From: Matt Selsky <selsky@columbia.edu>
Date: Thu, 11 Dec 2014 18:00:18 +0000 (+0000)
Subject: Bug 1102842 - remove and/or unwhitelist unsafe filters. r=gerv, a=simon.
X-Git-Tag: release-5.1.1~423
X-Git-Url: http://git.ipfire.org/cgi-bin/gitweb.cgi?a=commitdiff_plain;h=4d1c399ff6391b70e15a2c06d5bec10e2aaa3d3c;p=thirdparty%2Fbugzilla.git

Bug 1102842 - remove and/or unwhitelist unsafe filters. r=gerv, a=simon.
---

diff --git a/Bugzilla/Template.pm b/Bugzilla/Template.pm
index 26ef375859..2b068dc2ce 100644
--- a/Bugzilla/Template.pm
+++ b/Bugzilla/Template.pm
@@ -759,35 +759,6 @@ sub create {
         # built-in filter, please also add a stub filter to t/004template.t.
         FILTERS => {
 
-            # Render text in required style.
-
-            inactive => [
-                sub {
-                    my($context, $isinactive) = @_;
-                    return sub {
-                        return $isinactive ? '<span class="bz_inactive">'.$_[0].'</span>' : $_[0];
-                    }
-                }, 1
-            ],
-
-            closed => [
-                sub {
-                    my($context, $isclosed) = @_;
-                    return sub {
-                        return $isclosed ? '<span class="bz_closed">'.$_[0].'</span>' : $_[0];
-                    }
-                }, 1
-            ],
-
-            obsolete => [
-                sub {
-                    my($context, $isobsolete) = @_;
-                    return sub {
-                        return $isobsolete ? '<span class="bz_obsolete">'.$_[0].'</span>' : $_[0];
-                    }
-                }, 1
-            ],
-
             # Returns the text with backslashes, single/double quotes,
             # and newlines/carriage returns escaped for use in JS strings.
             js => sub {
diff --git a/t/004template.t b/t/004template.t
index b0ca5a629b..6e366c0444 100644
--- a/t/004template.t
+++ b/t/004template.t
@@ -74,9 +74,6 @@ foreach my $include_path (@include_paths) {
             no_break => sub { return $_; } ,
             js        => sub { return $_ } ,
             base64   => sub { return $_ } ,
-            inactive => [ sub { return sub { return $_; } }, 1] ,
-            closed => [ sub { return sub { return $_; } }, 1] ,
-            obsolete => [ sub { return sub { return $_; } }, 1] ,
             url_quote => sub { return $_ } ,
             css_class_quote => sub { return $_ } ,
             xml       => sub { return $_ } ,
diff --git a/t/008filter.t b/t/008filter.t
index fea018d439..1f5219f719 100644
--- a/t/008filter.t
+++ b/t/008filter.t
@@ -210,9 +210,9 @@ sub directive_ok {
     # Note: If a single directive prints two things, and only one is 
     # filtered, we may not catch that case.
     return 1 if $directive =~ /FILTER\ (html|csv|js|base64|css_class_quote|ics|
-                                        quoteUrls|time|uri|xml|lower|html_light|
-                                        obsolete|inactive|closed|unitconvert|
-                                        txt|html_linebreak|markdown|none|null)\b/x;
+                                        quoteUrls|time|uri|xml|html_light|
+                                        unitconvert|txt|html_linebreak|markdown|
+                                        none|null)\b/x;
 
     return 0;
 }
diff --git a/template/en/default/account/prefs/prefs.html.tmpl b/template/en/default/account/prefs/prefs.html.tmpl
index 8f11d0a6ff..33c0b42245 100644
--- a/template/en/default/account/prefs/prefs.html.tmpl
+++ b/template/en/default/account/prefs/prefs.html.tmpl
@@ -68,7 +68,7 @@
 
 [% IF changes_saved %]
   <div id="message">
-    The changes to your [% current_tab.label FILTER lower %] have been saved.
+    The changes to your [% current_tab.label FILTER lower FILTER html %] have been saved.
 
