Page MenuHomePhabricator

[SMW] 1.8; SMW_QP_List.php row results are not fully escaped which allows html tags
Closed, ResolvedPublic

Description

Problem

While testing r37721 we found that SMW_QP_List.php returns results that can contain html tags that distort the <ul>/<ol> embedded list.

Solution

For the <ul>/<ol> list to work properly, no other html tags should within within the result display therefore

SMW_QP_List.php

#line 226

  • $result .= $text; // actual output value

and instead sanitize and strip tags from results
+ $result .= Sanitizer::stripAllTags( $text );


Version: unspecified
Severity: normal

Details

Reference
bz37723

Event Timeline

bzimport raised the priority of this task from to Needs Triage.Nov 22 2014, 12:22 AM
bzimport set Reference to bz37723.
Unknown Object (User) added a comment.Jun 19 2012, 9:40 PM

I'll fixed this later, ones r37721 is submitted.

Unknown Object (User) added a comment.Jun 19 2012, 9:43 PM

OK, it's late it is not the 37721 revision but the bug 37721