[pve-devel] [PATCH] Fix escaping of XML attributes in cluster.conf [#686]

[Thomas Lamprecht]

This addresses the stable-3 branch in the pve-cluster package and fixes
https://bugzilla.proxmox.com/show_bug.cgi?id=686

On 08/20/2015 05:10 PM, Thomas Lamprecht wrote:
> When the cluster config XML gets written we escape the following
> characters in attributes: < > & "
> As the XML standard states, we only have to escape the characters
> " and ' in attributes. Whereas < > & have to be escaped in tags
> only. This addresses bug #686
>
> Signed-off-by: Thomas Lamprecht <t.lamprecht at proxmox.com>
> ---
>   data/PVE/Cluster.pm |    3 ---
>   1 file changed, 3 deletions(-)
>
> diff --git a/data/PVE/Cluster.pm b/data/PVE/Cluster.pm
> index 5a031cb..78b38ed 100644
> --- a/data/PVE/Cluster.pm
> +++ b/data/PVE/Cluster.pm
> @@ -1429,9 +1429,6 @@ sub xml_escape_attrib {
>   
>       return '' if !defined($data);
>   
> -    $data =~ s/&/&/sg;
> -    $data =~ s/</</sg;
> -    $data =~ s/>/>/sg;
>       $data =~ s/"/"/sg;
>   
>       return $data;