If a feed item has a title which includes an apostrophe ('), the title get's parsed into escaped text. For example:

Actual title is: Tomorrow's World 'not returning'

Parsed title from Feed Item can be seen here: http://portal.baade.org/node/687

CommentFileSizeAuthor
#1 aggregation.module_2.patch1.21 KBvito_swat

Comments

vito_swat’s picture

vito_swat commented
StatusFileSize
new aggregation.module_2.patch1.21 KB

Yes, there are too many check_plain() in this module. Check if provided patch helps. It should also help with escaping HTML in teasers but can be possibly vulnerable to XSS.

vito_swat’s picture

vito_swat commented
Status: Active » Needs review

Changing status.

RobRoy’s picture

RobRoy commented

Think this is a start. Basically you shouldn't be sanitizing input to node_save or whatever. We sanitize before inserting to db (db_query does this) for SQL injection and on display for XSS. I think we need the same for original_author as well.

crane.matt’s picture

crane.matt commented

I love this module works great for me. I was wondering if there is an eta on getting this bug officially fixed

crane.matt’s picture

crane.matt commented

I love this module works great for me. I was wondering if there is an eta on getting this bug officially fixed

vito_swat’s picture

vito_swat commented
Status: Needs review » Fixed

5.x-4.0 fixes this issue.

Anonymous’s picture

(not verified) commented
Status: Fixed » Closed (fixed)