365520 - attachment/edit has unescaped &

Status: RESOLVED FIXED

(Bugzilla :: User Interface, defect)

Description

[victory <[e-mail]>]

'attachment.cgi?id=[% attachment.id %]&action=diff&headers=0';

         | <a href="attachment.cgi?id=[% attachment.id %]&action=diff">Diff</a>

          | <a href="attachment.cgi?id=[% attachment.id %]&action=delete">Delete</a>

Comment 1

[victory <[e-mail]>]

Attachment: patch for tip

Comment 2

[Dave Miller [:justdave]]

Comment on attachment 250312 [details] [diff] [review]
patch for tip

The first one is inside a <script> element. The contents of <script> are exempt from needing to be escaped.  See http://www.w3.org/TR/html401/types.html#type-script

Comment 3

[Dave Miller [:justdave]]

Attachment: Patch v2

Same patch without the script part.