Release 3.4.7 (#6878)

* attempt to fix travis

* fix some issues

* other fixes

* fix builds

* affect tests?

* add patch

* update bundle

* fix dependencies

* update version

.travis.yml

@@ -9,17 +9,20 @@ python:
 
 sudo: false
 
+services:
+  - mysql
+  - postgresql
+
 addons:
   apt:
     packages:
-    - enchant
+      - enchant
 
 cache:
   directories:
     - node_modules
     - $HOME/.pip/cache
 
-
 env:
   global:
     # coveralls
@@ -30,29 +33,27 @@ env:
     - secure: CbPfysSncBB2Ue+VOtLDa8xJvwKl73nJO647zt/9UvZ/3PilnZN9aZv2jHxGvCiFXcez+2AddKptMCcx/5EW5UfRkrWUDHrfLCULU2TfOjmufEGM1eOIXhiAun8WQ85LBzTAYy1r9D514cbU3Yzn3xGZwJljPE8JE4cx3MNN/qQ=
     # temporary solution until https://github.com/ariya/phantomjs/issues/13953 is resolved
     - PHANTOMJS_CDNURL=https://s3.amazonaws.com/aldryn-local-assets
+    # make sure travis jobs are recognised
+    - DJANGO=1.11
+
   matrix:
     - FRONTEND=1 UNIT=1
     - FRONTEND=1 LINT=1
     - FRONTEND=1 INTEGRATION=1 INTEGRATION_TESTS_BUCKET=1 DJANGO=1.11 DATABASE_URL='sqlite://localhost/testdb.sqlite'
     - FRONTEND=1 INTEGRATION=1 INTEGRATION_TESTS_BUCKET=2 DJANGO=1.11 DATABASE_URL='sqlite://localhost/testdb.sqlite'
     - FRONTEND=1 INTEGRATION=1 INTEGRATION_TESTS_BUCKET=3 DJANGO=1.11 DATABASE_URL='sqlite://localhost/testdb.sqlite'
-    - DJANGO=1.11 DATABASE_URL='sqlite://localhost/:memory:'
     - DJANGO=1.11 DATABASE_URL='mysql://[email protected]/djangocms_test'
     - DJANGO=1.11 DATABASE_URL='postgres://[email protected]/djangocms_test'
     - DJANGO=1.11 DATABASE_URL='postgres://[email protected]/djangocms_test' AUTH_USER_MODEL='emailuserapp.EmailUser'
     - DJANGO=1.11 DATABASE_URL='postgres://[email protected]/djangocms_test' AUTH_USER_MODEL='customuserapp.User'
-    - TEST_DOCS=1 DJANGO=1.10 DATABASE_URL='sqlite://localhost/:memory:'
-    - DJANGO=1.10 DATABASE_URL='sqlite://localhost/:memory:'
     - DJANGO=1.10 DATABASE_URL='mysql://[email protected]/djangocms_test'
     - DJANGO=1.10 DATABASE_URL='postgres://[email protected]/djangocms_test'
     - DJANGO=1.10 DATABASE_URL='postgres://[email protected]/djangocms_test' AUTH_USER_MODEL='emailuserapp.EmailUser'
     - DJANGO=1.10 DATABASE_URL='postgres://[email protected]/djangocms_test' AUTH_USER_MODEL='customuserapp.User'
-    - DJANGO=1.9 DATABASE_URL='sqlite://localhost/:memory:'
     - DJANGO=1.9 DATABASE_URL='mysql://[email protected]/djangocms_test'
     - DJANGO=1.9 DATABASE_URL='postgres://[email protected]/djangocms_test'
     - DJANGO=1.9 DATABASE_URL='postgres://[email protected]/djangocms_test' AUTH_USER_MODEL='emailuserapp.EmailUser'
     - DJANGO=1.9 DATABASE_URL='postgres://[email protected]/djangocms_test' AUTH_USER_MODEL='customuserapp.User'
-    - DJANGO=1.8 DATABASE_URL='sqlite://localhost/:memory:'
     - DJANGO=1.8 DATABASE_URL='mysql://[email protected]/djangocms_test'
     - DJANGO=1.8 DATABASE_URL='postgres://[email protected]/djangocms_test'
     - DJANGO=1.8 DATABASE_URL='postgres://[email protected]/djangocms_test' AUTH_USER_MODEL='emailuserapp.EmailUser'
@@ -65,7 +66,7 @@ before_script:
   - if [ "$DATABASE_URL" == "mysql://[email protected]/djangocms_test" ]; then mysql -e 'create database IF NOT EXISTS djangocms_test CHARACTER SET utf8 COLLATE utf8_general_ci;'; fi
 
