collective/dateable.chronos — pull request #1 by keul (2012-03-21 14:13:40+00:00)
Title: XSS attack spoil bug fixed

Hi, a customer security check of sites with p4a.calendar found that calling the month.html, week.html with evil parameters can expose the site to some kind of attack.

Two example:
* http://youthost/calendar/week.html?date= 2011-09-01'%0D%0AContent−Type: text/html%0D%0A
This raise an alert in the client window
* http://youthost/calendar/week.html?date= 2011-09-01'%0D%0AContent−Type: text/html%0D%0A;
This raise Zope ugly Zope errors.

As our customer use Plone 3.2, we restored also the Plone 3 compatibility. Seems that the use of try/except ImportError was not working (the import was succesfull also on Plone 3, but with bad results).