html processor trivially exploited to make pages completely unrenderable

[exarkun@…]

By adding an invalid entity inside a section of markup using the html processor, trac can be made to render an error page with no content and no buttons for undoing the damage. Presumably the page will remain in this state until an admin manually fixes the database.

An example of this is:

{{{
#!html
&junk;
}}}

[athomas]

A workaround is to manually append ?action=edit at the end of the URL. This will at least let you remove the offending HTML.

[cmlenz]

Fixed in [2969] and [2970].