Repository navigation
Show blogroll names and descriptions as plain text - #231
Merged
Merged
Conversation
Roller can store a bookmark's name and description as sanitized HTML, so escaping them in the blogroll macro showed entities such as ' and " on weblog pages. The macro now removes tags, decodes entities and escapes the result once.
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Testing RC4 found that the blogroll showed entities on weblog pages: with the default
weblogAdminsUntrusted=true, Roller stores a bookmark's name and description as sanitized HTML, and #221 escaped them again, soTom & Jerry'sshowed asTom & Jerry's.title, not the previous bookmark's.Tested on Jetty with bookmarks named
Tom & Jerry's,<b>Bold</b> linkand one with script and image tags in the name and description: each renders as plain text with no tags left in the page. No automated test covers the macro.