Edgewall Software
Modify

Opened 15 years ago

Closed 15 years ago

Last modified 15 years ago

#979 closed defect (fixed)

HTML "script" in ticket descriptions causes problems

Reported by: Juanma Barranquero Owned by: Christopher Lenz
Priority: normal Milestone: 0.8.1
Component: wiki system Version: 0.8
Severity: minor Keywords:
Cc: Branch:
Release Notes:
API Changes:

Description

Theoretically, HTML tags are escaped outside #!html blocks, but putting <script> alone in descriptions seems to wreak some havoc.

Attachments (0)

Change History (7)

comment:1 Changed 15 years ago by Juanma Barranquero

The easier way to see the problem is putting a script tag in a comment and clickin on "preview".

comment:2 Changed 15 years ago by Christopher Lenz

Version: devel0.8

I can only reproduce this on Firefox (probably other mozilla-based browsers as well). IE6/Win and Safari do the right thing here.

Looking at the HTML generated, the script tag is getting escaped.

comment:3 Changed 15 years ago by Juanma Barranquero

Not exactly; on previews, the script tag is quoted on the "Comment preview" textarea, but not in the "Comment" one.

IE/Win must be assuming that the script tag ends upon finding {{{

comment:4 Changed 15 years ago by Juanma Barranquero

[sorry for the unfinished comment]

…upong finding the closing textarea tag, while Firefox does not, so it seems like both a Firefox and a Trac bug.

comment:5 Changed 15 years ago by Christopher Lenz

Owner: changed from Jonas Borgström to Christopher Lenz
Status: newassigned

comment:6 Changed 15 years ago by Christopher Lenz

Resolution: fixed
Status: assignedclosed

Fixed in [1095]. Should also be ported to the stable branch, but I'm lacking the necessary karma.

comment:7 Changed 15 years ago by Christopher Lenz

Milestone: 0.8.1

Modify Ticket

Change Properties
Set your email in Preferences
Action
as closed The owner will remain Christopher Lenz.
The resolution will be deleted.
to The owner will be changed from Christopher Lenz to the specified user.

Add Comment


E-mail address and name can be saved in the Preferences .
 
Note: See TracTickets for help on using tickets.