------------------------------------------------------------
revno: 1064
committer: Mark Sapiro <[email protected]>
branch nick: 2.2
timestamp: Sat 2009-08-01 12:25:41 -0700
message:
XSS protection in the web interface went too far in escaping HTML
entities. Fixed.
modified:
Mailman/Utils.py
NEWS
--
lp:mailman/2.2
https://code.launchpad.net/~mailman-coders/mailman/2.2
Your team Mailman Checkins is subscribed to branch lp:mailman/2.2.
To unsubscribe from this branch go to
https://code.launchpad.net/~mailman-coders/mailman/2.2/+edit-subscription.
=== modified file 'Mailman/Utils.py'
--- Mailman/Utils.py 2009-03-13 01:14:10 +0000
+++ Mailman/Utils.py 2009-08-01 19:25:41 +0000
@@ -425,8 +425,10 @@
+_ampre = re.compile('&((?:#[0-9]+|[a-z]+);)', re.IGNORECASE)
def websafe(s):
- return cgi.escape(s, quote=True)
+ # Don't double escape html entities
+ return _ampre.sub(r'&\1', cgi.escape(s, quote=True))
def nntpsplit(s):
=== modified file 'NEWS'
--- NEWS 2009-08-01 19:16:45 +0000
+++ NEWS 2009-08-01 19:25:41 +0000
@@ -72,6 +72,9 @@
Bug Fixes and other patches
+ - XSS protection in the web interface went too far in escaping HTML
+ entities. Fixed.
+
- Removed or anonymized additional headers in posts to anonymous lists.
- Fixed a bug that could cause incorrect threading of replies to archived
_______________________________________________
Mailman-checkins mailing list
[email protected]
Unsubscribe:
http://mail.python.org/mailman/options/mailman-checkins/archive%40jab.org
