Add another layer of protection by escaping the tags list should it
ever be displayed instead of the current error message.
Patch by fu.
diffs (37 lines):
diff -r f75385e5b9ce -r b5f2f90a3c9a bin/upgrading/en.dat
--- a/bin/upgrading/en.dat Mon Dec 20 00:15:28 2010 +0800
+++ b/bin/upgrading/en.dat Mon Dec 20 00:29:51 2010 +0800
@@ -3831,7 +3831,7 @@ taglib.error.mergenoname=You did not pro
taglib.error.mergetoexisting=The tag name '[[tagname]]' is already in use, but
you did not select it. Please select the tag or merge to a different tag name.
-taglib.error.toomany=This would make you exceed your maximum of [[max]] tags.
Please remove at least [[excess]] of the following new tags: [[tags]].
+taglib.error.toomany2=This would make you exceed your maximum of [[max]] tags.
Please remove at least [[excess]] of the following new tags: [[tags]].
talk.anonwrote=Someone wrote,
diff -r f75385e5b9ce -r b5f2f90a3c9a cgi-bin/LJ/Tags.pm
--- a/cgi-bin/LJ/Tags.pm Mon Dec 20 00:15:28 2010 +0800
+++ b/cgi-bin/LJ/Tags.pm Mon Dec 20 00:29:51 2010 +0800
@@ -834,8 +834,8 @@ sub update_logtags {
if (@to_create && $max && $max > 0) {
my $total = scalar(keys %$utags) + scalar(@to_create);
if ( $total > $max ) {
- return $err->(LJ::Lang::ml('taglib.error.toomany', { max => $max,
- tags =>
join(", ", @to_create),
+ return $err->(LJ::Lang::ml('taglib.error.toomany2', { max => $max,
+ tags =>
LJ::ehtml( join( ", ", @to_create ) ),
excess =>
$total - $max }));
}
}
@@ -1108,8 +1108,8 @@ sub create_usertag {
my $cur = scalar(keys %{ LJ::Tags::get_usertags($u) || {} });
my $tagtotal = $cur + scalar(@$tags);
if ($tagtotal > $max) {
- return $err->(LJ::Lang::ml('taglib.error.toomany', { max => $max,
- tags =>
join(", ", @$tags) ,
+ return $err->(LJ::Lang::ml('taglib.error.toomany2', { max => $max,
+ tags =>
LJ::ehtml( join( ", ", @$tags ) ) ,
excess =>
$tagtotal - $max }));
}
}
_______________________________________________
dw-changelog mailing list
[email protected]
http://lists.dwscoalition.org/mailman/listinfo/dw-changelog
