a name with "../" or a quote imported files outside the themes directory (CodeQL py/path-injection; the page is for superusers). The name must now be one of the directories in SASS_DIR/wvc-themes, the list the page already offers; anything else is refused with a message and nothing is written. themes_list is empty when SASS_DIR has no themes, so every name is refused then. Checked with the real dev/scss: flatly is applied and compiled as before, "../../etc" is refused and leaves the CSS alone. The test fails on the previous code.
108 lines
4 KiB
Python
108 lines
4 KiB
Python
import os
|
|
|
|
import sass
|
|
from admin.decorators import superuser_only
|
|
from django.contrib import messages
|
|
from django.http import HttpResponseRedirect
|
|
from django.shortcuts import render
|
|
from django.utils.translation import gettext_noop as _
|
|
from logs.views import addlogmsg
|
|
|
|
from appsettings.models import AppSettings
|
|
|
|
|
|
@superuser_only
|
|
def appsettings(request):
|
|
"""
|
|
:param request:
|
|
:return:
|
|
"""
|
|
main_css = "wvc-main.min.css"
|
|
sass_dir = AppSettings.objects.get(key="SASS_DIR")
|
|
bootstrap_theme = AppSettings.objects.get(key="BOOTSTRAP_THEME")
|
|
themes_list = []
|
|
try:
|
|
themes_list = os.listdir(sass_dir.value + "/wvc-themes")
|
|
except FileNotFoundError as err:
|
|
messages.error(request, err)
|
|
addlogmsg(request.user.username, "-", "", err)
|
|
|
|
# Bootstrap settings related with filesystems, because of that they are excluded from other settings
|
|
appsettings = AppSettings.objects.exclude(
|
|
description__startswith="Bootstrap"
|
|
).order_by("name")
|
|
|
|
if request.method == "POST":
|
|
if "SASS_DIR" in request.POST:
|
|
try:
|
|
sass_dir.value = request.POST.get("SASS_DIR", "")
|
|
sass_dir.save()
|
|
|
|
msg = _("SASS directory path is changed. Now: %(dir)s") % {
|
|
"dir": sass_dir.value
|
|
}
|
|
messages.success(request, msg)
|
|
except Exception as err:
|
|
msg = err
|
|
messages.error(request, msg)
|
|
|
|
addlogmsg(request.user.username, "-", "", msg)
|
|
return HttpResponseRedirect(request.get_full_path())
|
|
|
|
if "BOOTSTRAP_THEME" in request.POST:
|
|
theme = request.POST.get("BOOTSTRAP_THEME", "")
|
|
# the name goes into @import paths: only the themes in SASS_DIR
|
|
if theme not in themes_list:
|
|
messages.error(request, _("Unknown theme: %(theme)s") % {"theme": theme})
|
|
return HttpResponseRedirect(request.get_full_path())
|
|
scss_var = f"@import '{sass_dir.value}/wvc-themes/{theme}/variables';"
|
|
# scss_boot = f"@import '{sass_dir.value}/bootstrap/bootstrap.scss';"
|
|
scss_boot = f"@import '{sass_dir.value}/bootstrap-overrides.scss';"
|
|
scss_bootswatch = (
|
|
f"@import '{sass_dir.value}/wvc-themes/{theme}/bootswatch';"
|
|
)
|
|
|
|
try:
|
|
with open(sass_dir.value + "/wvc-main.scss", "w") as main:
|
|
main.write(
|
|
scss_var + "\n" + scss_boot + "\n" + scss_bootswatch + "\n"
|
|
)
|
|
|
|
css_compressed = sass.compile(
|
|
string=scss_var + "\n" + scss_boot + "\n" + scss_bootswatch,
|
|
output_style="compressed",
|
|
)
|
|
with open("static/css/" + main_css, "w") as css:
|
|
css.write(css_compressed)
|
|
|
|
bootstrap_theme.value = theme
|
|
bootstrap_theme.save()
|
|
|
|
msg = _("Theme is changed. Now: %(theme)s") % {"theme": theme}
|
|
messages.success(request, msg)
|
|
except Exception as err:
|
|
msg = err
|
|
messages.error(request, msg)
|
|
|
|
addlogmsg(request.user.username, "-", "", msg)
|
|
return HttpResponseRedirect(request.get_full_path())
|
|
|
|
for setting in appsettings:
|
|
if setting.key in request.POST:
|
|
try:
|
|
setting.value = request.POST.get(setting.key, "")
|
|
setting.save()
|
|
|
|
msg = _("%(setting)s is changed. Now: %(value)s") % {
|
|
"setting": setting.name,
|
|
"value": setting.value,
|
|
}
|
|
messages.success(request, msg)
|
|
except Exception as err:
|
|
msg = err
|
|
messages.error(request, msg)
|
|
|
|
addlogmsg(request.user.username, "-", "", msg)
|
|
return HttpResponseRedirect(request.get_full_path())
|
|
|
|
return render(request, "appsettings.html", locals())
|