     [% IF email_changes_saved %]
       <p>
diff --git a/template/en/default/attachment/list.html.tmpl b/template/en/default/attachment/list.html.tmpl
index 4599f38ed6..2e160eda7c 100644
--- a/template/en/default/attachment/list.html.tmpl
+++ b/template/en/default/attachment/list.html.tmpl
@@ -70,7 +70,15 @@ function toggle_display(link) {
             <a href="attachment.cgi?id=[% attachment.id %]"
                title="View the content of the attachment">
           [% END %]
-          <b>[% attachment.description FILTER html FILTER obsolete(attachment.isobsolete) %]</b>
+          <b>
+            [% IF attachment.isobsolete %]
+              <span class="bz_obsolete">
+            [% END %]
+            [% attachment.description FILTER html %]
+            [% IF attachment.isobsolete %]
+              </span>
+            [% END %]
+          </b>
           [% "</a>" IF attachment.datasize %]
 
           <span class="bz_attach_extra_info">
diff --git a/template/en/default/attachment/show-multiple.html.tmpl b/template/en/default/attachment/show-multiple.html.tmpl
index e2c95cb80e..16d0933724 100644
--- a/template/en/default/attachment/show-multiple.html.tmpl
+++ b/template/en/default/attachment/show-multiple.html.tmpl
@@ -34,7 +34,15 @@
       <th colspan="6" class="bz_attach_footer">Attachment #[% a.id %]</th>
     </tr>
     <tr>
-      <td>[% a.description FILTER html FILTER obsolete(a.isobsolete) %]</td>
+      <td>
+        [% IF a.isobsolete %]
+          <span class="bz_obsolete">
+        [% END %]
+        [% a.description FILTER html %]
+        [% IF a.isobsolete %]
+          </span>
+        [% END %]
+      </td>
 
       <td>
         [% IF a.ispatch %]
diff --git a/template/en/default/bug/dependency-tree.html.tmpl b/template/en/default/bug/dependency-tree.html.tmpl
index a2730f3c91..70855fdc22 100644
--- a/template/en/default/bug/dependency-tree.html.tmpl
+++ b/template/en/default/bug/dependency-tree.html.tmpl
@@ -136,7 +136,9 @@
 
 [% BLOCK buglink %]
   [% isclosed = !bug.isopened %]
-  [% FILTER closed(isclosed) -%]
+  [% IF isclosed %]
+    <span class="bz_closed">
+  [% END %]
     <a title="[% INCLUDE buginfo bug=bug %]"
        href="show_bug.cgi?id=[% bugid %]">
       <b>[%- bugid %]:</b>
@@ -148,6 +150,8 @@
       <img src="skins/standard/dependency-tree/tree.png"
            title="See dependency tree for [% terms.bug %] [%+ bugid FILTER html %]">
     </a>
+  [% IF isclosed %]
+    </span>
   [% END %]
 [% END %]
 
diff --git a/template/en/default/list/change-columns.html.tmpl b/template/en/default/list/change-columns.html.tmpl
index c0279803cc..aef352d0fc 100644
--- a/template/en/default/list/change-columns.html.tmpl
+++ b/template/en/default/list/change-columns.html.tmpl
@@ -31,7 +31,7 @@
 [% FOREACH column = columns.keys %]
   [% NEXT IF collist.contains(column) %]
   [%# We lowecase the keys so that the sort happens case-insensitively. %]
-  [% SET column_desc = field_descs.$column || column FILTER lower %]
+  [% SET column_desc = field_descs.$column || column FILTER lower FILTER html %]
   [% available_columns.$column_desc = column %]
 [% END %]
 
diff --git a/template/en/default/list/edit-multiple.html.tmpl b/template/en/default/list/edit-multiple.html.tmpl
index e581f0892d..d956fa62ba 100644
--- a/template/en/default/list/edit-multiple.html.tmpl
+++ b/template/en/default/list/edit-multiple.html.tmpl
@@ -371,7 +371,13 @@
 
       <td>
         [% SET inactive = !group.is_active %]
-        [% group.description FILTER html_light FILTER inactive(inactive) %]
+        [% IF inactive %]
+          <span class="bz_inactive">
+        [% END %]
+        [% group.description FILTER html_light %]
+        [% IF inactive %]
+          </span>
+        [% END %]
       </td>
 
     </tr>
@@ -380,8 +386,8 @@
   </table>
 
   [% IF foundinactive %]
-    <p class="bz_info">(Note: [% terms.Bugs %] may not be added to [% FILTER inactive %]inactive
-    groups[% END %], only removed.)</p>
+    <p class="bz_info">(Note: [% terms.Bugs %] may not be added to inactive
+    groups, only removed.)</p>
   [% END %]
 
 [% END %]