updates after review:

Disable clients.config editing in UI
Strip single quotes too
Fix double-escaping in susimail folder page

apps/routerconsole/java/src/net/i2p/router/web/ConfigClientsHandler.java

@@ -187,6 +187,8 @@ public class ConfigClientsHandler extends FormHandler {
             if (! (RouterConsoleRunner.class.getName().equals(ca.className)))
                 ca.disabled = val == null;
             // edit of an existing entry
+            // disabled
+/****
             String desc = getJettyString("desc" + cur);
             if (desc != null) {
                 int spc = desc.indexOf(" ");
@@ -200,8 +202,11 @@ public class ConfigClientsHandler extends FormHandler {
                 ca.args = args;
                 ca.clientName = getJettyString("name" + cur);
             }
+****/
         }
 
+        // disabled
+/****
         int newClient = clients.size();
         String newDesc = getJettyString("desc" + newClient);
         if (newDesc != null && newDesc.trim().length() > 0) {
@@ -220,6 +225,7 @@ public class ConfigClientsHandler extends FormHandler {
             clients.add(ca);
             addFormNotice(_("New client added") + ": " + name + " (" + clss + ").");
         }
+****/
 
         ClientAppConfig.writeClientAppConfig(_context, clients);
         addFormNotice(_("Client configuration saved successfully"));

apps/routerconsole/java/src/net/i2p/router/web/ConfigClientsHelper.java

@@ -118,18 +118,18 @@ public class ConfigClientsHelper extends HelperBase {
                        //"webConsole".equals(ca.clientName) || "Web console".equals(ca.clientName),
                        false, RouterConsoleRunner.class.getName().equals(ca.className),
                        // description, edit
-                       ca.className + ((ca.args != null) ? " " + ca.args : ""), (""+cur).equals(_edit),
+                       ca.className + ((ca.args != null) ? " " + ca.args : ""), /* (""+cur).equals(_edit) */ false,
                        // show edit button, show update button
                        // Don't allow edit if it's running, or else we would lose the "handle" to the ClientApp to stop it.
-                       !showStop, false, 
+                       /* !showStop */ false, false, 
                        // show stop button
                        showStop,
                        // show delete button, show start button
                        !isConsole, showStart);
         }
         
-        if ("new".equals(_edit))
+        //if ("new".equals(_edit))
-            renderForm(buf, "" + clients.size(), "", false, false, false, false, "", true, false, false, false, false, false);
+        //    renderForm(buf, "" + clients.size(), "", false, false, false, false, "", true, false, false, false, false, false);
         buf.append("</table>\n");
         return buf.toString();
     }
@@ -291,9 +291,9 @@ public class ConfigClientsHelper extends HelperBase {
         if (showStopButton && (!edit))
             buf.append("<button type=\"submit\" class=\"Xstop\" name=\"action\" value=\"Stop ").append(index).append("\" >")
                .append(_("Stop")).append("<span class=hide> ").append(index).append("</span></button>");
-        if (showEditButton && (!edit) && !ro)
+        //if (showEditButton && (!edit) && !ro)
-            buf.append("<button type=\"submit\" class=\"Xadd\" name=\"edit\" value=\"Edit ").append(index).append("\" >")
+        //    buf.append("<button type=\"submit\" class=\"Xadd\" name=\"edit\" value=\"Edit ").append(index).append("\" >")
-               .append(_("Edit")).append("<span class=hide> ").append(index).append("</span></button>");
+        //       .append(_("Edit")).append("<span class=hide> ").append(index).append("</span></button>");
         if (showUpdateButton && (!edit) && !ro) {
             buf.append("<button type=\"submit\" class=\"Xcheck\" name=\"action\" value=\"Check ").append(index).append("\" >")
                .append(_("Check for updates")).append("<span class=hide> ").append(index).append("</span></button>");

apps/susimail/src/src/i2p/susi/webmail/WebMail.java

@@ -1670,7 +1670,7 @@ public class WebMail extends HttpServlet
 				} else if( sessionObject.state == STATE_SHOW ) {
 					Mail mail = sessionObject.mailCache.getMail(sessionObject.showUIDL, MailCache.FetchMode.HEADER);
 					if (mail != null && mail.shortSubject != null)
-						subtitle = quoteHTML(mail.shortSubject);
+						subtitle = mail.shortSubject; // already HTML encoded
 					else
 						subtitle = _("Show Message");
 				} else if( sessionObject.state == STATE_NEW ) {
@@ -2164,9 +2164,10 @@ public class WebMail extends HttpServlet
 					" onclick=\"deleteboxclicked();\" " +
 					( idChecked ? "checked" : "" ) + ">" + "</td><td " + jslink + ">" +
 					(mail.isNew() ? "<img src=\"/susimail/icons/flag_green.png\" alt=\"\" title=\"" + _("Message is new") + "\">" : "&nbsp;") + "</td><td " + jslink + ">" +
-					link + quoteHTML(mail.shortSender) + "</a></td><td " + jslink + ">" +
+                                        // mail.shortSender and mail.shortSubject already html encoded
+					link + mail.shortSender + "</a></td><td " + jslink + ">" +
 					(mail.hasAttachment() ? "<img src=\"/susimail/icons/attach.png\" alt=\"\" title=\"" + _("Message has an attachment") + "\">" : "&nbsp;") + "</td><td " + jslink + ">" +
-					link + quoteHTML(mail.shortSubject) + "</a></td><td " + jslink + ">" +
+					link + mail.shortSubject + "</a></td><td " + jslink + ">" +
 					(mail.isSpam() ? "<img src=\"/susimail/icons/flag_red.png\" alt=\"\" title=\"" + _("Message is spam") + "\">" : "&nbsp;") + "</td><td " + jslink + ">" +
 					// don't let date get split across lines
 					mail.localFormattedDate.replace(" ", "&nbsp;") + "</td><td " + jslink + ">&nbsp;</td><td align=\"right\" " + jslink + ">" +

core/java/src/net/i2p/data/DataHelper.java

@@ -1624,7 +1624,8 @@ public class DataHelper {
         if (orig == null) return "";
         String t1 = orig.replace('<', ' ');
         String rv = t1.replace('>', ' ');
-        rv = rv.replace("\"", "%22");
+        rv = rv.replace('\"', ' ');
+        rv = rv.replace('\'', ' ');
         return rv;
     }
 

router/java/src/net/i2p/router/RouterVersion.java

@@ -18,7 +18,7 @@ public class RouterVersion {
     /** deprecated */
     public final static String ID = "Monotone";
     public final static String VERSION = CoreVersion.VERSION;
-    public final static long BUILD = 25;
+    public final static long BUILD = 26;
 
     /** for example "-test" */
     public final static String EXTRA = "-rc";