279368 - Some data is stored as HTML in database fields

Status: VERIFIED DUPLICATE of bug 333124

(addons.mozilla.org Graveyard :: Developer Pages, defect)

Description

[Alex Sirota (iosart)]

User-Agent:       Mozilla/5.0 (Windows; U; Windows NT 5.1; en-US; rv:1.7.5) Gecko/20041107 Firefox/1.0
Build Identifier: Mozilla/5.0 (Windows; U; Windows NT 5.1; en-US; rv:1.7.5) Gecko/20041107 Firefox/1.0

For example:
http://lxr.mozilla.org/mozilla/source/webtools/update/developers/commentsmanager.php#265

Two problems:
1. HTML is stored in the DB
2. The link includes UID which is an internal DB field. Mustn't be stored as
HTML, should be a separate field.

Todo: code review, to find all the places with similar issues.

Reproducible: Always

Steps to Reproduce:

Comment 1

[Mike Kroger]

I'm not sure if this is a related problem but...

Commenting on extensions/themes is now allowing HTML to get into the DB. I have a HUGE problem with spammers spamming my site and my forum, and many of them spam the AMO comments too.

I'm sure it won't be long before we start seeing comments like </a href="http://pornsite.com">Vely goot stuf hear!</a>

Comment 2

[Mike Shaver (:shaver emeritus)]

We strip from user-added comments now, which is the meat of the issue.  Storing HTML in the database is amoral. :)

*** This bug has been marked as a duplicate of 333124 ***