649109 - User formatting (line breaks) not retained for Why/who sections of blocklist detail

Status: VERIFIED FIXED

(addons.mozilla.org Graveyard :: Admin/Editor Tools, defect)

Description

[krupa raj[:krupa]]

steps to reproduce:
1. Add 3 paragraphs (with line breaks) to Why and who sections of the blocklist detail page @ https://addons.allizom.org/z/en-US/admin/models/blocklist/blocklistdetail/add/
2. Check the blocked detail page  @ https://addons.allizom.org/z/en-US/firefox/blocked/i40


observed behavior:
User formatting (line breaks) not retained for Why/ who sections of blocklist detail

Comment 1

[Jeff Balogh (:jbalogh)]

The field takes html.

Comment 2

[Wil Clouser [:clouserw]]

Was there a special request for HTML here?  The normal purification+nl2br would work just as well and be consistent with the rest of the site and it would let us get rid of the "|safe" stuff which we've been on the warpath about.  Even if the input is supposed to be safe here, less false positives would be good, right?

Comment 3

[Jeff Balogh (:jbalogh)]

(In reply to comment #2)
> Was there a special request for HTML here?

Yes (bug 629818 comment 2). I do like fewer false positives, though.

Comment 4

[Wil Clouser [:clouserw]]

(In reply to comment #3)
> (In reply to comment #2)
> > Was there a special request for HTML here?
> 
> Yes (bug 629818 comment 2). I do like fewer false positives, though.

Ah, I'm willing to say "HTML" in that context is our normal purified HTML which is pretty extensive.  I'm going to reopen this to convert to purification+nl2br.  

Sorry to keep dropping .5 bugs on you, but I've seen the .6 schedule and you'll be fine.  Thanks.

Comment 5

[Jeff Balogh (:jbalogh)]

https://github.com/jbalogh/zamboni/commit/1fbb832 

fligtar: you're limited to whatever HTML we allow elsewhere but links will not get outgoing'd.

Comment 6

[krupa raj[:krupa]]

Filed bug 649923. Verified at https://addons-next.allizom.org/en-US/firefox/blocked/i40