CKAN: Ticket Query

#1180: Links in markdown can be badly formed

dread — Tue, 07 Jun 2011 17:50:37 GMT

User can insert bad anchor tags into the User-About and Package-Notes fields and when you view them (web interface) it causes a 500 error.

Need to improve filtering for anchors in markdown.

<a href="http://xxxsex.com>nasty/website

Also check this related exception:

Module ckan.controllers.user:59 in read
<<          c.is_myself = user.name == c.user
               c.api_key = user.apikey
               c.about_formatted = self._format_about(user.about)
               revisions_q = model.Session.query(model.Revision
                       ).filter_by(author=user.name)
>>  c.about_formatted = self._format_about(user.about)
Module ckan.controllers.user:167 in _format_about
<<      def _format_about(self, about):
               about_formatted = ckan.misc.MarkdownFormat().to_html(about)
               return genshi.HTML(about_formatted)
           def _get_form_password(self):
>>  return genshi.HTML(about_formatted)
WebApp Error: <class 'genshi.input.ParseError'>: junk characters in start tag: u'\u201dhttp://www.settingu': line 1, column 3

#1187: Stop spam users with links in the 'about' field

dread — Wed, 15 Jun 2011 13:03:19 GMT

When you edit a user, you should be stopped from putting links in the 'about' field, because this is a common tactic by spammers.

#1191: Unicode in user password gives 500 error on user registration

dread — Fri, 17 Jun 2011 12:14:55 GMT

Create/register a user with a unicode character in the password. It creates the user, but the redirect to the user page doesn't work and results in 500 error.

#1196: Markdown logging ignores config settings

dread — Wed, 22 Jun 2011 11:51:16 GMT

Markdown produces Debug logging, even when the pylons logging config is set to level of Info or Warning. This clogs up the logfile.