From fdfee4b34c818c410dd586e86ab1dad99c2a5f4c Mon Sep 17 00:00:00 2001
From: Mark Sapiro <mark@msapiro.net>
Date: Sat, 1 Aug 2009 12:22:34 -0700
Subject: XSS protection in the web interface went too far in escaping HTML
entities. Fixed.
---
Mailman/Utils.py | 4 +++-
1 file changed, 3 insertions(+), 1 deletion(-)
(limited to 'Mailman')
diff --git a/Mailman/Utils.py b/Mailman/Utils.py
index b0eb2dd0..5cba077e 100644
--- a/Mailman/Utils.py
+++ b/Mailman/Utils.py
@@ -424,8 +424,10 @@ def check_global_password(response, siteadmin=True):
+_ampre = re.compile('&((?:#[0-9]+|[a-z]+);)', re.IGNORECASE)
def websafe(s):
- return cgi.escape(s, quote=True)
+ # Don't double escape html entities
+ return _ampre.sub(r'&\1', cgi.escape(s, quote=True))
def nntpsplit(s):
--
cgit v1.2.3