Closed (fixed)
Project:
Signup Status
Version:
6.x-1.x-dev
Component:
Code
Priority:
Normal
Category:
Feature request
Assigned:
Reporter:
Created:
14 Aug 2009 at 21:38 UTC
Updated:
31 Aug 2009 at 22:20 UTC
Jump to comment: Most recent file
Comments
Comment #1
dwwComment #2
dwwNow with filter_xss(), just to be safe. The status name and description are entered by admins, not end users, but still. Since these tokens are used in plain text email, check_plain() isn't really what we want (and in fact, we don't even care about filter_xss(), either). However, if other modules start using these tokens in an HTML context, better safe than sorry...
Comment #4
dwwUpon further discussion, seems better to provide both regular and raw versions of these tokens, and let customers decide which to use as needed.
Comment #5
dwwNow without the PHP syntax error. ;)
Comment #6
dwwAfter more elaborate testing, there are cases where
$signup->statusis empty (e.g. users who signed up for something before signup_status was enabled, etc). So, now we're a little more careful about initializing those token values to avoid PHP notices.Comment #7
dwwGiven the review(s) by greggles and more testing from me, committed to HEAD.
Comment #8
dwwFollowup: Looking more closely at the default core tokens provided by token.module, it seems like '-' is used more frequently as the delimiter inside token names, not '_'. So, I just committed a change to switch from, e.g. [signup_status] to [signup-status] to HEAD.