398838 - Remove the obsolete Util::value_quote() routine

Status: RESOLVED FIXED

(Bugzilla :: Bugzilla-General, enhancement)

Description

[Frédéric Buclin]

Attachment: patch, v1

value_quote() is nothing more than html_quote() with newlines removal (see bug 4928). We have a better clean_text() routine to handle such unwanted characters and we should use it. As you can see in the patch, only two places were still using it.

Comment 1

[Max Kanat-Alexander]

Comment on attachment 283830 [details] [diff] [review]
patch, v1

Sure. I don't even see why we need to clean_text them. We clean_text it on the way in--I don't see what security this is getting us.

Comment 2

[Frédéric Buclin]

(In reply to comment #1)
> (From update of attachment 283830 [details] [diff] [review])
> Sure. I don't even see why we need to clean_text them. We clean_text it on the
> way in

Input data can have newlines in them (editvalues.cgi doesn't prevent them), but tooltips shouldn't have any (Firefox displays a strange NL character when it sees one). That's the reason I call clean_text().

Comment 3

[Frédéric Buclin]

Checking in showdependencygraph.cgi;
/cvsroot/mozilla/webtools/bugzilla/showdependencygraph.cgi,v  <--  showdependencygraph.cgi
new revision: 1.63; previous revision: 1.62
done
Checking in Bugzilla/Template.pm;
/cvsroot/mozilla/webtools/bugzilla/Bugzilla/Template.pm,v  <--  Template.pm
new revision: 1.80; previous revision: 1.79
done
Checking in Bugzilla/Util.pm;
/cvsroot/mozilla/webtools/bugzilla/Bugzilla/Util.pm,v  <--  Util.pm
new revision: 1.61; previous revision: 1.60
done
Checking in t/007util.t;
/cvsroot/mozilla/webtools/bugzilla/t/007util.t,v  <--  007util.t
new revision: 1.9; previous revision: 1.8
done