Support using <> lessthan/greater than characters in device description

[sgvfr]

Describe the bug

using Cacti 1.3

If using <> in a device description, the characters display as escape characters in dropdown menus

To Reproduce

Steps to reproduce the behavior:

1. edit a device description

2. include a less than or greater than symbol "< or >, <>"

3. go to "Management/Graphs"

4. display dropdown menu, if the device is "selected" it displays correctly, other devices show the escape characters for lt/gt

Expected behavior

Display lt/gt symbols in the device names while unselected in a dropdown menu.

Screenshots

[TheWitness]

Yea, we currently don't support this due to all the potential XSS and injection possibilities. So, I'm going to mark "will not fix" for now. Sorry about that. It might always change, but not before the 1.3 release.

[TheWitness]

Feel free to continue to comment.

[sgvfr]

Fair enough, can we move this to feature suggestion/enhancement instead of a bug?

[TheWitness]

Yea, I think so.

[netniV]

Personally, I think we should just not support this. Primarily because it imitates HTML tags.

[TheWitness]

There is a way to achieve that by performing a re-write of the html_escape() function using the library that our security researchers are recommending. But it's likely going to have to be in the develop branch due to the dependency to support the old RHEL7 stuff in 1.2.x Cacti version.