[SECURITY] Bug 313441: Query RSS should HTML-escape summary in <title> - Patch by Phil Ringnalda <philringnalda@gmail.com> r=myk a=justdave

I forgot to specify the bug number in my previous checkin. That was bug 312498.

3 files changed, 42 insertions, 51 deletions

diff --git a/template/en/default/global/header.html.tmpl b/template/en/default/global/header.html.tmpl
index 90c3659fe..959bf5a99 100644
--- a/template/en/default/global/header.html.tmpl
+++ b/template/en/default/global/header.html.tmpl
@@ -35,7 +35,7 @@
   # style: string. CSS style.
   # style_urls: list. List of URLs to CSS style sheets.
   # message: string. A message to display to the user. May contain HTML.
-  # rsslink: rss link url, May contain HTML
+  # atomlink: Atom link url, May contain HTML
   #%]
 
 [% IF message %]
@@ -100,11 +100,11 @@
       [% END %]
     [% END %]
 
-    [%# this puts the live bookmark up on firefox for the RSS feed %]
-    [% IF rsslink %]
+    [%# this puts the live bookmark up on firefox for the Atom feed %]
+    [% IF atomlink %]
        <link rel="alternate" 
-             type="application/rss+xml" title="RSS 1.0" 
-             href="[% rsslink FILTER html %]" />
+             type="application/atom+xml" title="Atom feed" 
+             href="[% atomlink FILTER html %]" />
     [% END %]
 
   </head>
diff --git a/template/en/default/list/list.rss.tmpl b/template/en/default/list/list.atom.tmpl
index cf6901bd7..367f2858f 100644
--- a/template/en/default/list/list.rss.tmpl
+++ b/template/en/default/list/list.atom.tmpl
@@ -19,8 +19,9 @@
   # Contributor(s): Walter Hoehn <wassa@columbia.edu>
   #                 John Belmonte <john@neggie.net>
   #                 Jason Remillard <jremillardshop@letterboxes.org>
+  #                 Phil Ringnalda <bugzilla@philringnalda.com>
   #
-  # This is a template for generating an RSS 1.0 representation of a buglist. 
+  # This is a template for generating an Atom representation of a buglist. 
   #%]
 
 [% PROCESS global/variables.none.tmpl %]
@@ -29,42 +30,32 @@
 [% DEFAULT title = "$terms.Bugzilla $terms.Bugs" %]
 
