admindb needs to escape message excerpt

Bug #265465 reported by Bug Importer
2
Affects Status Importance Assigned to Milestone
GNU Mailman
Invalid
Medium
Barry Warsaw

Bug Description

Symptom: Some pending posts are missing from admindb
display of pending posts. In my case, #1 -#6
displayed OK, #7 and #8 were missing, but #9 and #10
were OK.

Cause: The excerpt for #6 ended in the middle of a
commented-to-hide-from-old-browsers javascript
script. Both Netscape 4.7 and MSIE 5.5 for some
reason are looking for the comment close (-->), and
end up missing the </textarea>. The html for
processing messages #7 and #8 ended up in the excerpt
textarea for #6. Message #8 was another message with
javascript (can you tell I'm filtering for spam? :D),
only in this case, the entire script fit in the
excerpt, so the --> was found, and the </textarea> for
#8 closed off the textarea for #6. Message #9 then
appeared normally.

Fix: In admindb.py, in the TextArea function call for
the message excerpt, I replaced 'text' with 'cgi.escape
(text)' and that fixed the problem.

    John Van Essen <email address hidden>

[http://sourceforge.net/tracker/index.php?func=detail&aid=415847&group_id=103&atid=100103]

Tags: web-cgi
Revision history for this message
Barry Warsaw (barry) wrote :

Duplicate of #486340. Fixed in MM2.1 and MM2.0.9

To post a comment you must log in.
This report contains Public information  
Everyone can see this information.

Other bug subscribers

Remote bug watches

Bug watches keep track of this bug in other bug trackers.