A triple "check_plain" causes alt/title attributes of link fields like "A & B" to be rendered as "A & B" instead of "A & B".

Comments

dawehner’s picture

Status: Active » Postponed (maintainer needs more info)

I cannot reproduce it, i tryed out DRUPAL-6--2 and DRUPAL-6--3 and DRUPAL-6--2-6

What kind of field are you using?

matteogeco’s picture

Hi, this happens to me with node titles in table style views. Try to create a node with "A & B" as title and a table view that lists that node.

dawehner’s picture

Status: Postponed (maintainer needs more info) » Active

-

dawehner’s picture

StatusFileSize
new32.41 KB

It works fine, see the screenshot

matteogeco’s picture

Hi dereine, thank you for bringing back the thread to life (sorry for my english...). In your screenshot, I can't see if it works; the visibile title is ok, but we are talking about the "a" tag "title" attribute, i.e. the tooltip that appears when you put the mouse pointer over the link; what happens if you put the mouse pointer over "A & B"?

dawehner’s picture

Thats not really solveable currently, sadly:

The l function users check_plain for the title arguments. Views usres check_plain to get safe tokens. Perhaps someone has a suggestion to make this clean but also safe.

esmerel’s picture

Status: Active » Closed (works as designed)

If someone comes up with a solution, they can always post a patch.

mustanggb’s picture

Status: Closed (works as designed) » Active
StatusFileSize
new348 bytes

We can't double_encode = false, see #882438: Globally prevent double encoding in check_plain() by raising minimum PHP to 5.2.3
I don't want to suggest suggest altering $tokens as other code likely relies on these being clean, the same applies to l()

Therefore the attached patch will use clean $tokens, unclean them, then clean them again in l()

bojanz’s picture

Status: Active » Needs review

There's a patch in here.

anrikun’s picture

I used to do like #8 before, until I noticed that there are some cases it outputs unsafe/wrong code.
So far the best solution I have found is the one I propose here: #769458: Provide a way to use raw values of token too

merlinofchaos’s picture

Status: Needs review » Closed (duplicate)

This is now a dup of the issue mentioned in #10.