623076 - Pretty-print (strip out HTML/markup) from summary/description until the user clicks Edit

Status: VERIFIED FIXED

(addons.mozilla.org Graveyard :: Developer Pages, defect)

Description

[Stephen Donner [:stephend] Not actively reading bugmail]

Attachment: Screenshot

We should pretty-print (i.e. strip-out the HTML tags/markup) on https://addons.allizom.org/z/en-US/developers/addon/a9-9331/edit

Right now, it looks like:

oh hai, here is some HTML: <a href="http://www.akamai.com">Akamai</a> <img src="http://www.lexus.com/lexus-share/images/gallery/models/IS/photos/exterior/g_ext1.jpg"> <b>Bold</b>

It should appear formatted and without tags, just as it would appear on the site, until the user clicks on Edit, in which case, all tags should be exposed.

Comment 1

[Jeff Balogh (:jbalogh)]

Beware the xss.

Comment 2

[Dave Dash [:davedash, :dd] (assign all bugs to mbrandt)]

http://github.com/jbalogh/zamboni/commit/271ec83

Not pleased with the __class__ bit, hoping we can change that later to something more sensible.

Comment 3

[Stephen Donner [:stephend] Not actively reading bugmail]

Verified FIXED; the pretty-print is now:

hi, here is some HTML:<img src=";<script>alert('hi');</script>

(Which is fine since there was an XSS attempt, which is now escaped.)