Main menu

Forum


× Help Forum English

Special chars need to be escaped in event title

  • Lemke
  • Auteur du sujet
  • Fresh Boarder
  • Fresh Boarder
Plus d'informations
il y a 1 semaine 2 jours #17076 par Lemke
I am currently evaluating whether ICagenda is suitable for my purposes. In the course I discovered that event titles containing double quotes lead to errors. Example:
The event title is
Industrielle Praxis "Cloud Operations Workshop mit Bosch" (Workshop für Studierende)

This leads to the following generated html:
<div class="event ic-event ic-clearfix">
       <a href="/joomla/index.php/veranstaltungen-2/1-industrielle-praxis-cloud-operations-workshop-mit-bosch-workshop-fuer-studierende?date=2020-11-02-17-30" title="Industrielle Praxis " cloud="" operations="" workshop="" mit="" bosch"="" (workshop="" für="" studierende)"="">

I suppose the event title needs to be escaped using php htmlspecialchars. This might also be a security risk.

Connexion ou Créer un compte pour participer à la conversation.

  • Lyr!C
  • Portrait de Lyr!C
  • Administrateur
  • Administrateur
  • Lead Developer
Plus d'informations
il y a 1 semaine 2 jours #17077 par Lyr!C
Réponse de Lyr!C sur le sujet Special chars need to be escaped in event title
Hello,

Thank you for this report!

I don't see any security risk here, as it's only in a html layout rendering function.

But it's missing to escape...

Attached a version with the patch!

Best regards,
Cyril

Fichier attaché :

Nom du fichier : iCagenda_3...dev1.zip
Taille du ficher :1,775 ko

Latest version : 3.7.14

We recommend every user to keep your iCagenda updated.
Don't forget to have your Joomla!™ up-to-date!


Do you like iCagenda?
I would appreciate if you could take 5 minutes to post a review on JED (Joomla Extensions Directory) .
Pièces jointes :

Connexion ou Créer un compte pour participer à la conversation.

Modérateurs: Lyr!C
Temps de génération de la page : 0.068 secondes

Follow Us

Créez vos templates Joomla avec Template Creator CK