I'm using Asset together with the TinyMCE plugin. I started the Wizard from inside TInyMCE, then browsed to a picture and entered the text "Don't eat me" as alt text. Preview was fine, but Finish didn't work. It turns out that the wizard is not escaping inverted commas which is what generates the error:
------
[Break on this error] Drupal.assetWizard.insert('[asset|alt=Please don't eat me|title=A chicken|width...
missing ) after argument list
/modules/tinymce/tinymce/jscripts/tiny_mce/tiny_mce.js
Line 1
-----

Although this is a problem, it's probably not a security hole because there's another layer of conversion into html with TinyMCE cleaning. But note that I haven't tried to test whether this bug could be used maliciously.

Comments

wmostrey’s picture

wmostrey commented
Version: 5.x-1.0-beta1 » 5.x-1.0-beta3
Status: Active » Postponed (maintainer needs more info)

Are you still experiencing this in beta 3? I can't seem to replicate this.

jeff veit’s picture

jeff veit commented

No, but I wonder if I got the version wrong: I was flipping between version 1 and version 2, trying out features in both.

I really like v2 UI, but I had too many problems while trying to get it going reliably, and in the end opted not to use asset at all. Great pity, because imo asset has the best vision for asset handling in Drupal. But I have another site coming up which could use asset, and maybe I'll try again.

wmostrey’s picture

wmostrey commented
Version: 5.x-1.0-beta3 » 5.x-2.0-beta1

I believe you are right.

wmostrey’s picture

wmostrey commented
Status: Postponed (maintainer needs more info) » Active
wmostrey’s picture

wmostrey commented
Status: Active » Closed (fixed)

Asset 5.x-2 has been discontinued, please use 5.x-1.