Fixes cross-site scripting vulnerability caused by several cases of unescaped
message title and member full name leaking to HTML output.

diff -urN samizdat-0.6.1-orig/lib/samizdat/components/resource.rb samizdat-0.6.1-xss/lib/samizdat/components/resource.rb
--- samizdat-0.6.1-orig/lib/samizdat/components/resource.rb	2008-02-25 16:25:09.000000000 +0200
+++ samizdat-0.6.1-xss/lib/samizdat/components/resource.rb	2009-02-02 15:57:37.000000000 +0200
@@ -129,13 +129,13 @@
   # resource title (HTML-escaped)
   #
   def title
-    CGI.escapeHTML(limit_string(@title.to_s))
+    escape_title(@title.to_s)
   end
 
   # render resource as a list item
   #
   def list_item
-    resource(@id, @title, info)
+    resource(@id, title, info)
   end
 
   # short rendering of the resource
@@ -242,7 +242,7 @@
 
   def list_item
     if @message.nrelated > 0
-      resource(@id, Focus.focus_title(@title), info)
+      resource(@id, Focus.focus_title(title), info)
     else
       super
     end
@@ -325,7 +325,7 @@
         body << '<p>' <<
           sprintf(
             _('Account blocked by moderator: %s.'),
-            resource_href(blocked_by, CGI.escapeHTML(b_name))
+            resource_href(blocked_by, escape_title(b_name))
           ) << '</p>'
       end
     end
@@ -413,7 +413,7 @@
       (s::fullName ?member ?name)
       (s::voteRating #{@id} ?rating)}
     @info = sprintf(_('<a href="%s">%s</a> gave rating %4.2f to the <a href="%s">Statement %s</a> on %s.'),
-      @member, name, rating, @stmt, @stmt, format_date(date).to_s)
+      @member, escape_title(name), rating, @stmt, @stmt, format_date(date).to_s)
 
     @links['made'] = @member
   end
diff -urN samizdat-0.6.1-orig/lib/samizdat/controllers/message_controller.rb samizdat-0.6.1-xss/lib/samizdat/controllers/message_controller.rb
--- samizdat-0.6.1-orig/lib/samizdat/controllers/message_controller.rb	2008-02-25 13:49:18.000000000 +0200
+++ samizdat-0.6.1-xss/lib/samizdat/controllers/message_controller.rb	2009-02-02 15:58:50.000000000 +0200
@@ -19,7 +19,7 @@
 
   def source
     @message = Message.cached(@id)
-    @title = @message.content.title
+    @title = escape_title(@message.content.title)
     @content_for_layout = box(@title,
       form(nil,
         [:label, 'content', _('Content')],
@@ -438,7 +438,7 @@
 
     @title = _('Message Preview')
     @content_for_layout = box(
-      @message.content.title,
+      escape_title(@message.content.title),
       message(@message, :full) <<
         cut_warning.to_s <<
         '<p>' << _("Press 'Back' button to change the message.") << '</p>' <<
diff -urN samizdat-0.6.1-orig/lib/samizdat/controllers/resource_controller.rb samizdat-0.6.1-xss/lib/samizdat/controllers/resource_controller.rb
--- samizdat-0.6.1-orig/lib/samizdat/controllers/resource_controller.rb	2008-02-23 00:38:10.000000000 +0200
+++ samizdat-0.6.1-xss/lib/samizdat/controllers/resource_controller.rb	2009-02-02 15:59:34.000000000 +0200
@@ -16,7 +16,8 @@
 
     # special case: force untranslated title to go with full rendering of a message
     @title = ('Message' == @resource.type) ?
-      Message.cached(@id).content.title : @resource.title
+      escape_title(Message.cached(@id).content.title) :
+      @resource.title
 
     @links.update(@resource.links)
   end
diff -urN samizdat-0.6.1-orig/lib/samizdat/engine/helpers.rb samizdat-0.6.1-xss/lib/samizdat/engine/helpers.rb
--- samizdat-0.6.1-orig/lib/samizdat/engine/helpers.rb	2008-02-14 20:05:29.000000000 +0200
+++ samizdat-0.6.1-xss/lib/samizdat/engine/helpers.rb	2009-02-02 16:01:23.000000000 +0200
@@ -101,6 +101,12 @@
   end
 end
 
+# truncate _string_ to the title limit and escape HTML characters in it
+#
+def escape_title(string)
+  CGI.escapeHTML(limit_string(string))
+end
+
 # transform date to a standard string representation
 #
 def format_date(date)
diff -urN samizdat-0.6.1-orig/lib/samizdat/engine.rb samizdat-0.6.1-xss/lib/samizdat/engine.rb
--- samizdat-0.6.1-orig/lib/samizdat/engine.rb	2008-03-04 15:30:17.000000000 +0200
+++ samizdat-0.6.1-xss/lib/samizdat/engine.rb	2009-02-02 16:00:36.000000000 +0200
@@ -38,7 +38,7 @@
 
 # fix bug in standard cgi.rb
 def CGI::escapeHTML(string)
-  string.gsub(/&/n, '&amp;').gsub(/\"/n, '&quot;').gsub(/\'/n, '&apos;').gsub(/>/n, '&gt;').gsub(/</n, '&lt;')
+  string.gsub(/&/n, '&amp;').gsub(/\"/n, '&quot;').gsub(/\'/n, '&#39;').gsub(/>/n, '&gt;').gsub(/</n, '&lt;')
 end
 
 # add to_time() to String if it's not there
diff -urN samizdat-0.6.1-orig/lib/samizdat/helpers/message_helper.rb samizdat-0.6.1-xss/lib/samizdat/helpers/message_helper.rb
--- samizdat-0.6.1-orig/lib/samizdat/helpers/message_helper.rb	2008-02-23 11:46:36.000000000 +0200
+++ samizdat-0.6.1-xss/lib/samizdat/helpers/message_helper.rb	2009-02-02 16:00:10.000000000 +0200
@@ -39,7 +39,8 @@
   #
   def message_info(message, mode)
     creator = message.creator.id.nil? ?   # no link if published by guest
-      _('guest') : %{<a href="#{message.creator.id}">#{message.creator.full_name}</a>}
+      _('guest') :
+      %{<a href="#{message.creator.id}">#{escape_title(message.creator.full_name)}</a>}
     date = format_date(message.date)
 
     if :full == mode