< > in boinc_teams.xml <description> need to be HTML coded

[Ananas]

Currently everyone can mess up boinc_teams.xml or add dummy teams by just inserting the expected XML tags into his team description (starting with closing his own description), like :

</description>
<country>International</country>
<id>999</id>
<user_email_munged>UvfBja@rznvy.pbz</user_email_munged>
<user_name>HisOwnName</user_name>
</team>

<team>
... n records of data for fake teams ...
<description>
That was easy

So the description string needs to be HTML Entity encoded, at least &gt; and &lt; are necessary

[Ananas]

p.s.: I haven't tested that, it's from looking at the file contents and reading the code that extracts the records.

[davea]

(In [14240]) - user web: bug fix in moderation email send (fixes #485)

• BOINC-wide teams: HTML-escape user-supplied text (fixes #487)

[Nicolas]

Will existing projects' team_import break, until they upgrade?

[davea]

Yes - they'll get team names/descriptions with HTML-escaped chars. These will go back to normal when the project upgrades and runs team_import.php