Ampersands in flickr title fields are sync'd to nodes as &.

Comments

elly’s picture

It's true, and, HTML in captions gets entified, too, I've noticed... regardless of what you've got as your default input type on the site.

elly’s picture

it might present some kind of security hole to import unscrubbed html, but i got around the entifying by changing line 671 from

    $content .= '<p>'. htmlentities(html_entity_decode($flickr_photo['description'])) .'</p>';

to

    $content .= '<p>'. $flickr_photo['description'] .'</p>';
gclicon’s picture

Title: Ampersands in flickr Title Fields Entified » HTML in flickr Description Field and Title Entified

Updating title to also include issue in #367396: HTML in flickr Description Field Entified since they are related issues.

This is an issue that will take some time to figure out how to best resolve since just about any solution would present some kind of security hole.

gclicon’s picture

Assigned: Unassigned » gclicon
gclicon’s picture

Category: bug » feature
xolotl’s picture

Isn't there an established, secure way to pass such content in Drupal? It's not like this issue is apparent in Drupal core...

If I could point to the method, I would.

elly’s picture

The right thing to do is probably pass it through Drupal's html filter, same as you would for node content. Perhaps this function? http://api.drupal.org/api/drupal/modules--filter--filter.module/function...

gclicon’s picture

Version: 6.x-1.x-dev » 7.x-1.x-dev

Actually, the better function would be:

http://api.drupal.org/api/drupal/modules%21filter%21filter.module/functi...

This would be a great way to not have FlickrSync decide what to omit or allow while giving both Admins and Users flexibility to decide on their own, similar to editing a node.

My current focus is on #1869164: Upgrade Flickrsync to support latest version of flickrapi module, but will entertain and review any patches to get this feature added. Otherwise, I'll add this feature once that ticket is closed.

gclicon’s picture

Status: Active » Postponed