InlineMultiCheckboxWidget renders unescaped JSON

[William Grant]

InlineMultiCheckboxWidget renders a whole lot of structures to JSON, then sticks them into a template tag with "structure", so they are left unescaped.

[Deryck Hodge (deryck)]

I can't reproduce this. I've been playing on a +recipe page on the dev server, after I created a recipe for one of the sample data branches. I've created a new distro series with the name "Foo <script>alert('gotcahs!');</script>" and the widget escapes that name on the page. I also hacked the doc test for the widget and see escaped tags.

Am I looking at the wrong page, the wrong widget, or is there somewhere else that uses this widget? Or else, how can I reproduce this?

[Curtis Hovey (sinzui)]

~wallyworld fixed the related bug 741639, perhaps we should assign the bug to him and mark it fixed released if we can verify his diff fixes the issue.

[Deryck Hodge (deryck)]

As we mentioned on IRC, I think the fix for displayname removes much danger from this, but I see now what William means about the use of structure in the bug report here. Seems a trivial fix to just remove the use of structure from the tal that build the js initializing the widget.

[Launchpad QA Bot (lpqabot)]

Fixed in stable r12921 <http://bazaar.launchpad.net/~launchpad-pqm/launchpad/stable/revision/12921>.