Tickets :: Comment on [#7926] Message option "Show All Headers" causes error

* Your Email Address
* Spam protection	Enter the letters below: .__. __.. ,.___. . \| \|(__ \./ \| \| \|__\.__) \| \| \__\|
Comment	>> Theoretically I agree. Realistically, though, we shouldn't be letting > >> through potentially unencoded data, but we also have this encoding > >> detection that tries to see if a URL is already html-entity encoded. > >> Do you see any way to reconcile that? > > > > I am not following you here... Are you talking about the current > code or potential future code? Because for current code, the only > reason the html-entity detection (&amp) detection is in there is to > allow successive calls to Util::addParameter() rather than any kind > of security checking.
Attachment
Watch this ticket