From 4ed6e2af8c73e6ef4f1b479baa422e2642befdcd Mon Sep 17 00:00:00 2001
From: bwarsaw
Date: Fri, 30 Nov 2001 18:08:15 +0000
Subject: show_post_requests(): cgi.escape() the full text of the message
 excerpt so that it can't sneak in table breaking HTML or evil Javascript. 
 Fixes SF bug #486340.  Patch and report by Greg Lindahl.

---
 Mailman/Cgi/admindb.py | 3 ++-
 1 file changed, 2 insertions(+), 1 deletion(-)

diff --git a/Mailman/Cgi/admindb.py b/Mailman/Cgi/admindb.py
index 5541d415f..19474d1e3 100644
--- a/Mailman/Cgi/admindb.py
+++ b/Mailman/Cgi/admindb.py
@@ -332,7 +332,8 @@ def show_post_requests(mlist, id, info, total, count, form):
     row, col = t.GetCurrentRowIndex(), t.GetCurrentCellIndex()
     t.AddCellInfo(row, col-1, align='right')
     t.AddRow([Bold(_('Message Excerpt:')),
-              TextArea('fulltext-%d' % id, body, rows=10, cols=80)])
+              TextArea('fulltext-%d' % id, cgi.escape(body),
+                       rows=10, cols=80)])
     t.AddCellInfo(row+1, col-1, align='right')
     form.AddItem(t)
     form.AddItem('<p>')
-- 
cgit v1.3.1