? Pending

User tests: Successful: Unsuccessful:

avatar continga
continga
5 May 2018

This commit fixes a bug where special characters like a semicolon get incorrectly removed from the layout parameter, leading to the url using an invalid layout.

Summary of Changes

Using the ContentHelperRoute class to construct a category route can sometimes result in generating an invalid url. The layout parameter has been obtained by JInput::get which by default will use the cmd filter, which removes certain special characters from the string.

We should use the string filter instead here, which allows more characters than cmd. Note: This does not introduce any security issues as far as I'd assess, because XSS-suspicious strings still get removed by the string filter, and other stuff should be catched by url-encoding methods such as JRoute::_. I might have overseen something though, so if somebody could confirm this I'd be very happy.

Testing Instructions

Create a layout with some special characters in it, e.g. a semicolon. This is e.g. being used YOOthemes Warp Framework to split the used layout and the used style from each other.
Then call this method from somewhere and notice that your semicolon has been removed, leading to an incorrect link.

Expected result

The link should contain the correct layout paramater.

Actual result

The link contains a layout parameter with certain special characters removed, leading to an incorrect link as the layout will not be found and the default layout used instead.

avatar continga continga - open - 5 May 2018
avatar continga continga - change - 5 May 2018
Status New Pending
avatar joomla-cms-bot joomla-cms-bot - change - 5 May 2018
Category Front End com_content
avatar continga continga - change - 5 May 2018
The description was changed
avatar continga continga - edited - 5 May 2018
avatar SharkyKZ
SharkyKZ - comment - 5 May 2018

This is already fixed in #20229.

avatar zero-24
zero-24 - comment - 5 May 2018

As the PR #20229 got merged where the issue got adressed in a different way too I'm going to close here.

avatar zero-24 zero-24 - change - 5 May 2018
Status Pending Closed
Closed_Date 0000-00-00 00:00:00 2018-05-05 20:43:33
Closed_By zero-24
Labels Added: ?
avatar zero-24 zero-24 - close - 5 May 2018

Add a Comment

Login with GitHub to post a comment