Drupal 6 has a wonderful new feature which makes comment signatures behave more like classic forum signatures in that the signature is part of the user profile instead of a part of the body of the comment.
This works fine as long as the signature's content is in the same input format as the comments it is being attached to, but fails when attached to comments of other input formats. (For example, if drupal attaches a signature designed for a BBCode input filter to a comment composed in HTML, the BBCodes will appear in the ouput. Furthermore, in that same situation, a BBCode-encoded message which contains literal < and > signs will likely result in unreliable output.)
Since old signatures were actually appended to the comment body, formatting concerns could be dealt with manually when the comment was composed. Now, if there's a formatting problem, it's impossible to fix.
I have yet to delve through the code and figure out how to fix this, but as a drupal admin I would prefer one of two solutions:
1) Always interpret user signatures with the default input format, no exceptions. (This would be the same behavior user profile fields exhibit.)
2) Another possibility would be to allow the input filter for a signature to be explicitly set. (Via an 'input format' field underneath the signature textarea, for example?)
| Comment | File | Size | Author |
|---|---|---|---|
| #23 | signature_format_04.patch | 1.74 KB | dawehner |
| #19 | signature_format_01[1].patch | 807 bytes | robin monks |
| #1 | signature_format_01.patch | 808 bytes | alexmarkley |
Comments
Comment #1
alexmarkley commentedA proof of concept patch to fix the problem. Just a pretty little one-liner that simply insists that all signatures be filtered using the default format. (Patch is against Drupal HEAD, but should apply to Drupal 6.0 rc2 as well.)
Comment #2
webchickThat seems like as decent approach. Subscribing.
Comment #3
catchThis is a patch.
Comment #4
cburschkaWould this approach be a lot more complex? I'm attracted to its greater flexibility... considering for example a site that has BBCode as default, but optionally allows WikiText or HTML to users, it would seem nice to allow users to enter HTML signatures instead of BBCode ones. Just an extra profile field, no? I've placed input format selectors into forms before, and it seems very simple.
Comment #5
webchick@Arancaytar: That solution could get into D7, but we're at RC2 so there's no way we're changing database tables around in D6.
Comment #6
cburschkaOkay. I didn't realize that the signature field is hard-coded into the schema; I was still thinking in terms of the {profile_fields} and {profile_values} tables in the profile module that allow dynamically created profile fields.
Comment #7
alexmarkley commentedCan we bump this issue? I'm not sure my patch is core-worthy, but it's been running on my d6-dev for a while without any problems.
Comment #8
gdevlugt commentedTried out the patch and it works for me on D6 head.
Using filtered html as default filter, I added an image link to my signature...
Before the patch a comment using the filtered html filter would not show the image. A comment using the full html filter did show the image.
After the patch, in both cases the image didn't show up, as expected by the description of the patch.
Although it would be helpful for newbie Drupal users to at least indicate what input the signature field expects, it would mean things like making the signature field filter aware (requiring changing the database schema) or extra translatable text strings for a description, which would be something for Drupal 7.
Until then, the patch would mean more consistency for Drupal 6 and therefore I recommend it.
Comment #9
alexmarkley commentedIs this issue still unaddressed in Drupal 6?
Comment #10
cburschkaSeems like it. Another review and it'll be RTBC. (I'm glad the acronym was conserved. Old habits die hard.)
Comment #11
pobster commentedUhhhh please don't think of this as thread hijacking as I'm wondering if my problem is related? I've enabled signatures in /admin/user/settings but they're not appended to anything... At all? Is there anywhere I need to specify 'stick a signature in this node-type'? Or is this related to this issue?...
Pobster
Comment #12
perien commentedI'm having the same problem...
Comment #13
alexmarkley commentedComment signatures are not designed to be appended to nodes. They are only appended to comments. If you want comment signatures to appear in nodes, make a feature request.
This issue is only for fixing a bug related to unreliable input format filtering in comment signatures.
Can we please get another review on this patch so we can move forward on some sort of resolution? (After all, we've had two releases of drupal 6 now, and this problem isn't going to fix itself.)
Comment #14
michelleThis really isn't a bug, so I doubt it will be changed in 6.x. Bumping to 7.x. My $.02 is that it would be better to have a separate input format for signatures, but possibly for signatures across the board rather than per signature.
pobster - You need to enable signatures in user settings and they only show on comments and, yes, this is off topic. If you have more issues, please start a new one.
Michelle
Comment #15
alexmarkley commentedYes, this is definitely a bug. It's a design flaw.
It assumes that all user comments will always be in the same input format, which is absolutely incorrect for any non-trivial configuration.
My site is suffering from this oversight.
Comment #16
alexmarkley commentedBtw, if we want a more complex solution (such as user-selectable comment formats) somebody (not me) should create a feature request for 7.x-dev.
This issue is a bug report for 6.x.
Comment #17
alexmarkley commentedMichelle in IRC suggested that we target 7.x-dev with this patch, and shoot for backporting it to 6.x later.
Comment #18
catchMichelle's right about the order in which it'll get fixed. fwiw, appending signatures to nodes has it's own issue here: http://drupal.org/node/132446
Comment #19
robin monks commentedResync to HEAD.
Robin
Comment #21
lilou commentedSee: #335122: Test clean HEAD after every commit and http://pastebin.ca/1258476
Comment #22
dawehnerthis defintive need works, because hook_comment changed
why not add a possibilty to let the admin select a format in usersettings?
Comment #23
dawehneri addded this functionality
8138 passes, 0 fails, and 0 exceptionsComment #25
alexmarkley commentedThis problem was fixed by the latest security advisory.
Of course, since this issue has been publicly known and reported since January 2008, making a big deal about it in SA-CORE-2009-007 seems... Silly?
So anyway, good work team! I've been patching my own Drupal site against this for a year and a half, so it'll be nice to no longer have to track that manually.
Comment #26
michelle@malex: While the security release does fix it, the exact nature of the security problem hasn't been known very long. At least I don't see anything on this issue that mentions the security problem. I don't think it occured to anyone until they went to try and enable comments on d.o. If you realized the security implications 1.5 years ago, you should have reported it as a security hole rather than a design flaw and it would have been fixed a long time ago.
Michelle
Comment #27
avpaderno