Closed (fixed)
Project:
Drupal core
Version:
6.x-dev
Component:
node system
Priority:
Normal
Category:
Bug report
Assigned:
Unassigned
Reporter:
Created:
12 Sep 2007 at 11:36 UTC
Updated:
11 Oct 2007 at 12:31 UTC
Jump to comment: Most recent file
Comments
Comment #1
stevenpatzComment #2
webchickThis sounds more like a bug than a feature request, and therefore can be fixed in 6.x (and possibly back-ported to 5.x).
The suggested fix is a bit dangerous though; node title could contain anything, so it needs to be check_plain()ed.
So this one adds the node title as placeholder in the string.
Comment #3
Freso commentedUsing my fresh D6 CVS install, I generated a bunch of (= 100) nodes with Devel Generate and went and checked the text, which said
I then tried to apply the patch, which went cleanly, refreshed the page and now properly got . However, trying with the title , I get this:
title="Read the rest of !&quot;#€%&amp;/()=?`&gt;&lt;."- notice the doubly escaped ampersands! (The code for the<h2>title itself istitle="!"#€%&/()=?`><"- no doubly escaped ampersands.)Comment #4
Freso commentedI've tried digging into the API and the code, and for all I can tell,
node_link()inherits a call tol()fromhook_link(), which runs the text (including attributes) throughcheck_plain(). Which means that using@is superfluous, and using!should do fine. But I am must admit that I haven't been able to locate any actual references in any functions or anything, but, well, yes.I've attached a patch with
!instead of@, please review and see if there's anywhere this isn't escaped.Comment #5
webchickAh-ha, I had forgotten about the check_plain() in l(). Thanks, Freso!
Looks like this is good to go.
Comment #6
gábor hojtsyThanks. I also added a comment that the title gets escaped later, so people will not fix this "bug".
Comment #7
peterx commentedThe line
'attributes' => array('title' => t('Read the rest of !title.', array('!title' => $node->title)))works in Drupal 5.2 and is in use on http://petermoulding.com.
Thank you for fixing the last WAI issue for Drupal and the modules in use on my site.
Comment #8
(not verified) commented