html in listinfo is quoted

[Barry Warsaw]

If you enter html into the 'info' text area, the
listinfo page sees that html as quoted, not as valid
html. This is a result of the XSS hole closure in
2.1.4, but some innocent tags should be allowed back in.

[http://sourceforge.net/tracker/index.php?func=detail&aid=870028&group_id=103&atid=100103]

[Hertell (hertell)]

The same goes if you use Umlauts (åäö, or ¨ å
ö) in the welcome-tect text-area. First it converts the
Umlaut-character to an decimal reference (&#228), and after
that it converts the & character into an Character entity.

In other words; when the user gets the welcome-email that
contains ä characters (ä), it is converted twice: This
is the code-soup for this character that finally arives:
ä instead of the single ä character

[Hertell (hertell)]

I tracked down the encoding-problem to the following row in
Defaults.py:
add_language('en', _('English (USA)'), 'us-ascii')

By changing the encoding to iso-8859-1 fixes the problem.
add_language('en', _('English (USA)'), 'iso-8859-1')

You probably ask why I don't use the admin-pages in my local
language? The ansver is that I prefer English before
anything else.

[Barry Warsaw (barry)]

The original bug is now fixed in cvs, for 2.1.5.

The one that hertell describes is not so much a bug but a
byproduct of the design. If you want to include non-ascii
characters in the welcome text, then you have to switch to a
language that includes those characters in its encoding,
enter them, then switch back to English.