 before_install:
-  - "export TRAVIS_COMMIT_MSG=\"$(git log --format=%B --no-merges -n 1)\""
+  - 'export TRAVIS_COMMIT_MSG="$(git log --format=%B --no-merges -n 1)"'
   - pip install -U "pip>=8.0,<18.0"
   - echo "$TRAVIS_COMMIT_MSG" | grep '\[skip saucelabs\]'; export USE_SAUCE_LABS=$?; true
   - echo "$TRAVIS_COMMIT_MSG" | grep '\[ci only docs\]'; export ONLY_DOCS=$?; true
@@ -99,7 +100,6 @@ notifications:
 
 matrix:
   exclude:
-
     - python: 2.7
       env: TEST_DOCS=1 DJANGO=1.10 DATABASE_URL='sqlite://localhost/:memory:'
     - python: 2.7
@@ -137,8 +137,6 @@ matrix:
     - python: 2.7
       env: FRONTEND=1 LINT=1
 
-    - python: 3.3
-      env: TEST_DOCS=1 DJANGO=1.10 DATABASE_URL='sqlite://localhost/:memory:'
     - python: 3.3
       env: DJANGO=1.11 DATABASE_URL='sqlite://localhost/:memory:'
     - python: 3.3
@@ -188,8 +186,6 @@ matrix:
     - python: 3.3
       env: FRONTEND=1 LINT=1
 
-    - python: 3.4
-      env: TEST_DOCS=1 DJANGO=1.10 DATABASE_URL='sqlite://localhost/:memory:'
     - python: 3.4
       env: DJANGO=1.11 DATABASE_URL='sqlite://localhost/:memory:'
     - python: 3.4
@@ -286,15 +282,19 @@ matrix:
     - python: 3.6
       env: FRONTEND=1 LINT=1
 
-
   allow_failures:
-
     - python: 2.7
       env: DJANGO=1.8 DATABASE_URL='mysql://[email protected]/djangocms_test'
 
+    - python: 3.3
+      env: TEST_DOCS=1 DJANGO=1.10 DATABASE_URL='sqlite://localhost/:memory:'
+
     - python: 3.4
       env: DJANGO=1.8 DATABASE_URL='mysql://[email protected]/djangocms_test'
 
+    - python: 3.4
+      env: TEST_DOCS=1 DJANGO=1.10 DATABASE_URL='sqlite://localhost/:memory:'
+
     - python: 3.5
       env: DJANGO=1.8 DATABASE_URL='mysql://[email protected]/djangocms_test'
 

CHANGELOG.txt

@@ -1,4 +1,4 @@
-=== 3.4.7 (unreleased) ===
+=== 3.4.7 (2020-07-21) ===
 
 * Removed extra quotation mark from the sideframe button template
 * Fixed a bug where xframe options were processed by clickjacking middleware
@@ -7,6 +7,7 @@
 * Fixed a bug where editing pages with primary keys greater than 9999 would throw an
   exception.
 * Fixed broken wizard page creation when no language is set within the template context (see #5828).
+* Fixed a security vulnerability in the plugin_type url parameter to insert JavaScript code.
 
 
 === 3.4.6 (2018-03-26) ===

cms/__init__.py

@@ -1,5 +1,5 @@
 # -*- coding: utf-8 -*-
 
-__version__ = '3.4.6'
+__version__ = '3.4.7'
 
 default_app_config = 'cms.apps.CMSConfig'

cms/admin/placeholderadmin.py

@@ -22,6 +22,7 @@
 from django.utils.six.moves.urllib.parse import parse_qsl, urlparse
 from django.utils.decorators import method_decorator
 from django.utils.encoding import force_text
+from django.utils.html import conditional_escape
 from django.utils import translation
 from django.utils.translation import ugettext as _
 from django.views.decorators.clickjacking import xframe_options_sameorigin
@@ -327,7 +328,7 @@ def add_plugin(self, request):
             # errors is s dict mapping fields to a list of errors
             # for that field.
             error = list(form.errors.values())[0][0]
-            return HttpResponseBadRequest(force_text(error))
+            return HttpResponseBadRequest(conditional_escape(force_text(error)))
 
         plugin_data = form.cleaned_data
         placeholder = plugin_data['placeholder_id']