Tickets :: Comment on [#7926] Message option "Show All Headers" causes error

* Your Email Address
* Spam protection	Enter the letters below: . . . .. . __. \| \| \|\ \|\|_/ (__ \|___\|___\| \\|\| \.__)
Comment	>>> You are right about the '&amp' trick - it is possible to put a > >>> superfluous one in an URL and it will skip the htmlentities() call. > >> > >> For what we do here, do you agree that escapeOnce (from > >> http://cvs.horde.org/co.php/framework/View/lib/Horde/View/Helper/Url.php?r=ccfd50278baa306abee1acd1b310a168f8ae4925) would >> work > >> instead? > > > > Not really following that code without any real-life context. But > theoretically, we really shouldn't be "fixing" double escaped > parameters when parsing a URL from form data. If double escaped > parameters exist at that point, either the generating code is broken > and should be fixed or something fishy is occurring. It might be > best to ignore those URLs completely and throw an exception or error > rather than trying to magically fix it.
Attachment
Watch this ticket