Markup placed in some fields appears in the pages' <title></title>. It should be stripped out as the <title> can contain only text and entities.

Applies to markup in "Site Name" and "Slogan" & probably elsewhere.

CommentFileSizeAuthor
#3 tags_in_title.patch1.05 KBjacine
#2 title.txt103 bytesmnicholas

Comments

damien tournoud’s picture

damien tournoud commented
Status: Active » Postponed (maintainer needs more info)

Cannot reproduce.

Which theme are you using?

mnicholas’s picture

mnicholas commented
StatusFileSize
new title.txt103 bytes

I've placed a demonstration at my (embryonic) blog:
http://blog.mgn.org.uk/
Different tags seem to exhibit different behaviour, underline for example. I've placed bold tags in both the "Site Name" and the "Slogan" and they appear correctly on the page, but also appear in the <title>. Firefox & chrome display these as plain text in the window title, maybe other browsers do different? Theme must be the default since I've done nothing to the change the apperance.

It'll take ages to format the title here, so I've uploaded a file.

jacine’s picture

jacine
she/her
Location New York
commented
Version: 7.0-alpha6 » 7.x-dev
Status: Postponed (maintainer needs more info) » Needs review
StatusFileSize
new tags_in_title.patch1.05 KB

I can reproduce.

Front page:
<title>&lt;b&gt;bold tag&lt;/b&gt; in my site name | <b>bold tag</b> in my slogan</title>

Node:
<title>Pertineo &lt;b&gt;tag&lt;/b&gt; | &lt;b&gt;bold tag&lt;/b&gt; in my site name</title>

I'm not positive if this is the right way to fix it, but here's my attempt. Note: This doesn't fix the node title, because that has already gone through a check_plain(), which escapes the tags, before attempting to strip_tags(). This is no different in Drupal 6 though.

Status: Needs review » Needs work

The last submitted patch, tags_in_title.patch, failed testing.

Jeff Burnz’s picture

Jeff Burnz commented

sub

+++ includes/theme.inc	13 Sep 2010 05:05:48 -0000
@@ -2199,12 +2199,12 @@ function template_preprocess_html(&$vari
-      $head_title[] = filter_xss_admin(variable_get('site_slogan', ''));
+      $head_title[] = strip_tags(variable_get('site_slogan', ''));

does strip_tags allow through html entities - doesn't filter_xss_admin allow them? I can't remember so just posing the question.

Powered by Dreditor.

damien tournoud’s picture

damien tournoud commented
Status: Needs work » Closed (duplicate)

#461938: Core should consistently filter_xss_admin() on $site_slogan and check_plain $site_name