814841 - The description of custom fields is not filtered in the help page

Status: RESOLVED FIXED

(Bugzilla :: Bugzilla-General, defect)

Description

[Sony]

Attachment: error.jpg

User Agent: Mozilla/5.0 (Windows NT 6.1; rv:17.0) Gecko/17.0 Firefox/17.0
Build ID: 20121119183901

Steps to reproduce:

Hello,

some error in bugzilla again.

Use my login and password for test:

https://oj2xywb2bi6e.demo.bugzilla.org

user: [e-mail]

password: 1a2a3a


Actual results:

https://oj2xywb2bi6e.demo.bugzilla.org/editfields.cgi

https://oj2xywb2bi6e.demo.bugzilla.org/show_bug.cgi?id=18793

https://oj2xywb2bi6e.demo.bugzilla.org/page.cgi?id=fields.html 


Expected results:

only with admin account.

Comment 1

[Frédéric Buclin]

Field descriptions are not filtered on purpose to let admins format their text a bit, see bug 529201. As there is no reason to allow JS code here, we could replace FILTER none by FILTER html_light as we do everywhere else for field descriptions. But this is in no way a security bug as they are fully controlled by admins.

Comment 2

[Frédéric Buclin]

Actually, only 4.4 and newer are affected, since we implemented the "Long Description" attribute of custom fields, see bug 728138. 4.2 and older are not affected.

Comment 3

[Frédéric Buclin]

Attachment: patch, v1

Comment 4

[Sony]

Yes, i know, this bug not a security bug, but today i have a time for my hobby, and i found this error, if this not a interesting, next time i don't put this is here.

Comment 5

[Frédéric Buclin]

(In reply to Sony from comment #4)
> Yes, i know, this bug not a security bug, but today i have a time for my
> hobby, and i found this error, if this not a interesting, next time i don't
> put this is here.

I never said this isn't interesting. I said this isn't a security bug, and so there is no need to check the "Security" checkbox when reporting the bug. This is spamming the whole security team for something which is harmless. But because a bug is not considered a security issue doesn't mean we don't want to fix the problem. See, I uploaded a patch already. :)

Comment 6

[Sony]

Ok:) Thank you for the clarification!

Comment 7

[David Lawrence [:dkl]]

Comment on attachment 684843 [details] [diff] [review]
patch, v1

Review of attachment 684843 [details] [diff] [review]:
-----------------------------------------------------------------

r=dkl

Comment 8

[Frédéric Buclin]

Committing to: bzr+ssh://[e-mail]/bugzilla/trunk/
modified template/en/default/pages/fields.html.tmpl
Committed revision 8485.

Committing to: bzr+ssh://[e-mail]/bugzilla/4.4/
modified template/en/default/pages/fields.html.tmpl
Committed revision 8469.