Bug 1102842 - remove and/or unwhitelist unsafe filters. r=gerv, a=simon.

diff --git a/Bugzilla/Template.pm b/Bugzilla/Template.pm
index 26ef375859646346f93d98ef2ea3dff6492fa233..2b068dc2ce16175ada2f5f479cc13eb010222d3d 100644 (file)
--- a/Bugzilla/Template.pm
+++ b/Bugzilla/Template.pm
@@ -759,35 +759,6 @@ sub create {
         # built-in filter, please also add a stub filter to t/004template.t.
         FILTERS => {
 
-            # Render text in required style.
-
-            inactive => [
-                sub {
-                    my($context, $isinactive) = @_;
-                    return sub {
-                        return $isinactive ? '<span class="bz_inactive">'.$_[0].'</span>' : $_[0];
-                    }
-                }, 1
-            ],
-
-            closed => [
-                sub {
-                    my($context, $isclosed) = @_;
-                    return sub {
-                        return $isclosed ? '<span class="bz_closed">'.$_[0].'</span>' : $_[0];
-                    }
-                }, 1
-            ],
-
-            obsolete => [
-                sub {
-                    my($context, $isobsolete) = @_;
-                    return sub {
-                        return $isobsolete ? '<span class="bz_obsolete">'.$_[0].'</span>' : $_[0];
-                    }
-                }, 1
-            ],
-
             # Returns the text with backslashes, single/double quotes,
             # and newlines/carriage returns escaped for use in JS strings.
             js => sub {

diff --git a/t/004template.t b/t/004template.t
index b0ca5a629bb0a30aad1d06dd47fbcb652a32e142..6e366c0444f63708371b1ba544a035c723679592 100644 (file)
--- a/t/004template.t
+++ b/t/004template.t
@@ -74,9 +74,6 @@ foreach my $include_path (@include_paths) {
             no_break => sub { return $_; } ,
             js        => sub { return $_ } ,
             base64   => sub { return $_ } ,
-            inactive => [ sub { return sub { return $_; } }, 1] ,
-            closed => [ sub { return sub { return $_; } }, 1] ,
-            obsolete => [ sub { return sub { return $_; } }, 1] ,
             url_quote => sub { return $_ } ,
             css_class_quote => sub { return $_ } ,
             xml       => sub { return $_ } ,

diff --git a/t/008filter.t b/t/008filter.t
index fea018d439a398cb601acfab76f632f25eb3cd93..1f5219f719b600f0cb3a202e1c321a5f56d05434 100644 (file)
--- a/t/008filter.t
+++ b/t/008filter.t
@@ -210,9 +210,9 @@ sub directive_ok {
     # Note: If a single directive prints two things, and only one is 
     # filtered, we may not catch that case.
     return 1 if $directive =~ /FILTER\ (html|csv|js|base64|css_class_quote|ics|
-                                        quoteUrls|time|uri|xml|lower|html_light|
-                                        obsolete|inactive|closed|unitconvert|
-                                        txt|html_linebreak|markdown|none|null)\b/x;
+                                        quoteUrls|time|uri|xml|html_light|
+                                        unitconvert|txt|html_linebreak|markdown|
+                                        none|null)\b/x;
 
     return 0;
 }

diff --git a/template/en/default/account/prefs/prefs.html.tmpl b/template/en/default/account/prefs/prefs.html.tmpl
index 8f11d0a6ff893afa91b86c0d457a9e72cb3abc73..33c0b422454f4450b6434073b62fea8456a695ec 100644 (file)
--- a/template/en/default/account/prefs/prefs.html.tmpl
+++ b/template/en/default/account/prefs/prefs.html.tmpl
@@ -68,7 +68,7 @@
 
 [% IF changes_saved %]
   <div id="message">
-    The changes to your [% current_tab.label FILTER lower %] have been saved.
+    The changes to your [% current_tab.label FILTER lower FILTER html %] have been saved.
 
     [% IF email_changes_saved %]
       <p>

diff --git a/template/en/default/attachment/list.html.tmpl b/template/en/default/attachment/list.html.tmpl
index 4599f38ed6b7f37f3b3c07b9717668550967f218..2e160eda7c6f1ad997dc05dd9570fadc1eba6f48 100644 (file)
--- a/template/en/default/attachment/list.html.tmpl
+++ b/template/en/default/attachment/list.html.tmpl
@@ -70,7 +70,15 @@ function toggle_display(link) {
             <a href="attachment.cgi?id=[% attachment.id %]"
                title="View the content of the attachment">
           [% END %]
-          <b>[% attachment.description FILTER html FILTER obsolete(attachment.isobsolete) %]</b>
+          <b>
+            [% IF attachment.isobsolete %]
+              <span class="bz_obsolete">
+            [% END %]
+            [% attachment.description FILTER html %]
+            [% IF attachment.isobsolete %]
+              </span>
+            [% END %]
+          </b>
           [% "</a>" IF attachment.datasize %]
 
