From 7eb41e97540c719b7305875d701206b94661a264 Mon Sep 17 00:00:00 2001 From: mkg <1650473152@qq.com> Date: Wed, 13 Oct 2021 19:38:28 +0800 Subject: [PATCH] =?UTF-8?q?=E4=BF=AE=E8=A1=A5=E6=97=A5=E5=BF=97=E7=9A=84xs?= =?UTF-8?q?s=E6=BC=8F=E6=B4=9E?= MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit --- applications/common/admin_log.py | 9 +++++---- 1 file changed, 5 insertions(+), 4 deletions(-) diff --git a/applications/common/admin_log.py b/applications/common/admin_log.py index 1ef10dc..24a4373 100644 --- a/applications/common/admin_log.py +++ b/applications/common/admin_log.py @@ -1,5 +1,6 @@ from flask_login import current_user +from applications.common.utils.validate import xss_escape from applications.extensions import db from applications.models import AdminLog @@ -9,8 +10,8 @@ def login_log(request, uid, is_access): 'method': request.method, 'url': request.path, 'ip': request.remote_addr, - 'user_agent': request.headers.get('User-Agent'), - 'desc': request.form.get('username'), + 'user_agent': xss_escape(request.headers.get('User-Agent')), + 'desc': xss_escape(request.form.get('username')), 'uid': uid, 'success': int(is_access) @@ -35,8 +36,8 @@ def admin_log(request, is_access): 'method': request.method, 'url': request.path, 'ip': request.remote_addr, - 'user_agent': request.headers.get('User-Agent'), - 'desc': str(dict(request.values)), + 'user_agent': xss_escape(request.headers.get('User-Agent')), + 'desc': xss_escape(str(dict(request.values))), 'uid': current_user.id, 'success': int(is_access)