New Foswiki release 2.1.6 is available with important security fixes.
Sourceforge foswiki email lists being discontinued. Subscribe to the new Foswiki announce and discuss lists at MailingLists
You are here: Foswiki>Tasks Web>Item11682 (11 Apr 2012, GeorgeClark)Edit Attach

Item11682: LINKTOOLTIPINFO html corrupted if text contained quotes and removal created a WikiWord

Priority: Urgent
Current State: Closed
Released In: 1.1.5
Target Release: patch
Applies To: Engine
Branches: Release01x01 trunk
Reported By: SvenDowideit
Waiting For:
Last Change By: GeorgeClark
the issue that is Urgent for me:

client site has tooltips that worked ok on tmwiki, but cause bad html leakage.

its the simple thing i though it was, (to do with ' symbols), and I'm still trying to make an example that shows it for a unit test.

in the process of trying to find it, it seems that LINKTOOLTIPINFO=on is not always working right. (docco says it should result in Set LINKTOOLTIPINFO = $username - $date - r$rev: $summary, but instead i'm getting tips that say on

  • Later: - this is probably due to a space at the end of the setting 'on ' - I wonder if this should be chomped for true.

-- SvenDowideit - 21 Mar 2012

mmm, seems that the issue is that someone decided to remove single and double quotes, without replacing them with anything. In the process, string s that were not initially WikiWords, suddenly become ones. and then corrupt the title="" string with 'create topic' html

so I'm going to fix this by using.... $summary = Foswiki::entityEncode($summary);

now to see if any unit tests fail (tbh, i don't think any other unit tests enable the 'view' script context, so nothing else ever tested tooltips

later: well, that does not work, as we then proceed to encode those encodings frown, sad smile which of course the unit test does not show.

-- SvenDowideit - 22 Mar 2012

Unit tests are site configuration specific.

-- GeorgeClark - 30 Mar 2012
Topic revision: r16 - 11 Apr 2012, GeorgeClark - This page was cached on 22 Mar 2018 - 17:34.

The copyright of the content on this website is held by the contributing authors, except where stated elsewhere. See Copyright Statement. Creative Commons License