|
In-Portal Issue Tracker - In-Portal CMS
|
|
Viewing Issue Advanced Details |
|
|
ID:
|
Category:
|
Type:
|
Reproducibility:
|
Date Submitted:
|
Last Update:
|
|
530 |
[In-Portal CMS] Front End |
feature request |
N/A |
2010-01-05 04:59 |
2010-07-22 15:06 |
|
|
Reporter:
|
alex |
Platform:
|
|
|
|
Assigned To:
|
alex |
OS:
|
|
|
|
Priority:
|
normal |
OS Version:
|
|
|
|
Status:
|
closed |
Product Version:
|
5.0.2-B2 |
|
|
Product Build:
|
|
Resolution:
|
fixed |
|
| |
|
ETA:
|
none |
Fixed in Version:
|
5.1.0-B1 |
|
|
Reference:
|
http://groups.google.com/group/in-portal-dev/browse_thread/thread/27bfe06312f7eaec |
|
Change Log Message:
|
|
|
Estimate Points:
|
0 |
|
|
Summary:
|
0000530: Improvements of "m_Get" and "m_GetConfig" tags |
|
Description:
|
Tag "m_Get" is used to retrieve any variable from browser (get, post, cookie). This tag has internal parameter named "htmlchars", which applies "htmlspecialchars" function on it's result. This functionality is redundant, since we have "html_escape" parameter, that is processed for each tag, that does the same. I propose to remove "htmlchars" parameter processing.
There is another issue with "m_Get" tag. As security measure we apply "htmlspecialchars" by default on all browser variables, that are used on front-end (this way all type of injections are prevented). In case if developer wan't to output actual variable's value without "htmlspecialchars" function applied to it, then there is no way. I propose to add "no_html_escape" parameter that will do that for "m_Get" tag.
Tag "m_GetConfig" is used to retrieve configuration variable's value by given name. Also "escape" parameter is processed internally, that does the same as global tag parameter "js_escape". So I propose to remove it too. |
|
Steps To Reproduce:
|
|
|
Additional Information:
|
|
| Relationships | | parent of | 0001266 | closed (5.2.0) | alex | Special Characters in Website Name break Admin Menu |
|
|
Attached Files:
|
 main_processor_fix.patch (1,016) 2010-01-05 04:59
http://tracker.in-portal.org/file_download.php?file_id=207&type=bug |
|
|
Issue History |
|
Date Modified |
Username |
Field |
Change |
|
2012-04-26 02:37 |
alex |
Relationship added |
parent of 0001266 |
|
2010-07-22 15:06 |
alex |
Note Added: 0002561 |
|
|
2010-07-22 15:06 |
alex |
Status |
resolved => closed |
|
2010-04-25 07:09 |
alex |
Note Added: 0001920 |
|
|
2010-04-25 07:09 |
alex |
Status |
reviewed and tested => resolved |
|
2010-04-25 07:09 |
alex |
Fixed in Version |
=> 5.1.0-B1 |
|
2010-04-25 07:09 |
alex |
Resolution |
open => fixed |
|
2010-04-25 07:09 |
alex |
Assigned To |
!COMMUNITY => alex |
|
2010-04-25 07:09 |
alex |
Changeset attached |
5.1.x r13395 |
|
2010-04-24 23:39 |
Dmitry |
Time Estimate Removed |
1 => |
|
2010-04-24 23:39 |
Dmitry |
Note Added: 0001915 |
|
|
2010-04-24 23:39 |
Dmitry |
Status |
needs testing => reviewed and tested |
|
2010-02-27 04:08 |
alex |
Developer |
=> alex |
|
2010-01-12 11:16 |
alex |
Time Estimate Added |
1 |
|
2010-01-12 10:32 |
alex |
Target Version |
Icebox => 5.1.0 |
|
2010-01-05 05:00 |
alex |
Assigned To |
=> !COMMUNITY |
|
2010-01-05 05:00 |
alex |
Status |
active => needs testing |
|
2010-01-05 05:00 |
alex |
Reference |
=> http://groups.google.com/group/in-portal-dev/browse_thread/thread/27bfe06312f7eaec |
|
2010-01-05 05:00 |
alex |
Target Version |
=> Icebox |
|
2010-01-05 04:59 |
alex |
New Issue |
|
|
2010-01-05 04:59 |
alex |
File Added: main_processor_fix.patch |
|