pearweb, HTML changelogs, moving forward

Hey all,
We need to make a decision regarding the future of Helgi's changelog
implementation and the bugtracker.

There's bugs:
http://pear.php.net/bugs/bug.php?id=16845
http://pear.php.net/bugs/bug.php?id=16671

and I had a bad moment with an XSS bug which was hard to tell if it was
exploitable or not at a glance.

My suggestions here:

   -
   - Alter the storage on the bug table, add a column:
   'rendered_html_changelog (text/varchar)'.
   - Remove all of the hacky searching of the comments, make sure they are
   rendered properly escaped.


   http://svn.php.net/viewvc/pear/pearweb/trunk/public_html/bugs/bug.php?view=markup#l1321

   IE:
       $search  = "</div>";
       $needle  = strrpos($comment, $search);
       if ($needle !== false) {
           $fix     = substr($comment, $needle + strlen($search)); // Get
   from last div until end of string
           $status  = substr($comment, 0, $needle) . $search;
       }

       $comment = htmlspecialchars($fix, ENT_QUOTES, 'UTF-8', false);
       $comment = make_ticket_links(addlinks(*clean*($comment)));
       $comment = $status . $comment;

   becomes:

   $comment = make_ticket_links(addlinks($row['comment']);
   $status = $row['rendered_html_changelog'];


   - Storing also writes to the appropriate new column
   - Measure the number of current bug reports with inline html changelogs,
   and *manually* migrate them (hurray for SQLYog) if the number is low
   (<100).

Thoughts? Flames?

IMO, this is a good balance between  keeping Pretty Changelogs and having to
implement a Bug Changelog table / migrate everything.