Bug 565899: Make the html_linebreak filter safe by having it first call the

Bugzilla/Template.pm

@@ -532,6 +532,7 @@ sub create {
             # See bugs 4928, 22983 and 32000 for more details
             html_linebreak => sub {
                 my ($var) = @_;
+                $var = html_quote($var);
                 $var =~ s/\r\n/\
/g;
                 $var =~ s/\n\r/\
/g;
                 $var =~ s/\r/\
/g;

t/008filter.t

@@ -226,7 +226,7 @@ sub directive_ok {
     return 1 if $directive =~ /FILTER\ (html|csv|js|base64|url_quote|css_class_quote|
                                         ics|quoteUrls|time|uri|xml|lower|html_light|
                                         obsolete|inactive|closed|unitconvert|
-                                        txt|none)\b/x;
+                                        txt|html_linebreak|none)\b/x;
 
     return 0;
 }

template/en/default/global/code-error.html.tmpl

@@ -540,7 +540,7 @@
 </table>
 
 <p>Traceback:</p>
-<pre>[% traceback FILTER html FILTER html_linebreak %]</pre>
+<pre>[% traceback FILTER html_linebreak %]</pre>
 
 [% IF variables %]
   <pre>

template/en/default/global/hidden-fields.html.tmpl

@@ -52,7 +52,7 @@
   [% ELSE %]
     [% FOREACH mvalue = cgi.param(field).slice(0) %]
       <input type="hidden" name="[% field FILTER html %]"
-             value="[% mvalue FILTER html FILTER html_linebreak %]">
+             value="[% mvalue FILTER html_linebreak %]">
     [% END %]
   [% END %]
 [% END %]