           <span class="bz_attach_extra_info">

diff --git a/template/en/default/attachment/show-multiple.html.tmpl b/template/en/default/attachment/show-multiple.html.tmpl
index e2c95cb80e73537c2c451a3703f74d71bf0e00f2..16d0933724b5d0cad8c4b237333860fcf9a48357 100644 (file)
--- a/template/en/default/attachment/show-multiple.html.tmpl
+++ b/template/en/default/attachment/show-multiple.html.tmpl
@@ -34,7 +34,15 @@
       <th colspan="6" class="bz_attach_footer">Attachment #[% a.id %]</th>
     </tr>
     <tr>
-      <td>[% a.description FILTER html FILTER obsolete(a.isobsolete) %]</td>
+      <td>
+        [% IF a.isobsolete %]
+          <span class="bz_obsolete">
+        [% END %]
+        [% a.description FILTER html %]
+        [% IF a.isobsolete %]
+          </span>
+        [% END %]
+      </td>
 
       <td>
         [% IF a.ispatch %]

diff --git a/template/en/default/bug/dependency-tree.html.tmpl b/template/en/default/bug/dependency-tree.html.tmpl
index a2730f3c91ab5def17c7a4f64b9ea536a528ae33..70855fdc221ddffe0f1e4071b030b45da379ecb5 100644 (file)
--- a/template/en/default/bug/dependency-tree.html.tmpl
+++ b/template/en/default/bug/dependency-tree.html.tmpl
@@ -136,7 +136,9 @@
 
 [% BLOCK buglink %]
   [% isclosed = !bug.isopened %]
-  [% FILTER closed(isclosed) -%]
+  [% IF isclosed %]
+    <span class="bz_closed">
+  [% END %]
     <a title="[% INCLUDE buginfo bug=bug %]"
        href="show_bug.cgi?id=[% bugid %]">
       <b>[%- bugid %]:</b>
@@ -148,6 +150,8 @@
       <img src="skins/standard/dependency-tree/tree.png"
            title="See dependency tree for [% terms.bug %] [%+ bugid FILTER html %]">
     </a>
+  [% IF isclosed %]
+    </span>
   [% END %]
 [% END %]
 

diff --git a/template/en/default/list/change-columns.html.tmpl b/template/en/default/list/change-columns.html.tmpl
index c0279803cce3d509965635c1e291f512c14d8f7f..aef352d0fc2d3523cd16c998c9ce11c6c3d8cc3a 100644 (file)
--- a/template/en/default/list/change-columns.html.tmpl
+++ b/template/en/default/list/change-columns.html.tmpl
@@ -31,7 +31,7 @@
 [% FOREACH column = columns.keys %]
   [% NEXT IF collist.contains(column) %]
   [%# We lowecase the keys so that the sort happens case-insensitively. %]
-  [% SET column_desc = field_descs.$column || column FILTER lower %]
+  [% SET column_desc = field_descs.$column || column FILTER lower FILTER html %]
   [% available_columns.$column_desc = column %]
 [% END %]
 

diff --git a/template/en/default/list/edit-multiple.html.tmpl b/template/en/default/list/edit-multiple.html.tmpl
index e581f0892ddc2c8c937a230f4dc5e6b9a82e83d3..d956fa62ba7187d023c98543876fe337e344d172 100644 (file)
--- a/template/en/default/list/edit-multiple.html.tmpl
+++ b/template/en/default/list/edit-multiple.html.tmpl
@@ -371,7 +371,13 @@
 
       <td>
         [% SET inactive = !group.is_active %]
-        [% group.description FILTER html_light FILTER inactive(inactive) %]
+        [% IF inactive %]
+          <span class="bz_inactive">
+        [% END %]
+        [% group.description FILTER html_light %]
+        [% IF inactive %]
+          </span>
+        [% END %]
       </td>
 
     </tr>
@@ -380,8 +386,8 @@
   </table>
 
   [% IF foundinactive %]
-    <p class="bz_info">(Note: [% terms.Bugs %] may not be added to [% FILTER inactive %]inactive
-    groups[% END %], only removed.)</p>
+    <p class="bz_info">(Note: [% terms.Bugs %] may not be added to inactive
+    groups, only removed.)</p>
   [% END %]
 
 [% END %]