Item8089: TML variables broken by HTML ascii conversions in CommentPlugin

When a topic is saved by CommentPlugin, characters like %, <, > are converted to HTML ascii which breaks the parsing/rendering of the topic.

Instead of parsing the variable, it renders the character itself. See also comments below.

This is not affected on normal edit.

---

Not sure if this is a bug. Comment Plugin do not process well verbatim tags. When verbatim is used it should behave in any context.Example here (also in CommentPluginDoNotHonorVerbatimTags)

-- EnriqueCadalso - 27 Mar 2009

<verbatim> %SEARCH{ "[C]ategory.*value\=.%URLPARAM{"qCategory" default = "*" }%" scope="text" type="regex" nosearch="on" format=" | $formfield(Category) | $formfield(Animal) |" }%

</verbatim>

-- EnriqueCadalso - 27 Mar 2009

Another test <verbatim> %SEARCH{ "[C]ategory.*value\=.%URLPARAM{"qCategory" default = "*" }%" scope="text" type="regex" nosearch="on" format=" | $formfield(Category) | $formfield(Animal) |" }% </verbatim>

-- EnriqueCadalso - 27 Mar 2009

With extra line

<verbatim>

%SEARCH{ "[C]ategory.*value\=.%URLPARAM{"qCategory" default = "*" }%" scope="text" type="regex" nosearch="on" format=" | $formfield(Category) | $formfield(Animal) |" }%

</verbatim>

end

-- EnriqueCadalso - 27 Mar 2009

OK, so CommentPlugin is converting < and > to html ascii codes, which somehow the browser doesn't parse correctly.
If CommentPlugin doesn't render html ascii codes but render the normal < and >, the verbatim element work fine.

We need to ensure CommentPlugin doesn't replace < with &lt; or &#60;. Same for >

-- KwangErnLiew - 08 Apr 2009

This conversion is not there from nowhere.

Someone put it there for a reason and before we fix the code we should at least try and dig out why the conversion was added.

Maybe we break something else? Maybe it will not be possible at all to put text like X > Y?

-- KennethLavrsen - 14 May 2009

Commenting is disabled while not logged in

Not using comment plugin

%SEARCH{ "[C]ategory.*value\=.%URLPARAM{"qCategory" default = "*" }%" 
scope="text" type="regex" nosearch="on" 
format=" | $formfield(Category) | $formfield(Animal) |" }%

---

The reason for the conversion was to prevent CommentPlugin from being used for phishing expeditions. If there are other mechanisms in place that address that (e.g. Kenneth's URLPARAM filters), then the conversion can be removed.

-- CrawfordCurrie - 10 Jun 2009

I guess something changed since this was reported, but it works OK on trunk now.

Closed no-action.

-- CrawfordCurrie - 30 Aug 2010