Validation issues with function.title and function.breadcrumb

[nils73]

While creating a new website I ran into some validation issues. While inside the menu (bulletmenu_accessible) everything is okay, the breadcrumbs and the title function produce some validation errors.

In my menu I am using "Service & Contact" and the & (ampersand) is not properly encoded as & and so the HTML validator reports an error. I did a quick and dirty hack and modified the two files on my own. Here is what I did:

function.title.php
Line 31:

Code: Select all

$result = htmlspecialchars($pageinfo->content_title);

and in

function.breadcrumbs.php
Line 109:

Code: Select all

$trail .= htmlspecialchars(($onecontent->MenuText()!=''?$onecontent->MenuText():$onecontent->Name()));

Line 123:

Code: Select all

$trail .= htmlspecialchars(($onecontent->MenuText()!=''?$onecontent->MenuText():$onecontent->Name()));

But I am pretty sure that this is just quick and dirty and that probably somebody with better programming skills should have a look into this.

Regards,
Nils

[jelle]

maybe you could use some smarty functions too, that would eliminate the need for digging in the code (but makes it less beautifull)
I think I saw a smarty function to escape those nasties yesterday, but I cant seem to find it now.  The usage was something like {title|escape}, but maybe you have to define your own function for that first (which negates the whole deal).

[nils73]

Thanks jelle. I know about this escape-feature in Smarty (at least it is somewhere in my brain) where you can do something like:

{title|escape:"html"}

which might do the same trick. But then it is still a trick. However I must admit I haven't tried to use Smarty to escape the characters ...

Regars,
Nils

[jelle]

True, you should not have to fix things in the output, but keep the input that goes into the db clean. In theory practice and theory should be the same, in practice they are not.

[nils73]

erm ... yes ... or should I say no? I am not sure ... in theory I am, but ...

Regars,
Nils

[arwan]

While implementing my first test site with CMSMS, I also ran into some validation issues with page properties 'Title', 'Menu Text' and 'Title Attribute' (more precisely while using cms_selflink). I was already thinking about writing a patch to fix this issue, since I like the project so much . But it's not really clear how CMSMS is supposed to handle these properties. I noticed for example that the menumanager is correctly converting special characters(at least on 'Menu Text') using the function my_htmlentities().
Are these properties allowed to contain HTML? Perhaps there is an option planned to configure what content is allowed for these properties?

A side note: that function my_htmlentities() doesn't convert double quotes, although there seems to be a parameter ($quote_style) planned for that purpose. This causes a problem while editing a page with a 'Title' that contains double quotes.

Keep up the good work, this looks like an excellent project!

[Ted]

Ok, fixed in svn.  It now uses cms_htmlentities, and I've put the code back in to escape ".

[arwan]

I've pasted some code to fix related issues in other files.

http://www.cmsmadesimple.org/pastebin/406

[nils73]

Thanks to all for contributing so fast to this issue. This is a serious problem in most other CMS and I am quite happy with the solution in CMSMS.

Regards,
Nils

[chilsta]

Hi all- glad I found this thread- thort I was going mad there for a minute.

Just in case anyone else is looking into this, If I enter a page's title with & it's OK in the , but not the main navigation button text, the source is rendered as & if I enter it as a plain ol' & they're fine in the menu, but don't get rendered out as &s in the so it doesn't validate... (picture me swapping these around for, oh, an hour or so in true Homer style ).

So I found this page, but I don't know how to use Subversion or arwan's code from the paste bin. I guess the pastebin code would be my easiest option (if it indeed does fix the function.title problem, I'm not using breadcrumbs on this site)- do I just stick that in a file on the server like "patch.php" and point my browser to it? If so, where does it need to go?

If that's not going to work for me, could someone tell me what to edit in function.title?

Many Thanks IA
C*

0.12.1 "Savusavu", LAMP

[cyberman]

So I found this page, but I don't know how to use Subversion or arwan's code from the paste bin. I guess the pastebin code would be my easiest option (if it indeed does fix the function.title problem, I'm not using breadcrumbs on this site)- do I just stick that in a file on the server like "patch.php" and point my browser to it? If so, where does it need to go?

No patch file  - open the tag files with your favourite editor and change the lines with posted code ...