Hi,

A javascript error is produced when you enter an incorrect path in the menu admin area. This is caused by $message returning single quotes e.g.

+ 'The path 'sdfgsdfg' is either invalid or you do not have access to it.'

The single quotes are causing the javascript to end prematurely.

All single and double quotes should be stripped and replaced with there html code equivalent.

Thanks.

CommentFileSizeAuthor
#3 singlequotev2.patch654 bytesmikebell_
#1 singlequote.patch655 bytesmikebell_

Comments

mikebell_’s picture

mikebell_ commented
Status: Active » Needs review
StatusFileSize
new singlequote.patch655 bytes

Ok I've built a rough patch to fix this. Please find it attached

tanc’s picture

tanc
he/him
Primary language English
Location Italy
commented

Thanks for the patch. Would encoding with htmlentities work instead of a string replace?

I'm currently having issues with my CVS account so I can't update any code.

mikebell_’s picture

mikebell_ commented
StatusFileSize
new singlequotev2.patch654 bytes

Updated patch to use htmlentities

mikebell_’s picture

mikebell_ commented

Please use patch from post #1 as #3 breaks links.

tanc’s picture

tanc
he/him
Primary language English
Location Italy
commented

Have committed your patch from #1. Thanks!

tanc’s picture

tanc
he/him
Primary language English
Location Italy
commented
Status: Needs review » Fixed

Marking this as fixed as no one has reviewed and from my testing it appears to be fine.

Status: Fixed » Closed (fixed)

Automatically closed -- issue fixed for 2 weeks with no activity.

adewinne’s picture

adewinne commented
Status: Closed (fixed) » Needs review

I just wrapped the $message output with addslashes in the module on line 117. Worked fine.

$output .= "+ '<li>". addslashes($message) ."</li>'\n";

tanc’s picture

tanc
he/him
Primary language English
Location Italy
commented
Version: 6.x-1.0 » 6.x-1.x-dev
Assigned: Unassigned » tanc
Status: Needs review » Fixed

Thanks adewinne, good idea with addslashes. I've added it to the 6.x-1.x-dev branch, should be updated shortly.

Status: Fixed » Closed (fixed)

Automatically closed -- issue fixed for 2 weeks with no activity.

  • tanc committed 81b1e9b on 6.x-1.x, 8.x-2.x 
    Issue #798802 by adewinne: Use addslashes() around the message to escape...