@jsubri There a few things that make this functionality fail:

• The module will strip out span and script tags
• The length of the introtext is trimmed (removing vital javascript)

To make it work just replace https://github.com/joomla/joomla-cms/blob/staging/modules/mod_articles_category/helper.php#L325-L332 with:

	public static function _cleanIntrotext($introtext)
	{
		$introtext = str_replace(array('<p>','</p>'), ' ', $introtext);
		$introtext = strip_tags($introtext, '<a><em><strong><span><script>');
		$introtext = trim($introtext);

		return $introtext;
	}

And increase the allowed characters (in my test case 1000)

And the million dollar question: can this be patched without this hack?

• well someone needs to spend sometime, I guess

Thank you for the workaround and yes $introtext is easily above 600 characters long.
Low priority anyway.

Does not this solution have security implications in so much as now the _cleanIntrotext method would allow script to be output?

@PhilETaylor I think I should redo #11027, will make patching this a lot easier (but I don't remember the reason we end up reverting it in the first place)

@jsubri Is this issue still present in the latest J3?

I didn't checked recently, the workaround was good enough for me and I've advised my customer (NGO) to refrain adding email address in the introtext. Very high probability the javascript code is still present in the $introtext in current staging. I've not test with J4.

Is this issue still present in the latest J3?

Yes.

Is this issue still present in latest Joomla 4 ?

Yes.

This is a bug that should be fixed in J3

please test #36602 for j4

still an issue on j3

the j3 pr #36603