Issue 1170 - [adblockplus.org Anwiki to CMS migration] Migrate content

filters/unescape.py

+def unescape(markup):

[Sebastian Noack, 2015/02/13 17:51:49]

As outlined were you use this filter, I don't think that we need it.

[kzar, 2015/02/20 14:55:18]

Unfortunately we do.

[kzar, 2015/02/20 17:04:48]

So I've just checked and there appear to be no locale strings with escaped HTML
saved in the locale files. There are however a couple of places[1] where we need
more HTML than is allowed by sitescripts.cms, sitescripts.cms escapes the HTML
and we then have to unescape it again before it's displayed.

Ultimately you're right we should remove the need for this, but I would prefer
to split that work off as a separate ticket and merge this first.

[1] Unescape filter is used in two places; for interface and preference
descriptions. Of those I can find in total 10 examples where the filter makes a
difference.

[Sebastian Noack, 2015/02/20 17:49:38]

You are right, the "translate" template filter escapes everything except <a>,
<strong> and <em> tags. I missed that, makes sense though. But if this isn't
enough, you have to change that implementation first.

We are not talking about an aesthetic issue here. You are potentially breaking
the website here. For example, imagine following string: "reviewer > author".
The "translate" filter will correctly turn it into "reviewer &gt; author". But
then you turn it back into "reviewer > author" breaking the generated HTML.

Not to mention that you enable translators to perform XSS attacks.

[kzar, 2015/02/20 18:00:43]

Well in for these two places there are sometimes descriptions that contain
links. Normally we can safely include links by only having the <a> tag itself in
the locale string and then passing the URLs as paramers from the page template.
But for preference and interface descriptions I don't think this is possible.

This is because we are using the preftable and interface includes for these
pages, to avoid having the link URLs in the locale strings we would need to
somehow either put them in the includes directly or in the pages that include
them.

So unless you can see another way to approach this I think we have the choice
between using this unescape filter and modifying the sitescripts.cms code to
allow <a> tags with the href attribute.

What do you think?

+  return markup.unescape()