[#17324] - Comment for non-escaped $result->title
- Closed
- 4 Aug 2017
- Medium
- Build: staging
- # 17324
Steps to reproduce the issue
- Check out https://github.com/joomla/joomla-cms/pull/16484/files
- Note that the security checks (i.e. the escapes) get moved to view.html.php (via the htmlspecialchars)
Expected result
A comment to let a future coder know why it's not escaped
Actual result
There's no comment
System information (as much as possible)
N/A
Additional comments
Adding the comment could be important for someone that looks at the file later down the road. They'd see that other variables are escaped, but those two aren't, and wonder why. A person might even submit code to escape it.
joomla-cms-bot
- | Labels |
Added:
?
|
||
franz-wohlkoenig
- | Category | ⇒ | com_search |
| Status | New | ⇒ | Discussion |
| Status | Discussion | ⇒ | Information Required |
@weeblr
nice , thanks for your works
just it would have been better if a new property was added:
$result->title_escaped_search_highlighted (or a shorter one)
this way
-- the original issue would have been fixed
-- existing templates overrides would not need to be updated
-- consistent with all other template files where the ->title is not passed escaped, and it is also the original text unmodified
but since which date they should:
had the template developers followed the default Joomla! template all would be well.
before the date that the change was introduced or after the date the change was introduced ?
anyway personally i care little of this, i think this can now be closed
The problem is the developers have used escape around the title something which is common in Wordpress since they don't really sanitise any data naturally.
But it's not needed in Joomla! at this level which we are rendering the template the content should already be escaped at the tmpl level.
Thanks for everyone's input! I think this issue is resolved now. But, if there's still a concern about a new property, please open a new issue report for it.
| Status | Information Required | ⇒ | Closed |
| Closed_Date | 0000-00-00 00:00:00 | ⇒ | 2017-08-04 18:21:15 |
| Closed_By | ⇒ | nicksavov |
I would say to add a new property to the record
like
$result->title_escaped_highlighted
and leave $result->title untouched
since the way it is modified now it is inconsistent with all other template files