From 4d1c399ff6391b70e15a2c06d5bec10e2aaa3d3c Mon Sep 17 00:00:00 2001
From: Matt Selsky <selsky@columbia.edu>
Date: Thu, 11 Dec 2014 18:00:18 +0000
Subject: Bug 1102842 - remove and/or unwhitelist unsafe filters. r=gerv,
 a=simon.

---
 template/en/default/list/change-columns.html.tmpl |  2 +-
 template/en/default/list/edit-multiple.html.tmpl  | 12 +++++++++---
 2 files changed, 10 insertions(+), 4 deletions(-)

(limited to 'template/en/default/list')

diff --git a/template/en/default/list/change-columns.html.tmpl b/template/en/default/list/change-columns.html.tmpl
index c0279803c..aef352d0f 100644
--- a/template/en/default/list/change-columns.html.tmpl
+++ b/template/en/default/list/change-columns.html.tmpl
@@ -31,7 +31,7 @@
 [% FOREACH column = columns.keys %]
   [% NEXT IF collist.contains(column) %]
   [%# We lowecase the keys so that the sort happens case-insensitively. %]
-  [% SET column_desc = field_descs.$column || column FILTER lower %]
+  [% SET column_desc = field_descs.$column || column FILTER lower FILTER html %]
   [% available_columns.$column_desc = column %]
 [% END %]
 
diff --git a/template/en/default/list/edit-multiple.html.tmpl b/template/en/default/list/edit-multiple.html.tmpl
index e581f0892..d956fa62b 100644
--- a/template/en/default/list/edit-multiple.html.tmpl
+++ b/template/en/default/list/edit-multiple.html.tmpl
@@ -371,7 +371,13 @@
 
       <td>
         [% SET inactive = !group.is_active %]
-        [% group.description FILTER html_light FILTER inactive(inactive) %]
+        [% IF inactive %]
+          <span class="bz_inactive">
+        [% END %]
+        [% group.description FILTER html_light %]
+        [% IF inactive %]
+          </span>
+        [% END %]
       </td>
 
     </tr>
@@ -380,8 +386,8 @@
   </table>
 
   [% IF foundinactive %]
-    <p class="bz_info">(Note: [% terms.Bugs %] may not be added to [% FILTER inactive %]inactive
-    groups[% END %], only removed.)</p>
+    <p class="bz_info">(Note: [% terms.Bugs %] may not be added to inactive
+    groups, only removed.)</p>
   [% END %]
 
 [% END %]
-- 
cgit v1.2.3-24-g4f1b