summaryrefslogtreecommitdiffstats
path: root/template/en/default/reports
diff options
context:
space:
mode:
authorlpsolit%gmail.com <>2006-10-15 05:26:50 +0200
committerlpsolit%gmail.com <>2006-10-15 05:26:50 +0200
commitb1ef63e5bfc0d3995245b42154686db1400b2c22 (patch)
tree0db4955b3303c2e5565d6e97e8fac62c63147117 /template/en/default/reports
parent40aae68e1263b9677285473a9205cef378b451c0 (diff)
downloadbugzilla-b1ef63e5bfc0d3995245b42154686db1400b2c22.tar.gz
bugzilla-b1ef63e5bfc0d3995245b42154686db1400b2c22.tar.xz
Bug 206037: [SECURITY] Fix escaping/quoting in edit*.cgi scripts - Patch by Frédéric Buclin <LpSolit@gmail.com> r=justdave a=justdave
Diffstat (limited to 'template/en/default/reports')
-rw-r--r--template/en/default/reports/components.html.tmpl4
-rw-r--r--template/en/default/reports/keywords.html.tmpl4
2 files changed, 4 insertions, 4 deletions
diff --git a/template/en/default/reports/components.html.tmpl b/template/en/default/reports/components.html.tmpl
index 1e9065a78..d135a7ef8 100644
--- a/template/en/default/reports/components.html.tmpl
+++ b/template/en/default/reports/components.html.tmpl
@@ -36,7 +36,7 @@
[% END %]
<p>
- [% product.description FILTER none %]
+ [% product.description FILTER html_light %]
</p>
<table>
@@ -87,7 +87,7 @@
</tr>
<tr>
<td colspan="[% numcols - 1 %]">
- [% comp.description FILTER none %]
+ [% comp.description FILTER html_light %]
</td>
</tr>
[% END %]
diff --git a/template/en/default/reports/keywords.html.tmpl b/template/en/default/reports/keywords.html.tmpl
index 979c50163..1a0ae0bf5 100644
--- a/template/en/default/reports/keywords.html.tmpl
+++ b/template/en/default/reports/keywords.html.tmpl
@@ -24,7 +24,7 @@
# keywords: array keyword objects. May be empty. Each has has four members:
# id: id of the keyword
# name: the name of the keyword
- # description: keyword description. May be HTML.
+ # description: keyword description. Can contain some limited HTML code.
# bug_count: number of bugs with that keyword
# caneditkeywords: boolean. True if this user can edit keywords
%]
@@ -55,7 +55,7 @@
<a name="[% keyword.name FILTER html %]">
[% keyword.name FILTER html %]</a>
</th>
- <td>[% keyword.description %]</td>
+ <td>[% keyword.description FILTER html_light %]</td>
<td align="center">
[% IF keyword.bug_count > 0 %]
<a href="buglist.cgi?keywords=[% keyword.name FILTER url_quote %]&amp;resolution=---">