Feeling Lucky
No Code Attached Yet
[#36299] - SimpleXMLElement::xpath(): Invalid predicate in /libraries/src/Form/Form.php on line 1682
- Closed
- 13 Nov 2022
- Medium
- Build: 4.0-dev
- # 36299
Steps to reproduce the issue
Hi! Double quotes (and other special chars, I suppose) are not encoded and it causes problems with names containing ones:
$fields = $this->xml->xpath('//field[@name="' . $name . '" and not(ancestor::field/form/*)]');
Where $name must be sanitized before applying.
File /libraries/src/Form/Form.php
- Joomla 3: line 1682
- Joomla 4: line 1374
I don't know if there are other parts of the code that must be corrected.
joomla-cms-bot
- | Labels |
Added:
No Code Attached Yet
|
||
| Status | New | ⇒ | Closed |
| Closed_Date | 0000-00-00 00:00:00 | ⇒ | 2022-11-13 09:58:15 |
| Closed_By | ⇒ | joomdonation |
I'm closing this issue for now. While your finding is correct, most of the variable usage here is name of field, name of fieldset or group and should not contains special characters. Adding code to handle this case will make the code becomes unnecessary complicated. It has been working well for us for years, so I guess we do not really need to change it
If you do not agree, feel free to re-open and I will ask our maintainer team to check and reply you further. Thanks !