mirror/php-e107
1
0
Fork 0
mirror of https://github.com/e107inc/e107.git synced 2025-08-11 09:04:38 +02:00
Code Issues Releases Wiki Activity

Restore htmlspecialchars() for e_parse::filter(…, 'str')

Browse Source 
Fixes regression from 20882920a0 where
data would get inserted into the database with literal quotation marks,
but e107 has always expected `"` and `'` to come directly from
the database
This commit is contained in:
Nick Liu
2021-10-06 13:03:08 -05:00
parent d4d0a74858
commit 19f48180dc
2 changed files with 29 additions and 2 deletions
Download Patch File Download Diff File Expand all files Collapse all files

15
e107_tests/tests/unit/e_parseTest.php
View File

@@ -2589,7 +2589,22 @@ Your browser does not support the audio tag.
}
/**
* e107 v0.6.0 requires strings to be passed around with quotation marks escaped for HTML as a way to prevent
* both SQL injection and cross-site scripting. Although {@see e_parse::toDB()} is supposed to do that, some
* usages, specifically {@see e_front_model::sanitizeValue()} call {@see e_parse::filter()} instead.
*
* @version 2.3.1
*/
public function testFilterStr()
{
$input = "<strong>\"e107's\"</strong>";
$expected = "&quot;e107&#039;s&quot;";
$actual = $this->tp->filter($input, 'str');
$this->assertEquals($expected, $actual);
}
public function testCleanHtml()
{