HTML "script" in ticket descriptions causes problems

[Juanma Barranquero]

Theoretically, HTML tags are escaped outside #!html blocks, but putting <script> alone in descriptions seems to wreak some havoc.

[Juanma Barranquero]

The easier way to see the problem is putting a script tag in a comment and clickin on "preview".

[cmlenz]

I can only reproduce this on Firefox (probably other mozilla-based browsers as well). IE6/Win and Safari do the right thing here.

Looking at the HTML generated, the script tag is getting escaped.

[Juanma Barranquero]

Not exactly; on previews, the script tag is quoted on the "Comment preview" textarea, but not in the "Comment" one.

IE/Win must be assuming that the script tag ends upon finding {{{

[Juanma Barranquero]

[sorry for the unfinished comment]

...upong finding the closing textarea tag, while Firefox does not, so it seems like both a Firefox and a Trac bug.

[cmlenz]

Fixed in [1095]. Should also be ported to the stable branch, but I'm lacking the necessary karma.