From b1ef63e5bfc0d3995245b42154686db1400b2c22 Mon Sep 17 00:00:00 2001
From: "lpsolit%gmail.com" <>
Date: Sun, 15 Oct 2006 03:26:50 +0000
Subject: =?UTF-8?q?Bug=20206037:=20[SECURITY]=20Fix=20escaping/quoting=20i?=
 =?UTF-8?q?n=20edit*.cgi=20scripts=20-=20Patch=20by=20Fr=C3=A9d=C3=A9ric?=
 =?UTF-8?q?=20Buclin=20<LpSolit@gmail.com>=20r=3Djustdave=20a=3Djustdave?=
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

---
 template/en/default/admin/groups/delete.html.tmpl | 2 +-
 template/en/default/admin/groups/edit.html.tmpl   | 2 +-
 template/en/default/admin/groups/list.html.tmpl   | 1 +
 3 files changed, 3 insertions(+), 2 deletions(-)

(limited to 'template/en/default/admin/groups')

diff --git a/template/en/default/admin/groups/delete.html.tmpl b/template/en/default/admin/groups/delete.html.tmpl
index d0c50f69a..f5aa7a9b4 100644
--- a/template/en/default/admin/groups/delete.html.tmpl
+++ b/template/en/default/admin/groups/delete.html.tmpl
@@ -48,7 +48,7 @@
   <tr>
     <td>[% gid FILTER html %]</td>
     <td>[% name FILTER html %]</td>
-    <td>[% description FILTER html %]</td>
+    <td>[% description FILTER html_light %]</td>
   </tr>
 </table>
 
diff --git a/template/en/default/admin/groups/edit.html.tmpl b/template/en/default/admin/groups/edit.html.tmpl
index 51aba7ffe..a66e78fde 100644
--- a/template/en/default/admin/groups/edit.html.tmpl
+++ b/template/en/default/admin/groups/edit.html.tmpl
@@ -165,7 +165,7 @@
             [% group.grpnam FILTER html %]
           </a>
         </td>
-        <td align="left" class="groupdesc">[% group.grpdesc FILTER html %]</td>
+        <td align="left" class="groupdesc">[% group.grpdesc FILTER html_light %]</td>
       </tr>
     [% END %]
   </table>
diff --git a/template/en/default/admin/groups/list.html.tmpl b/template/en/default/admin/groups/list.html.tmpl
index fe32bc53d..ef2c7486b 100644
--- a/template/en/default/admin/groups/list.html.tmpl
+++ b/template/en/default/admin/groups/list.html.tmpl
@@ -47,6 +47,7 @@
    }
    {name               => 'description'
     heading            => 'Description'
+    allow_html_content => 1
    }
    {name               => 'userregexp'
     heading            => 'User RegExp'
-- 
cgit v1.2.1