--- a/roundup/cgi/templating.py	Mon Jul 10 17:31:34 2023 -0400
+++ b/roundup/cgi/templating.py	Mon Sep 11 00:10:29 2023 -0400
@@ -20,7 +20,6 @@
 __docformat__ = 'restructuredtext'
 
 import calendar
-import cgi
 import csv
 import os.path
 import re
@@ -28,6 +27,7 @@
 
 from roundup import hyperdb, date, support
 from roundup.anypy import urllib_
+from roundup.anypy.cgi_ import cgi
 from roundup.anypy.html import html_escape
 from roundup.anypy.strings import is_us, us2s, s2u, u2s, StringIO
 from roundup.cgi import TranslationService, ZTUtils
@@ -61,10 +61,50 @@
         import markdown2
         import re
 
-        class Markdown(markdown2.Markdown):
-            # don't allow disabled protocols in links
-            _safe_protocols = re.compile('(?!' + ':|'.join([
-                re.escape(s) for s in _disable_url_schemes])
+        # Note: version 2.4.9 does not work with Roundup as it breaks
+        # [issue1](issue1) formatted links.
+
+        # Versions 2.4.8 and 2.4.10 use different methods to filter
+        # allowed schemes. 2.4.8 uses a pre-compiled regexp while
+        # 2.4.10 uses a regexp string that it compiles.
+
+        markdown2_vi = markdown2.__version_info__
+        if markdown2_vi > (2, 4, 9):
+            # Create the filtering regexp.
+            # Allowed default is same as what hyper_re supports.
+
+            # pathed_schemes are terminated with ://
+            pathed_schemes = ['http', 'https', 'ftp', 'ftps']
+            # non_pathed are terminated with a :
+            non_pathed_schemes = ["mailto"]
+
+            for disabled in _disable_url_schemes:
+                try:
+                    pathed_schemes.remove(disabled)
+                except ValueError:  # if disabled not in list
+                    pass
+                try:
+                    non_pathed_schemes.remove(disabled)
+                except ValueError:
+                    pass
+
+            re_list = []
+            for scheme in pathed_schemes:
+                re_list.append(r'(?:%s)://' % scheme)
+            for scheme in non_pathed_schemes:
+                re_list.append(r'(?:%s):' % scheme)
+
+            enabled_schemes = r"|".join(re_list)
+
+            class Markdown(markdown2.Markdown):
+                _safe_protocols = enabled_schemes
+        elif markdown2_vi == (2, 4, 9):
+            raise RuntimeError("Unsupported version - markdown2 v2.4.9\n")
+        else:
+            class Markdown(markdown2.Markdown):
+                # don't allow disabled protocols in links
+                _safe_protocols = re.compile('(?!' + ':|'.join([
+                    re.escape(s) for s in _disable_url_schemes])
                                          + ':)', re.IGNORECASE)
 
         def _extras(config):
@@ -1639,7 +1679,7 @@
          (:[\d]{1,5})?                     # port
          (/[\w\-$.+!*(),;:@&=?/~\\#%]*)?   # path etc.
         )|
-        (?P<email>[-+=%/\w\.]+@[\w\.\-]+)|
+        (?P<email>(?:mailto:)?[-+=%/\w\.]+@[\w\.\-]+)|
         (?P<item>(?P<class>[A-Za-z_]+)(\s*)(?P<id>\d+)(?P<fragment>\#[^][\#%^{}"<>\s]+)?)
     )''', re.X | re.I)
     protocol_re = re.compile('^(ht|f)tp(s?)://', re.I)
@@ -1856,7 +1896,7 @@
             # causing a KeyError. So see if we removed it (and entered
             # it into valid_schemes). If we didn't raise KeyError.
             try:
-                del(schemes[sch])
+                del (schemes[sch])
                 self.valid_schemes[sch] = True
             except KeyError:
                 if sch in self.valid_schemes: