481952 - Confirm attachment deletion page puts HTML in <title>

Status: RESOLVED FIXED

(Bugzilla :: Attachments & Requests, defect)

Description

[Reed Loden [:reed]]

Attachment: patch - v1

I was deleting an attachment on bmo the other day, and I noticed the <title> had a bunch of HTML in it. <title> shouldn't have HTML tags in it...

Untested patch attached.

Comment 1

[Frédéric Buclin]

Comment on attachment 366016 [details] [diff] [review]
patch - v1

>-  Delete Attachment [% a.id FILTER html %] of
>-  [%+ "$terms.Bug " _ a.bug_id FILTER bug_link(a.bug_id) FILTER none %]
>+  Delete Attachment [% a.id %] of [% terms.Bug %] [%+ a.bug_id %]

You must leave FILTER html alone, for both fields. Only bug_link() FILTER none must go away.

Comment 2

[Reed Loden [:reed]]

(In reply to comment #1)
> You must leave FILTER html alone, for both fields. Only bug_link() FILTER none
> must go away.

I removed the filters because of this code in bug/show.html.tmpl:
  [% PROCESS global/header.html.tmpl
    title = "$terms.Bug $bug.bug_id – $filtered_desc"

Why isn't that filtering the bug_id?

Comment 3

[Frédéric Buclin]

008filter.t doesn't catch unfiltered stuff in strings, only in BLOCKs. With your fix as is, Tinderbox is going to burn. We know .id and .bug_id should be safe, but I don't want additional stuff in filterexceptions.pl for just one line.

Comment 4

[Reed Loden [:reed]]

Attachment: patch - v2

Comment 5

[Frédéric Buclin]

Comment on attachment 366244 [details] [diff] [review]
patch - v2

r=LpSolit

Comment 6

[Reed Loden [:reed]]

tip:

Checking in template/en/default/attachment/confirm-delete.html.tmpl;
/cvsroot/mozilla/webtools/bugzilla/template/en/default/attachment/confirm-delete.html.tmpl,v  <--  confirm-delete.html.tmpl
new revision: 1.7; previous revision: 1.6
done

BUGZILLA-3_2-BRANCH:

Checking in template/en/default/attachment/confirm-delete.html.tmpl;
/cvsroot/mozilla/webtools/bugzilla/template/en/default/attachment/confirm-delete.html.tmpl,v  <--  confirm-delete.html.tmpl
new revision: 1.6.2.1; previous revision: 1.6
done