Merge pull request #2763 from modoboa/fix/xss_fixes

Avoid XSS issues while deleting account and looking at logs.

modoboa/admin/static/admin/js/admin.js

@@ -408,7 +408,7 @@ Identities.prototype = {
         }
 
         $("a[name=delaccount]").confirm({
-            question: function() { return this.$element.attr('title'); },
+            question: function() { return htmlEncode(this.$element.attr('title')); },
             method: "POST",
             checkboxes: deloptions,
             success_cb: $.proxy(this.reload_listing, this)

modoboa/core/templates/core/logs_page.html

@@ -5,6 +5,6 @@
   <td>{{ l.date_created|date:"SHORT_DATETIME_FORMAT" }}</td>
   <td>{{ l.level|colorize_level|safe }}</td>
   <td>{{ l.logger }}</td>
-  <td>{{ l.message|tohtml|safe }}</td>
+  <td>{{ l.message }}</td>
 </tr>
 {% endfor %}

modoboa/static/js/autocompleter.js

@@ -56,7 +56,7 @@
             $.each(this.choices, $.proxy(function(index, value) {
                 if (exp.test(value)) {
                     this.$menu.append(
-                        $('<li><a href="#" name="' + value + '">' + value + '</a></li>')
+                        $('<li><a href="#" name="' + htmlEncode(value) + '">' + htmlEncode(value) + '</a></li>')
                     );
                 }
             }, this));