avatar zero-24
zero-24
7 Apr 2015

Steps to reproduce the issue

See:
http://issues.joomla.org/tracker/joomla-cms/6685

and
http://issues.joomla.org/tracker/joomla-cms/6684

The first Differences Tab.

There we remove code like <jdoc> and <input type=text /> from the title

Expected result

The title will not changed automagic

Actual result

The title is changend by JTracker itself without user action.

avatar zero-24 zero-24 - open - 7 Apr 2015
avatar mbabker
mbabker - comment - 7 Apr 2015

I'm not so sure how I feel about this one. To change this in essence requires us to allow HTML input in the title and description fields and implement a filter that matches GitHub so we aren't opening ourselves up to a hack.

avatar zero-24
zero-24 - comment - 7 Apr 2015

as for description it works ok with commenting like <br> but not for title see: http://issues.joomla.org/tracker/jtests/82 (try to use esting <br>)

if someone what us to hack this days he needs to open a issue on github with the code into the title this gets synced without cleaning into JTracker. Only on saving the issue it gets cleaned.

Did we have a chance to handel it by only removing the <...>? I'm not sure for the security impact.

But so we have all data there ;) If someone realy need full HTML Codes they should use commeting like <your very bad html or other code> into the description

avatar mbabker
mbabker - comment - 7 Apr 2015

Description works fine because it doesn't filter data (we may be able to put the HTML filter around that, not so sure what side effects it could cause); the title is filtered as a string through the filter package. As for the hooks they probably need to be refactored to store through the IssueModel versus IssueTable object as the model is doing all the filtering.

avatar b2z
b2z - comment - 16 Apr 2015

So #639 should fix it?

avatar mbabker
mbabker - comment - 16 Apr 2015

Well, partially. Now both sides should be using the same rules. But, HTML is getting stripped in the title for both elements now. So, we may need to use the HTML filter in Joomla's InputFilter object to make things work.

avatar zero-24 zero-24 - change - 17 Oct 2015
Title
JTracker clean the title with
JTracker clean the title with
Status New Closed
Closed_Date 0000-00-00 00:00:00 2015-10-17 22:54:30
Closed_By zero-24
avatar zero-24 zero-24 - close - 17 Oct 2015

Add a Comment

Login with GitHub to post a comment