[Mailman-checkins] [Branch ~mailman-coders/mailman/2.1] Rev 1296: Strengthened escaping of user web data by including some characters that

[noreply]

------------------------------------------------------------
revno: 1296
committer: Mark Sapiro <msap...@value.net>
branch nick: 2.1
timestamp: Mon 2011-04-25 16:26:13 -0700
message:
  Strengthened escaping of user web data by including some characters that
  some older browsers misinterpret as < or >.
modified:
  Mailman/Utils.py
  NEWS


--
lp:mailman/2.1
https://code.launchpad.net/~mailman-coders/mailman/2.1

Your team Mailman Checkins is subscribed to branch lp:mailman/2.1.
To unsubscribe from this branch go to 
https://code.launchpad.net/~mailman-coders/mailman/2.1/+edit-subscription

=== modified file 'Mailman/Utils.py'
--- Mailman/Utils.py	2011-03-21 20:40:40 +0000
+++ Mailman/Utils.py	2011-04-25 23:26:13 +0000
@@ -425,7 +425,15 @@
 
 
 _ampre = re.compile('&amp;((?:#[0-9]+|[a-z]+);)', re.IGNORECASE)
+# Characters misinterpreted as < or > by some broken browsers.
+_broken_browser = {'\x8b': '&#8249;',
+                   '\x9b': '&#8250;',
+                   '\xbc': '&#188;',
+                   '\xbd': '&#190;',
+                  }
 def websafe(s):
+    for k in _broken_browser:
+        s = s.replace(k, _broken_browser[k])
     # Don't double escape html entities
     return _ampre.sub(r'&\1', cgi.escape(s, quote=True))
 

=== modified file 'NEWS'
--- NEWS	2011-04-25 22:40:16 +0000
+++ NEWS	2011-04-25 23:26:13 +0000
@@ -43,6 +43,9 @@
 
   Bug Fixes and other patches
 
+    - Strengthened escaping of user web data by including some characters that
+      some older browsers misinterpret as < or >.
+
     - Mailman now sets the 'secure' flag in cookies set via https URLs.
       Bug #770377.
 


_______________________________________________
Mailman-checkins mailing list
Mailman-checkins@python.org
Unsubscribe: 
http://mail.python.org/mailman/options/mailman-checkins/archive%40jab.org