BANNER_MAINTENANCE not allowing HTML #9548

Closed
opened 2025-12-29 20:51:19 +01:00 by adam · 2 comments
Owner

Originally created by @AnythingOverIP on GitHub (Apr 26, 2024).

Originally assigned to: @arthanson on GitHub.

Deployment Type

Self-hosted

NetBox Version

v3.7.6

Python Version

3.8

Steps to Reproduce

Modify configuration.py to enable Maintenance Mode:

# Setting this to True will display a "maintenance mode" banner at the top of every page.
MAINTENANCE_MODE = True
# This adds a banner to the top of every page when maintenance mode is enabled. HTML is allowed
BANNER_MAINTENANCE = 'System maintenance in progress: <b>READ ONLY</b> / Maintenance en cours: <b>LECTURE SEULEMENT</b>'

Expected Behavior

I would expect to have the HTML codes interpreted correctly (part of text above should be in bold).
This works in BANNER_LOGIN and BANNER_FOOTER, but not in BANNER_MAINTENANCE.

image

Observed Behavior

image

(results are similar using <strong>)

Originally created by @AnythingOverIP on GitHub (Apr 26, 2024). Originally assigned to: @arthanson on GitHub. ### Deployment Type Self-hosted ### NetBox Version v3.7.6 ### Python Version 3.8 ### Steps to Reproduce Modify configuration.py to enable Maintenance Mode: ``` # Setting this to True will display a "maintenance mode" banner at the top of every page. MAINTENANCE_MODE = True # This adds a banner to the top of every page when maintenance mode is enabled. HTML is allowed BANNER_MAINTENANCE = 'System maintenance in progress: <b>READ ONLY</b> / Maintenance en cours: <b>LECTURE SEULEMENT</b>' ``` ### Expected Behavior I would expect to have the HTML codes interpreted correctly (part of text above should be in bold). This works in BANNER_LOGIN and BANNER_FOOTER, but not in BANNER_MAINTENANCE. ![image](https://github.com/netbox-community/netbox/assets/25624251/2585b387-b8a1-4f12-b38f-2bb5d2b90564) ### Observed Behavior ![image](https://github.com/netbox-community/netbox/assets/25624251/d4377cb1-d6e4-459a-a2b3-81d4297eb76c) (results are similar using `<strong>`)
adam added the type: bugstatus: acceptedseverity: low labels 2025-12-29 20:51:19 +01:00
adam closed this issue 2025-12-29 20:51:19 +01:00
Author
Owner

@AnythingOverIP commented on GitHub (Apr 26, 2024):

I doubt this be a priority if not reproducible in 4.x... I haven`t had a chance to test with beta.

@AnythingOverIP commented on GitHub (Apr 26, 2024): I doubt this be a priority if not reproducible in 4.x... I haven`t had a chance to test with beta.
Author
Owner

@jeremystretch commented on GitHub (Apr 29, 2024):

It looks like the escape() filter was mistakenly applied to the content of BANNER_MAINTENANCE. We treat all other banner content (top, bottom, and login) as safe, to enable the injection of arbitrary HTML content.

@jeremystretch commented on GitHub (Apr 29, 2024): It looks like the `escape()` filter was mistakenly applied to the content of `BANNER_MAINTENANCE`. We treat all other banner content (top, bottom, and login) as safe, to enable the injection of arbitrary HTML content.
Sign in to join this conversation.
1 Participants
Notifications
Due Date
No due date set.
Dependencies

No dependencies set.

Reference: starred/netbox#9548