merge RT 4.2.11 and Header changes to disable RT javascript, RT#34237

1 files changed, 11 insertions, 7 deletions

diff --git a/rt/share/html/Elements/MakeClicky b/rt/share/html/Elements/MakeClicky
index 4607ba092..4d28771e2 100644
--- a/rt/share/html/Elements/MakeClicky
+++ b/rt/share/html/Elements/MakeClicky
@@ -50,7 +50,7 @@ use Regexp::Common qw(URI);
 
 my $escaper = sub {
     my $content = shift;
-    RT::Interface::Web::EscapeUTF8( \$content );
+    RT::Interface::Web::EscapeHTML( \$content );
     return $content;
 };
 
@@ -61,15 +61,19 @@ my %actions = (
     },
     url => sub {
         my %args = @_;
+        my $post = "";
+        $post = ")" if $args{value} !~ /\(/ and $args{value} =~ s/\)$//;
         $args{value} = $escaper->($args{value});
-        my $result = qq{[<a target="new" href="$args{value}">}. loc('Open URL') .qq{</a>]};
-        return $args{value} . qq{ <span class="clickylink">$result</span>};
+        my $result = qq{[<a target="_blank" href="$args{value}">}. loc('Open URL') .qq{</a>]};
+        return $args{value} . qq{ <span class="clickylink">$result</span>$post};
     },
     url_overwrite => sub {
         my %args = @_;
+        my $post = "";
+        $post = ")" if $args{value} !~ /\(/ and $args{value} =~ s/\)$//;
         $args{value} = $escaper->($args{value});
-        my $result = qq{<a target="new" href="$args{value}">$args{value}</a>};
-        return qq{<span class="clickylink">$result</span>};
+        my $result = qq{<a target="_blank" href="$args{value}">$args{value}</a>};
+        return qq{<span class="clickylink">$result</span>$post};
     },
 );
 
@@ -144,14 +148,14 @@ if ( defined $cache ) {
 }
 
 unless ( $regexp ) {
-    RT::Interface::Web::EscapeUTF8( $content ) unless $html;
+    RT::Interface::Web::EscapeHTML( $content ) unless $html;
     return;
 }
 
 my $pos = 0;
 while ( $$content =~ /($regexp)/gsio ) {
     my $match = $1;
-    next if $` =~ /href=(?:&quot;|")$/;
+    next if $` =~ /\w+=(?:&quot;|")$/;
     my $skipped_len = pos($$content) - $pos - length($match);
     if ( $skipped_len > 0 ) {
         my $plain;