liqd/adhocracy — pull request #203 by phihag (2013-02-04 13:53:23+00:00)
Title: Do not allow HTML input

As of f1632cca1160eae2f6e3b2612e26aada5d203760 (and before 13ab01a4488e4e2f8d396e913fee00bdb46adf88), instance administrators can inject arbitrary HTML into an application.

If relative_urls is on, this allows instance administrators to trivially execute JavaScript in the installation's origin.
But even if it's off, instance administrators can trivially:

* Steal users' session cookies (And vote as them in other instances!)
* Out-right ask users for their passwords.
* Switch out links to other parts of the UI

http://sectest.adhocracy.de/ demonstrates this (try clicking one of the navigation links).

Therefore, we should forbid HTML in instance and milestone texts. This pull request does exactly that.