Pylons/deform — pull request #204 by dairiki (2014-03-02 22:36:46+00:00)
Title: Escape contents of RichTextWidgets

The content of the `` for `RichTextWidget`s is currently not being escaped. This can cause trouble if that content is not valid HTML, or if it comes from an untrusted source.

There is no reason not to escape the contents of the `<textarea>`, so this PR fixes that.

The `.tinymce-preload` span is problematic, since its contents can not be escaped. This PR copes as follows:

- If `delayed_load` is not enabled for the widget, simply omit the preload span, since it is not required.

- When `delayed_load` is enabled, we assume that any `appstruct` data is trusted, so it is interpolated without escaping. However, the delayed-load functionality is disabled upon error-redisplay if there is an error in the richtext field, since in this case a user-provided value (which did not pass validation) is being displayed.