IE and FF give an error message:
FF: XML cannot be the whole program [Break on this error] <br />
IE: Syntaxerror Line: 760 character: 1 Code: 0 URI: http:...edited

I debugged the code to find the culprit to be the contents of variable getclicky_codesnippet. This a variable and in my system it has got set to <br />. The variable is written into the page as: <script type="text/javascript"><br /></script> Which of course is not sensible code and hence the error message.

workaround: get clicky module, lines 189, add check for valid javacode here.

action: assure the variable gets only set to sensible information.

  // Add any custom code snippets if specified
  $codesnippet = variable_get('getclicky_codesnippet', '');  
  if (!empty($codesnippet)) {
    $js_code .= '<script type="text/javascript">';
    $js_code .= $codesnippet;
    $js_code .='</script>';
  }

kr Joel Box, Mondial-IT.NL

Comments

rsvelko’s picture

rsvelko commented
Category: bug » task

This should have happened because of FCKeditor or another WYSWYG ...

They insert br or p into textareas.

There is a way to disable fckeditor for a given path (wildcards possible too) by going to its settings.

In order for this br to be inserted you must have gone to the textarea and played with the WYSWYG editor...

Non of a getclicky's fault.

I can add a check for "[whitespace]<(br|p)/(optionally)>[whitespace]" if this will help anyone. This is a pseudo regexp there ...

joelbox-mondial-it’s picture

joelbox-mondial-it commented

1) Are you serious that a user can add unvalidated javacode directly into the page?
Perhaps it is wise to have the security group have a look through the code as this raises new issues.
2) Probably other users will explore clicky the same way and run into the warning.
Preventing it by setting the input filters to off, and checking the field before using it in a script still is the right way to handle module input.

rsvelko’s picture

rsvelko commented

@2: You totally misunderstand everything.

1. The js box is for site admins to shape the tracking code as they want. So no control over the js is needed. This js is like the js devs put in the site themes for example.

Generally I agree on "always validate unpit".

If somebody messes up with this much advanced JS stuff - they surely would know what's happening.

And finally - anyone patches ?

rsvelko’s picture

rsvelko commented
Assigned: Unassigned » rsvelko
Status: Active » Fixed

we now do sth like :


+  if ( $codesnippet == "<br>" ||
+    $codesnippet == "<br />" ||
+    $codesnippet == "<p></p>" ||
+    preg_match('!^<p>.+</p>$!', $codesnippet)
+    ) { $codesnippet = ""; }
+

...

+    '#wysiwyg' => FALSE,

all commited in 9a79c51 - to be released in 6.x-1.7

rsvelko’s picture

rsvelko commented
Status: Fixed » Closed (fixed)