[#1478 Prevent DTML in comments only]

[email protected] (thimo) Fri, 21 Jan 2011 16:43:03 -0800

Newsgroups	gmane.comp.web.zope.zwiki
Message-ID	<20110121164301-0800__23681.9938444116$1295656993$gmane$org@longrun.zwiki.org>

I think it would be useful to prohibit DTML and the rst raw directive for comments.

It could be implemented by adding something like the following code to the method *comment* (and *append*?) of class *PageEditingSupport*:

::

        if re.search(r'(?i)(<dtml|&dtml)',text) or re.search(r'(?i)(<dtml|&dtml)',subject_heading) \
            or re.search(r'(?i)(\.\.\s*raw\s*::)',text) or re.search(r'(?i)(\.\.\s*raw\s*::)',subject_heading):
            return self.denied(
                _("Sorry, dynamic content is not allowed within comments."))

--
forwarded from http://longrun.zwiki.org/zwiki.org/1478PreventDTMLInCommentsOnly#[email protected]