HTMLSpecialChars() Double escaping default to false #9557
Conversation
There was a problem hiding this comment.
wasn't totally sure about this one
There was a problem hiding this comment.
Better to be more aggressive than less in updating these
|
Can you rebase this on main? |
Is this what you meant? Or a rebase via my VM and resending the code |
|
You need to do both as it now includes unrelated changes. |
Hmm I had tried that but got a number of conflicts |
d8c3c3f to
e23ca66
Compare
e23ca66 to
208d05f
Compare
htdocs/installdb.php
Outdated
| ); | ||
| $installer->getConfigContent($_POST), | ||
| ENT_QUOTES | ENT_SUBSTITUTE | ENT_HTML5, | ||
| null, false); |
There was a problem hiding this comment.
@KLaFleur please breakdown all the functions properly
php/installer/Installer.class.inc
Outdated
| }, | ||
| return htmlspecialchars($val, | ||
| ENT_XML1 | ENT_SUBSTITUTE | ENT_HTML5, 'ISO-8859-1', | ||
| null, false); |
There was a problem hiding this comment.
@KLaFleur too many arguments there
208d05f to
0df0d26
Compare
changed formatting to keep lines under 85 char + added a few missed instances of htmlspecialchars()
0df0d26 to
63984ca
Compare
|
@KLaFleur Please fix the tests on this. It looks like it's failing on PHPCS and most of them can be autofixed with |
|
This appears to be failing because of a bug in phan. The parameter it's complaining about is nullable according to the PHP documentation: https://www.php.net/manual/en/function.htmlspecialchars.php I think for now, you should explicitly set it to 'UTF-8' to get around the errors. It's technically not the same meaning, but our encodings should pretty much always be utf8. |
40e765d to
0f2de3b
Compare
Brief summary of changes
updated all instances of htmlspecialchars() to turn off double escaping