diff --git a/webapp/auth/views.py b/webapp/auth/views.py index d4a7ad48..ef266575 100644 --- a/webapp/auth/views.py +++ b/webapp/auth/views.py @@ -61,12 +61,6 @@ def login(): else: return redirect(url_for(PAGE_INDEX)) - # log_info(f"request.url: {request.url}") - # if request.method == 'GET': - # log_info(f"GET: request.args: {request.args.to_dict()}") - # else: - # log_info(f"POST: request.form: {request.form.to_dict()}") - # Process POST form = LoginForm() if form.validate_on_submit(): @@ -74,8 +68,8 @@ def login(): if not is_whitelisted_username(username): flash(f'Username {username} is not authorized to log in to this server. Please contact ' 'support@edirepository.org if you believe you need access to this server.', 'error') + log_error(f'Non-whitelisted login attempt by {username}') return redirect(url_for(PAGE_LOGIN)) - # domain = form.domain.data # Never None domain = "edi" user_dn = 'uid=' + form.username.data + ',' + Config.DOMAINS[domain] password = form.password.data diff --git a/webapp/views/data_tables/templates/clone_attributes_4.html b/webapp/views/data_tables/templates/clone_attributes_4.html index 4f4b7f9a..02a43b89 100644 --- a/webapp/views/data_tables/templates/clone_attributes_4.html +++ b/webapp/views/data_tables/templates/clone_attributes_4.html @@ -37,12 +37,20 @@ select_default(this.id); }); } + function escapeSelector(selector) { + // There are a few characters that need to be escaped in a jQuery selector so they aren't interpreted as + // class selectors and the like. This function escapes those characters. + return selector.replace(/([!"#$%&'()*+,.\/:;<=>?@[\\\]^`{|}~])/g, '\\$1'); + } function select_default(_select_id) { // We need to replace spaces with underscores in the SELECT id for jQuery to work properly let select_id = _select_id.replace(/ /g, '_'); - let selector = '#' + select_id + ' option'; // Get rid of SELECT__ and __SELECT substrings let default_val = select_id.substring(8, select_id.length - 8); + // jQuery interprets '.' as a class selector, so we need to escape '.' with '\\'. + // There are various other chars that may be similarly problematic. We'll escape them all. + select_id = escapeSelector(select_id); + let selector = '#' + select_id + ' option'; $(selector).filter(function() { let this_text = $(this).text().replace(/ /g, '_'); return this_text === default_val;