Ive previously submitted a patch to improve the formatting of multiline properties in the emailed change note.... this patch improves the presentation of these properties in the history display.

This patch uses difflib to break the change into added and removed lines. removals are displayed in strikethrough, and additions are given a yellow highlight.

One aspect of this patch could use additional review..... The 'current' dictionary always originally stored the property values *after* being passed through cgi.escape, however this feature needs to calculate the diffs on unescaped strings, therefore the hyperdb.String case now stores unescaped strings in that dictionary. It is obviously critical that input strings do not leak into the ouput html stream without passing through cgi.escape.

The _ndiff_classes dict seems to be defined but not used.

I'm not immediately seeing why you need to pass unescaped strings to _string_history_diff. It seems like it would work just fine with escaped strings. Maybe if you explain my little brain will comprehend :)

Logged In: NO 


_ndiff_classes is used in _string_history_diff to generate css class names for each line based on whether it is an addition or deletion.

Re: moving the call to cgi.escape to the very end....

Yeah, I think what you suggest is probably safe. At the worst it would mean that difflib would produce a different set of changes (because of the way difflib resynchronises after a change). This relies on the cgi.escape making minimal changes. Would you like me to rework the patch?

- Toby (but not logged into sourceforge from this machine)

If you want to rework it that would be great. It would be nice to keep changes minimal and I don't think cgi.escape will confuse difflib too much.

If not, I'll get around to it eventually :)  

Hi,
just tried to see if the patch still applies to current hg tip.
It does with a few changes, see roundup_diffs_in_history-2013-05-16.diff.

I've ran the demo, but could not directly see the effects in the web interface
history for a regular issues.

Is there still interest in the patch? Can you describe what it does?
Justus proposed a change to make sure cgi.escape is used. So this would need to 
be checked anyway.

Ping, is anybody still interested in this, if not I'll close as as out
of date or abandoned in a month.

Closing as abandoned.