Code 

 if (variable_get('ant_php_'. $node->type, 0) || module_exists('token')) {
  $output = preg_replace('/[\t\n\r\0\x0B]/', '', strip_tags($output));
}

must be removed from function _auto_nodetitle_patternprocessor. Suppose I want node title to be 'x<y'. Currently if I return 'x<y' in php code I get 'x' as title because '<y' is stripped. If I return 'x&lt;y' in php code I get 'x&lt;y' as title.

This logic does not follow Drupal's guidelines of sanitizing text only during output:

When handling data, the golden rule is to store exactly what the user typed. When a user edits a post they created earlier, the form should contain the same things as it did when they first submitted it. This means that conversions are performed when content is output, not when saved to the database

CommentFileSizeAuthor
#9 878570-9.auto_nodetitle_no_sanitize_title_on_input.d7.patch463 bytesanmolgoyal74
#4 878570-4.auto_nodetitle_no_sanitize_title_on_input.d7.patch449 bytesdww
#4 878570-4.auto_nodetitle_no_sanitize_title_on_input.d6.patch513 bytesdww

Comments

TonyK’s picture

TonyK commented
Title: Do not strip title's tags in function _auto_nodetitle_patternprocessor » Do not sanitize title in function _auto_nodetitle_patternprocessor
bdsl’s picture

bdsl commented

This looks like the same issue as, or at least closely related to, #1071596: HTML Special characters in node title and #1052268: Special characters break creation of automatically generated node titles.

ambient.impact’s picture

ambient.impact
they/them
Primary language English
Location Toronto
commented

This was giving me headaches in 7.x-1.0-alpha1 as well, until I tracked it down. Hoping this gets taken care of at some point.

dww’s picture

dww
we/he/they
commented
Version: 6.x-1.x-dev » 7.x-1.x-dev
Priority: Normal » Major
Status: Active » Needs review
StatusFileSize
new 878570-4.auto_nodetitle_no_sanitize_title_on_input.d6.patch513 bytes
new 878570-4.auto_nodetitle_no_sanitize_title_on_input.d7.patch449 bytes

Yes, this is definitely a bug. See my wider analysis at #1071596-35: HTML Special characters in node title. Bottom-line: auto_nodetitle should not be trying to filter the title on input. It's up to all the places displaying the title to filter on output.

Here are patches for both 7.x-1.x and 6.x-1.x.

mattbk’s picture

mattbk commented

Patch in #4 doesn't seem to work for me, but others should try it to make sure.

pieterdc’s picture

pieterdc
Primary language Dutch
Location Ghent
commented
Issue summary: View changes

Patch for 7.x-1.0 in #4 does work for me. Thanks, @dww.

gaele’s picture

gaele commented
Status: Needs review » Reviewed & tested by the community
anmolgoyal74’s picture

anmolgoyal74 commented
Assigned: Unassigned » anmolgoyal74
Status: Reviewed & tested by the community » Needs work

The patch doesn't apply anymore.

anmolgoyal74’s picture

anmolgoyal74 commented
Status: Needs work » Needs review
StatusFileSize
new 878570-9.auto_nodetitle_no_sanitize_title_on_input.d7.patch463 bytes

This patch only removes strip_tags(). The function preg_replace() should be remain there to remove white spaces which has also been removed in patch given in #4.

gaurav.kapoor’s picture

gaurav.kapoor commented
Status: Needs review » Fixed

Status: Fixed » Closed (fixed)

Automatically closed - issue fixed for 2 weeks with no activity.