From f77c9aa9279774d2a98829b743f07f19b3fc0ae7 Mon Sep 17 00:00:00 2001
From: Pierre-Yves Chibon <pingou@pingoured.fr>
Date: Jun 02 2015 11:34:50 +0000
Subject: [PATCH 1/2] convert_readme also returns if that readme is safe to display or not


---

diff --git a/pagure/ui/repo.py b/pagure/ui/repo.py
index ac0d5cc..4933eda 100644
--- a/pagure/ui/repo.py
+++ b/pagure/ui/repo.py
@@ -73,11 +73,12 @@ def view_repo(repo, username=None):
             pass
 
     readme = None
+    safe = False
     for i in tree:
         name, ext = os.path.splitext(i.name)
         if name == 'README':
             content = repo_obj[i.oid].data
-            readme = pagure.doc_utils.convert_readme(
+            readme, safe = pagure.doc_utils.convert_readme(
                 content, ext,
                 view_file_url=flask.url_for(
                     'view_raw_file', username=username,
@@ -123,6 +124,7 @@ def view_repo(repo, username=None):
         repo_obj=repo_obj,
         username=username,
         readme=readme,
+        safe=safe,
         branches=sorted(repo_obj.listall_branches()),
         branchname='master',
         last_commits=last_commits,

From 9d93e4c2b900104b5d2a10411f4e81038aafbd4a Mon Sep 17 00:00:00 2001
From: Pierre-Yves Chibon <pingou@pingoured.fr>
Date: Jun 02 2015 11:35:22 +0000
Subject: [PATCH 2/2] Adjust how we display the README page to avoid XSS


---

diff --git a/pagure/templates/repo_info.html b/pagure/templates/repo_info.html
index 5be6bca..681dd14 100644
--- a/pagure/templates/repo_info.html
+++ b/pagure/templates/repo_info.html
@@ -161,7 +161,11 @@
 
   {% if readme %}
   <section class="readme">
-    {{ readme |safe }}
+    {% if safe %}
+      {{ readme | noJS |safe }}
+    {% else %}
+      {{ readme | noJS }}
+    {% endif %}
   </section>
   {% endif %}