Able to inject HTML tag / script on comments

[galupa]

Hi,

I want to report a bug on comments.
I am using 5.2 community edition and also have tested this on 6.2 community edition.
To reproduce:

1. go to any document detail page
2. create a comment with html tag
   For example:

   <div class="textLayer">
   test
   </div>
   

3. edit the comment
4. save without changing anything
5. The html tag will be part of the page (injected)

By using the example above, user shall not be able to click any top menu because of class="textLayer"

Probably a good idea to exclude class namespace because it can make the user mess up the UI accidentaly

Please let me know if you need more details.

Best Regards,
Rangga