edx/edx-ora — pull request #164 by waheedahmed (2014-01-27 10:01:28+00:00)
Title: Fixed img tags are allowed without filtering of their attributes.

ORA-255

Image tags are allowed without filtering of their attributes in feedback, when a feedback is passed to sanitize_html() here https://github.com/edx/edx-ora/blob/master/controller/util.py#L397-L404 then it will raise an exception:
"ValueError: It does not make sense to pass in both allow_tags and remove_unknown_tags"
because of remove_unknown_tags=True by default and in exception handling it will pass all text and html without filtering.