修复xss的问题,使用a标签代替js跳转

This commit is contained in:
virusdefender 2016-04-13 11:27:46 +08:00
parent 17131e8085
commit 20b51b70c3
2 changed files with 10 additions and 4 deletions

View File

@ -127,4 +127,11 @@ li.problem-tag {
#tfa-area{ #tfa-area{
display: none; display: none;
}
li.list-group-item>a{
display: inline;
padding: 0;
margin: 0;
} }

View File

@ -77,10 +77,9 @@
</div> </div>
<ul class="list-group"> <ul class="list-group">
{% for item in tags %} {% for item in tags %}
<li class="list-group-item problem-tag" <li class="list-group-item problem-tag">
onclick="location.href='/problems/?tag={{ item.name }}'"> <a href="/problems/?tag={{ item.name }}">{{ item.name }}</a>
<span class="badge">{{ item.problem_number }}</span> <span class="badge">{{ item.problem_number }}</span>
{{ item.name }}
</li> </li>
{% endfor %} {% endfor %}
</ul> </ul>