0008723: Bug text body is not escaped with htmlspecialchars()

ID	Project	Category	View Status	Date Submitted	Last Update
0008723	mantisbt	other	public	2008-01-08 12:59	2008-08-12 09:35

Reporter	Borszczuk	Assigned To	ryandesign
Priority	normal	Severity	minor	Reproducibility	always
Status	closed	Resolution	no change required
Product Version	1.1.0

Summary	0008723: Bug text body is not escaped with htmlspecialchars()
Description	Bug text body is not escaped with htmlspecialchars() which causes problems whenever user use "sharp brackets" or try to post some HTML code. The problem is in two files (I removed "sharp brackets" from code quotes): bug_view_page.php in line 342 which looks like: echo $t_bug->description; while it shall at least look like this: echo htmlspecialchars($t_bug->description); the same affects bug_view_advanced_page.php line 454, with the same bug and the same solution.
Tags	No tags attached.

Borszczuk 2008-01-08 13:00 reporter ~0016587	This note is for testing purposes to see if notes are affected as well (bug summary is not). I put some html code below (which shall for sure be escaped): This shall not be bold faced

Borszczuk 2008-01-08 13:01 reporter ~0016588	ok, notes are affected too.

Borszczuk 2008-01-08 14:54 reporter ~0016589	Ok, I now realised Mantis seem to store HTML [BR] instead of doing nl2br() each time. That seem to suck even more ;/ My "fixes" above are inaccurate due to that.

ryandesign 2008-01-08 16:28 reporter ~0016590	Not a bug. Behavior is intended. See the variable g_html_valid_tags in the configuration file, which by default is something like "p, li, ul, ol, br, pre, i, b, u" to allow those specific tags to be used. If you don't want those tags to be usable, remove them from g_html_valid_tags.

Borszczuk 2008-01-08 16:36 reporter ~0016591	Correct. Tweaking these paramters solves the issue. Shouldn't it be disabled by default as i.e. in Bugzilla, which does not handle them?

Borszczuk 2008-01-08 17:35 reporter ~0016593	But there's related bug anyway. I disabled all tags but still, on the "Most Active" on "Summary" screen tags are not escaped as expected

giallu 2008-01-16 16:05 reporter ~0016679	That is most likely my fault... please file another bug for it