crits/crits — pull request #303 by wxsBSD (2014-11-10 04:11:01+00:00)
Title: Fix a potential problem with an editable field.

This is probably best described with an example.

Edit an event and give it a description with some HTML in it. I've been
using an img tag. When the data is submitted it is rendered in the page.
If the page is reloaded it is properly sanitized.

Fix this by returning the sanitized data from the editable call.

For testing I made an event, and gave it a description with img tags in
the event creation form. I then verified that the data is stored in the
database without the HTML entities (eg: ). When going to
view the page the tags are converted to the HTML entities and nothing is
rendered in my browser. This is normal behavior and expected.

I then edited the description, and put the HTML back in and upon submission
it would be rendered in the browser. I then put my change in place and
repeated and nothing is rendered. Also, with my change the contents
of the string in the databse is not changed. This is important because some
fields are converted in STIX documents and having the HTML entities would
likely break things.