Broken HTML escaping in many templates

[Shane Hathaway]

The page templates in KARL3 often use the ${foo} syntax provided by chameleon.zpt. In chameleon.zpt 1.0b9 and earlier, ${foo} is not HTML escaped, leading to many cross site scripting vulnerabilities. Starting with 1.0b10, ${foo} will be HTML escaped, which prevents most XSS vulnerabilities, but KARL3 has many templates that need to adapt to the change. We need to fix those templates, then update to the latest version of chameleon.zpt.

[Paul Everitt (paul-agendaless)]

Let's put this in the pile for next week, we're pretty loaded down for this week.

[Paul Everitt (paul-agendaless)]

For now, we'll reserve M11 Medium to mean: "things to get to feature completion"

[Paul Everitt (paul-agendaless)]

Chris switched the index to use the new Chameleon, as well as spending lots of time fixing the ${} syntax and layout breakage.

I'll mark this closed as we don't have any next step. If there is something broken, we'll make a new issue.