Bug 565899: Make the html_linebreak filter safe by having it first call the

"html" filter
r=LpSolit, a=LpSolit

diff --git a/Bugzilla/Template.pm b/Bugzilla/Template.pm
index 71370a8c19f5b8714fd64e430948e579cc7d60cf..274ed8847376377be7005279952e8079f2d7a400 100644 (file)
--- a/Bugzilla/Template.pm
+++ b/Bugzilla/Template.pm
@@ -532,6 +532,7 @@ sub create {
             # See bugs 4928, 22983 and 32000 for more details
             html_linebreak => sub {
                 my ($var) = @_;
+                $var = html_quote($var);
                 $var =~ s/\r\n/\
/g;
                 $var =~ s/\n\r/\
/g;
                 $var =~ s/\r/\
/g;

diff --git a/t/008filter.t b/t/008filter.t
index e6ae4c13af8be1a443db50a5e3246421f8fbf4cb..5a5b223c8a22982f2845f51300ceb4f712df98a0 100644 (file)
--- a/t/008filter.t
+++ b/t/008filter.t
@@ -226,7 +226,7 @@ sub directive_ok {
     return 1 if $directive =~ /FILTER\ (html|csv|js|base64|url_quote|css_class_quote|
                                         ics|quoteUrls|time|uri|xml|lower|html_light|
                                         obsolete|inactive|closed|unitconvert|
-                                        txt|none)\b/x;
+                                        txt|html_linebreak|none)\b/x;
 
     return 0;
 }

diff --git a/template/en/default/global/code-error.html.tmpl b/template/en/default/global/code-error.html.tmpl
index f50f60737834b2610061cd6fea55290117e02d43..e3bd3ba8b0c9916a07086eeee12c8391e368e390 100644 (file)
--- a/template/en/default/global/code-error.html.tmpl
+++ b/template/en/default/global/code-error.html.tmpl
@@ -540,7 +540,7 @@
 </table>
 
 <p>Traceback:</p>
-<pre>[% traceback FILTER html FILTER html_linebreak %]</pre>
+<pre>[% traceback FILTER html_linebreak %]</pre>
 
 [% IF variables %]
   <pre>

diff --git a/template/en/default/global/hidden-fields.html.tmpl b/template/en/default/global/hidden-fields.html.tmpl
index 24f15c4f5e6413725403bd5239849ec7f1ea4d69..c141c640974b76b59f8b3e5e35025038c9c6c78f 100644 (file)
--- a/template/en/default/global/hidden-fields.html.tmpl
+++ b/template/en/default/global/hidden-fields.html.tmpl
@@ -52,7 +52,7 @@
   [% ELSE %]
     [% FOREACH mvalue = cgi.param(field).slice(0) %]
       <input type="hidden" name="[% field FILTER html %]"
-             value="[% mvalue FILTER html FILTER html_linebreak %]">
+             value="[% mvalue FILTER html_linebreak %]">
     [% END %]
   [% END %]
 [% END %]