Careless use of decode_entities() can result in security vulnerabilities. Patch to add a warning to the doxygen comments, as well as some doc clean-up.

CommentFileSizeAuthor
#7 decode_entities_d6.patch1.23 KBmr.baileys
#3 decode_entities.patch1.24 KBmr.baileys
decode_entities.patch1.24 KBmr.baileys

Comments

damien tournoud’s picture

damien tournoud commented
Status: Active » Reviewed & tested by the community

That's a reasonable improvement.

jbrown’s picture

jbrown commented
Status: Reviewed & tested by the community » Needs work

it should be @return , not @returns

mr.baileys’s picture

mr.baileys
Primary language Dutch
Location 🇧🇪 (Ghent)
commented
Status: Needs work » Needs review
StatusFileSize
new decode_entities.patch1.24 KB

Indeed it should, thanks!

damien tournoud’s picture

damien tournoud commented
Status: Needs review » Reviewed & tested by the community

Good catch.

dries’s picture

dries commented
Status: Reviewed & tested by the community » Fixed

Committed to CVS HEAD. Thanks.

damien tournoud’s picture

damien tournoud commented
Version: 7.x-dev » 6.x-dev
Status: Fixed » Patch (to be ported)

Let's consider a backport to D6.

mr.baileys’s picture

mr.baileys
Primary language Dutch
Location 🇧🇪 (Ghent)
commented
Status: Patch (to be ported) » Needs review
StatusFileSize
new decode_entities_d6.patch1.23 KB

Straight backport

damien tournoud’s picture

damien tournoud commented
Status: Needs review » Reviewed & tested by the community

Doesn't hurt to get into D6 too, I believe.

gábor hojtsy’s picture

gábor hojtsy
he/him
Primary language Hungarian
Location Hungary
commented
Status: Reviewed & tested by the community » Fixed

Committed thank you!

Status: Fixed » Closed (fixed)

Automatically closed -- issue fixed for 2 weeks with no activity.