cross
New Foswiki release 2.1.6 is available with important security fixes.
Sourceforge foswiki email lists being discontinued. Subscribe to the new Foswiki announce and discuss lists at MailingLists
You are here: Foswiki>Tasks Web>Item11682 (11 Apr 2012, GeorgeClark)Edit Attach

Item11682: LINKTOOLTIPINFO html corrupted if text contained quotes and removal created a WikiWord

pencil
Priority: Urgent
Current State: Closed
Released In: 1.1.5
Target Release: patch
Applies To: Engine
Component:
Branches: Release01x01 trunk
Reported By: SvenDowideit
Waiting For:
Last Change By: GeorgeClark
the issue that is Urgent for me:

client site has tooltips that worked ok on tmwiki, but cause bad html leakage.

its the simple thing i though it was, (to do with ' symbols), and I'm still trying to make an example that shows it for a unit test.


in the process of trying to find it, it seems that LINKTOOLTIPINFO=on is not always working right. (docco says it should result in Set LINKTOOLTIPINFO = $username - $date - r$rev: $summary, but instead i'm getting tips that say on

  • Later: - this is probably due to a space at the end of the setting 'on ' - I wonder if this should be chomped for true.

-- SvenDowideit - 21 Mar 2012

mmm, seems that the issue is that someone decided to remove single and double quotes, without replacing them with anything. In the process, string s that were not initially WikiWords, suddenly become ones. and then corrupt the title="" string with 'create topic' html

so I'm going to fix this by using.... $summary = Foswiki::entityEncode($summary);

now to see if any unit tests fail (tbh, i don't think any other unit tests enable the 'view' script context, so nothing else ever tested tooltips


later: well, that does not work, as we then proceed to encode those encodings frown, sad smile which of course the unit test does not show.

-- SvenDowideit - 22 Mar 2012

Unit tests are site configuration specific.

-- GeorgeClark - 30 Mar 2012
Topic revision: r16 - 11 Apr 2012, GeorgeClark - This page was cached on 22 Mar 2018 - 17:34.

The copyright of the content on this website is held by the contributing authors, except where stated elsewhere. See Copyright Statement. Creative Commons License