CiscoSystems/horizon — pull request #7 by MartinFalatic (2014-08-11 23:23:32+00:00)
Title: Sanitized drag-and-drop names to prevent XSS

This patch is a forward-port of a patch from puppet-coe-service-patch
which had the following commit message:

---

Revision: e682666e1d928b61e3f87927edd96ffa695ff344
Author: Daniel Park
Date: 7/22/2014 12:12:59 PM
Message:
DE610 - Sanitized drag-and-drop names to prevent XSS

https://us1.rallydev.com/#/20103531125d/detail/defect/20692523466

Chained a few more .replace() calls to properly santize drag-and-drop names for launching
Horizon instances and creating firewall names.
Also added escaping for email addresses. Please refer to the following bugs for more details:

[OSSA 2014-023] Stored XSS for /admin/users/ (CVE-2014-3475):
https://bugs.launchpad.net/horizon/+bug/1320235

[OSSA 2014-023] Persistent XSS in OpenStack Havana UI for Network Name (CVE-2014-3474):
https://bugs.launchpad.net/horizon/+bug/1322197

[OSSA 2014-023] XSS in Horizon Heat template - resource name (CVE-2014-3473):
https://bugs.launchpad.net/horizon/+bug/1308727

Based on https://review.openstack.org/#/c/105478/

Change-Id: I03546278f2309615393dbe005c09ecd6629452f5

---

Implements: rally-user-story US4145
Implements: rally-task TA3483
Not-in-upstream: true