snoopdave opened a new pull request, #231: URL: https://github.com/apache/roller/pull/231
Testing RC4 found that the blogroll showed entities on weblog pages: with the default `weblogAdminsUntrusted=true`, Roller stores a bookmark's name and description as sanitized HTML, and #221 escaped them again, so `Tom & Jerry's` showed as `Tom & Jerry's`. - The blogroll macro now shows bookmark names and descriptions as plain text: it removes tags, decodes entities and escapes the result once. - A bookmark with no description gets an empty `title`, not the previous bookmark's. - CHANGES.md says names and descriptions are shown as plain text. Tested on Jetty with bookmarks named `Tom & Jerry's`, `<b>Bold</b> link` and one with script and image tags in the name and description: each renders as plain text with no tags left in the page. No automated test covers the macro. -- This is an automated message from the Apache Git Service. To respond to the message, please log on to GitHub and use the URL above to go to the specific comment. To unsubscribe, e-mail: [email protected] For queries about this service, please contact Infrastructure at: [email protected]
