[#22693] - language switcher generated URI show "&" instead of "&"
- Closed
- 21 Oct 2018
- Medium
- Build: staging
- # 22693
Steps to reproduce the issue
create a multilingual site.
do NOT enable SEF URL's
Expected result
URI under the flags to show URI with & as separator of the querystring
Actual result
URI under the flags do show URI querystring separator as &
System information (as much as possible)
My system is J!3.8.13 on PHP7.2.11, MySQL5.5.33, Apache2.2.15
Additional comments
See also https://forum.joomla.org/viewtopic.php?p=3544309
Possible solution that works for me:
replace all
htmlspecialchars(JUri::current(), ENT_COMPAT, 'UTF-8')
with
JUri::current()
joomla-cms-bot
- | Title |
|
||||||
| Labels |
Added:
?
|
||||||
| Status | New | ⇒ | Closed |
| Closed_Date | 0000-00-00 00:00:00 | ⇒ | 2018-10-19 13:20:32 |
| Closed_By | ⇒ | infograf768 |
Closing. This is not a bug. It was changed for security reason:
https://developer.joomla.org/security-centre/740-20180602-core-xss-vulnerability-in-language-switcher-module
Maybe reopen..
Change
htmlspecialchars($language->link, ENT_QUOTES, 'UTF-8')
into
JFilterOutput::ampReplace(htmlspecialchars($language->link, ENT_QUOTES, 'UTF-8', FALSE))
Works too.. same format as used in menu module. That should do it I assume. At least with me.
Forwarded to JSST to check if that does not re-introduce the vulnerability.
| Status | Closed | ⇒ | New |
| Closed_Date | 2018-10-19 13:20:32 | ⇒ | |
| Closed_By | infograf768 | ⇒ |
I am told it's OK to patch this way.
Reopened.
Can you propose the PR?
in fact, do not worry about that. I will include that patch in a pending PR i made for this module.
Sorry I am out for the weekend.. did not read this any earlier to respond.. thanks! Keep up the good work!
| Status | New | ⇒ | Closed |
| Closed_Date | 0000-00-00 00:00:00 | ⇒ | 2018-10-21 04:36:10 |
| Closed_By | ⇒ | infograf768 |
Hmm
In fact I have tested this here and there is no change in the link produced...
I should have tested before.
| Status | Closed | ⇒ | New |
| Closed_Date | 2018-10-21 04:36:10 | ⇒ | |
| Closed_By | infograf768 | ⇒ |
Reverting JFilterOutput::ampReplace as this will not do the job.
reopening.
I may have another solution.
Will keep you posted.
| Status | New | ⇒ | Closed |
| Closed_Date | 0000-00-00 00:00:00 | ⇒ | 2018-10-21 09:46:24 |
| Closed_By | ⇒ | infograf768 |
tagging this one in case someone is in the mood for both at the same time #22713