To comment on the following update, log in, then open the issue: http://www.openoffice.org/issues/show_bug.cgi?id=66821
------- Additional comments from [EMAIL PROTECTED] Sun Oct 29 22:44:10 -0700 2006 ------- Let me repatriate we don't consider this issue to be an defect. We had block this feature due to the serious implications on the site whereby you to disable _all_ of XSS filtering across the entire site,opening up scripting vulnerabilities and/or potential rendering issues. The alternative(s) at this point is a one-off/instance-set. This could be include either of these general ideas: 1. An override to the mailer viewer velocity template(s) to get rid of the escaping during message viewing. Consequence: makes this area vulnerable to XSS since what the browser is interpreting is user-defined data. 2. Override our Filter (Turbine) and create a new one this new filter could escape _only_ those individual tags deemed in proper. Consequence: We don't believe there is a way for the filter to limit the new filtering scheme to the mail reader. All other parts of CEE would be subject to the new escaping scheme. Analyzing each tag would mean that much extra processing time for every tag on every single page served across the App. This _could_ imply performance degradation. Please get back to us on the options which you would prefer . --------------------------------------------------------------------- Please do not reply to this automatically generated notification from Issue Tracker. Please log onto the website and enter your comments. http://qa.openoffice.org/issue_handling/project_issues.html#notification --------------------------------------------------------------------- To unsubscribe, e-mail: [EMAIL PROTECTED] For additional commands, e-mail: [EMAIL PROTECTED] --------------------------------------------------------------------- To unsubscribe, e-mail: [EMAIL PROTECTED] For additional commands, e-mail: [EMAIL PROTECTED]
