No Code Attached Yet
avatar keewhip
keewhip
8 May 2023

Since J4 the escape function in \libraries\src\MVC\View\HtmlView.php - Line 233 includes single quotes by passing the ENT_QUOTES flag to htmlspecialchars()

The escape method is used to strip html from the feed item title by first escaping the item title.
Then the title is decoded by html_entity_decode using the ENT_COMPAT flag
This causes the html-single-quote-entity (') to remain in the title.

I guess the title is amp_replaced on parsing the rss feed causing the ' to become ' in the final output.

Steps to reproduce the issue

Create an article in category EXAMPLE (category id = 1) with single quotes in the title.
title = This is a 'test' article

Display a feed from this category index.php?option=com_content&view=category&id=1&format=feed&type=rss

Expected result

Well formed RSS feed which shows this title element:
<title>This is a 'test' article</title>

Actual result

<title>This is a &amp;#039;test&amp;#039; article</title>

System information (as much as possible)

Joomla 4.3.1
PHP 8.1.10

Additional comments

Changing the flag to ENT_QUOTES in the html_entity_decode function fixes the issue.

Current situation:

$title = "This is a 'test' article";

$title = htmlspecialchars($title, ENT_QUOTES, 'UTF-8');
echo $title;

$title = html_entity_decode($title, ENT_COMPAT, 'UTF-8');
echo $title;

This is a &#039;test&#039; article
This is a &#039;test&#039; article

Fixed:

$title = "This is a 'test' article";

$title = htmlspecialchars($title, ENT_QUOTES, 'UTF-8');
echo $title;

$title = html_entity_decode($title, ENT_QUOTES, 'UTF-8');
echo $title;

This is a &#039;test&#039; article
This is a 'test' article
avatar keewhip keewhip - open - 8 May 2023
avatar keewhip keewhip - change - 8 May 2023
Labels Removed: ?
avatar joomla-cms-bot joomla-cms-bot - change - 8 May 2023
Labels Added: No Code Attached Yet
avatar joomla-cms-bot joomla-cms-bot - labeled - 8 May 2023
avatar keewhip
keewhip - comment - 8 May 2023

Fix for this issue in /libraries/src/MVC/View/CategoryFeedView.php

LINES 86 - 92

            // Strip html from feed item title
            if ($titleField) {
                $title = $this->escape($item->$titleField);
                $title = html_entity_decode($title, ENT_QUOTES, 'UTF-8');
            } else {
                $title = '';
            }
```<hr /><sub>This comment was created with the <a href="https://github.com/joomla/jissues">J!Tracker Application</a> at <a href="https://issues.joomla.org/tracker/joomla-cms/40558">issues.joomla.org/tracker/joomla-cms/40558</a>.</sub>
avatar richard67 richard67 - close - 8 May 2023
avatar richard67
richard67 - comment - 8 May 2023

Closing as having a pull request. See #40559 .

avatar richard67 richard67 - change - 8 May 2023
Status New Closed
Closed_Date 0000-00-00 00:00:00 2023-05-08 11:49:49
Closed_By richard67
avatar keewhip keewhip - change - 8 May 2023
The description was changed
avatar keewhip keewhip - edited - 8 May 2023

Add a Comment

Login with GitHub to post a comment