New ticket screen does not escape entities in summary on preview

[anonymous]

Steps to reproduce: Go to the "create new ticket" screen, enter the following in the Short Summary box:

This summary "contains quotes"

Then hit the preview button. The preview will come up with only "This summary" in the short summary field - everything including and after the first quote dissapears, because it is not being escaped as html entities before display.

[Christopher Lenz]

Works for me in 0.8.

[Christopher Lenz]

Or not. Using ModPython the behavior is buggy as reported.

[Christopher Lenz]

(sorry for the spam)

[Christopher Lenz]

The culprit here is the function util.escape(). It checks whether its argument is really of type StringType and only then performs the escaping. When running under ModPython however, parameter values retrieved from the FieldStorage are of type mod_python.util.StringField, and thus don't get escaped at all!

The following patch fixes the issue by converting any argument to a string first. I'd like to get some feedback on whether this change might introduce any regressions before checking it in. Jonas?

Index: trac/util.py
===================================================================
--- trac/util.py	(revision 1020)
+++ trac/util.py	(working copy)
@@ -65,12 +65,10 @@
     """Escapes &, <, > and \""""
     if not text:
         return ''
-    if type(text) is StringType:
-        text = text.replace('&', '&') \
-               .replace('<', '<') \
-               .replace('>', '>') \
-               .replace('"', '"')
-    return text
+    return str(text).replace('&', '&') \
+                    .replace('<', '<') \
+                    .replace('>', '>') \
+                    .replace('"', '"')
 
 def get_first_line(text, maxlen):
     """

I'll also add the patch as attachment.

[Christopher Lenz]

Patch as described in previous comment

[Jonas Borgström]

Good question, I can't remember exactly why it is this way. Your patch is definitely the way to go, and I think we have a good chance of detecting any regressions before the release if the patch is applied now.

[Christopher Lenz]

Fixed in [1027].