Leopoldadmin/leocrm
1
0
Fork 0
Code Issues 363 Pull Requests Actions Packages Projects Releases 1 Wiki Activity

P0+P1 fixes: RCE sandbox, SQL injection, RLS tenant isolation, DB roles, test syntax, attachment, permission registry, membership check
Check Cross-Plugin Imports / check (push) Has been cancelled
Details

Browse Source
This commit is contained in:
Agent Zero
2026-07-29 12:28:08 +02:00
parent 81ae5b7cb6
commit 26bf8d3a31
12 changed files with 423 additions and 39 deletions
Download Patch File Download Diff File Expand all files Collapse all files
app/plugins/builtins/report_generator/routes.py
+5 -3
View File
@@ -77,10 +77,12 @@ def _report_to_response(r: ReportInstance) -> dict:
def _render_jinja2(template_content: str, data: dict) -> str:
"""Render a Jinja2 template string with the given data."""
from jinja2 import Environment, StrictUndefined
"""Render a Jinja2 template string with the given data (sandboxed)."""
from jinja2 import StrictUndefined
from jinja2.sandbox import SandboxedEnvironment
env = Environment(autoescape=False, undefined=StrictUndefined)
env = SandboxedEnvironment(autoescape=True, undefined=StrictUndefined)
env.globals.clear()
template = env.from_string(template_content)
return template.render(**data)