 <?xml version="1.0"[% IF Param('utf8') %] encoding="UTF-8"[% END %]?>
-<rdf:RDF xmlns:rdf="http://www.w3.org/1999/02/22-rdf-syntax-ns#" 
-         xmlns:sy="http://purl.org/rss/1.0/modules/syndication/"
-         xmlns:dc="http://purl.org/dc/elements/1.1/"
-         xmlns="http://purl.org/rss/1.0/">
-  <channel rdf:about="[% Param('urlbase') %]buglist.cgi?
-         [%- urlquerypart.replace('ctype=rss[&]?','') FILTER xml %]" >
-       
-    <title>[% title FILTER xml %]</title>
-    <description>[% "$terms.Bugzilla $terms.bug list" FILTER xml %]</description>
-    
-    <link>[% Param('urlbase') %]buglist.cgi?
-          [%- urlquerypart.replace('ctype=rss[&]?','') FILTER xml -%]
-    </link>
-    
-    <sy:updatePeriod>hourly</sy:updatePeriod>
-    <sy:updateFrequency>2</sy:updateFrequency>
-    
-    <items>
-      <rdf:Seq>
-      [% FOREACH bug = bugs %]
-        <rdf:li rdf:resource="[% Param('urlbase') FILTER xml %]show_bug.cgi?id=[% bug.bug_id FILTER xml %]" />
-      [% END %]
-      </rdf:Seq>
-    </items>
-    
-  </channel>
- 
+<feed xmlns="http://www.w3.org/2005/Atom">
+  <title>[% title FILTER xml %]</title>
+  <link rel="alternate" type="text/html"
+        href="[% Param('urlbase') %]buglist.cgi?
+        [%- urlquerypart.replace('ctype=atom[&]?','') FILTER xml %]"/>
+  <link rel="self" type="application/atom+xml"
+        href="[% Param('urlbase') %]buglist.cgi?
+        [%- urlquerypart FILTER xml %]"/>
+  <updated>[% date.format(format=>"%Y-%m-%dT%H:%M:%SZ",
+              time=>bugs.nsort('changedtime').last.changedtime,
+              gmt=>1) FILTER xml %]</updated>
+  <id>[% Param('urlbase') %]buglist.cgi?[% urlquerypart FILTER xml %]</id>
+
   [% FOREACH bug = bugs %]
-  <item rdf:about="[% Param('urlbase') FILTER xml %]show_bug.cgi?id=[% bug.bug_id FILTER xml %]">
-    <title>
-      [% "@" IF bug.secure_mode %] [[% terms.Bug %] [%+ bug.bug_id FILTER xml %]] [% bug.short_desc FILTER xml %]
-    </title>
-    <link>[% Param('urlbase') FILTER xml %]show_bug.cgi?id=[% bug.bug_id FILTER xml %]</link>
-    <dc:creator>[% bug.reporter_realname FILTER xml %]</dc:creator>
-    <dc:date>[% date.format(format=>"%Y-%m-%dT%H:%MZ",time=>bug.opentime,gmt=>1) FILTER xml %]</dc:date> 
-    <description>
+  <entry>
+    <title>[% "@" IF bug.secure_mode %][[% terms.Bug %] [%+ bug.bug_id FILTER xml %]] [% bug.short_desc FILTER xml %]</title>
+    <link rel="alternate" type="text/html"
+          href="[% Param('urlbase') FILTER xml %]show_bug.cgi?id=
+          [%- bug.bug_id FILTER xml %]"/>
+    <id>[% Param('urlbase') FILTER xml %]show_bug.cgi?id=[% bug.bug_id FILTER xml %]</id>
+    <author>
+      <name>[% bug.reporter_realname FILTER xml %]</name>
+    </author>
+    <updated>[% date.format(format=>"%Y-%m-%dT%H:%M:%SZ",time=>bug.changedtime,
+                gmt=>1) FILTER xml %]</updated> 
+    <summary type="html">
       [%# Filter out the entire block, so that we don't need to escape the html code out %]
       [% FILTER xml %]
       <table>
@@ -91,7 +82,7 @@
       </tr>
       </table>
       [% END %]
-    </description>
-  </item>
+    </summary>
+  </entry>
   [% END %]
-</rdf:RDF>
+</feed>
diff --git a/template/en/default/list/list.html.tmpl b/template/en/default/list/list.html.tmpl
index 85b7d7316..5ac715a0c 100644
--- a/template/en/default/list/list.html.tmpl
+++ b/template/en/default/list/list.html.tmpl
@@ -48,15 +48,15 @@
 [% PROCESS global/header.html.tmpl
   title = title
   style = style
-  rsslink = "buglist.cgi?$urlquerypart&title=$title&ctype=rss" 
+  atomlink = "buglist.cgi?$urlquerypart&title=$title&ctype=atom" 
 %]
 
 <div align="center">
-  [% IF Param('timezone') %]

-    <b>[% time2str("%a %b %e %Y %T %Z", currenttime, Param('timezone')) %]</b><br>

-  [% ELSE %]

-    <b>[% time2str("%a %b %e %Y %T", currenttime) %]</b><br>

-  [% END %]

+  [% IF Param('timezone') %]
+    <b>[% time2str("%a %b %e %Y %T %Z", currenttime, Param('timezone')) %]</b><br>
+  [% ELSE %]
+    <b>[% time2str("%a %b %e %Y %T", currenttime) %]</b><br>
+  [% END %]
 
   [% IF debug %]
     <p>
@@ -169,7 +169,7 @@
         [% urlquerypart FILTER html %]&amp;ctype=csv">CSV</a> |
         <a href="buglist.cgi?
         [% urlquerypart FILTER html %]&amp;title=
-        [%- title FILTER html %]&amp;ctype=rss">RSS</a> |
+        [%- title FILTER html %]&amp;ctype=atom">Feed</a> |
         <a href="buglist.cgi?
         [% urlquerypart FILTER html %]&amp;ctype=ics">iCalendar</a> |
         <a href="colchange.cgi?