Uploaded image for project: 'Islandora'
  1. Islandora
  2. ISLANDORA-1608

Wrong double encoding for some $object->labels when used in display

    Details

      Description

      Compound solution pack, when working in JAIL mode composites the main object's label and a child one into the page title using drupal_set_title.
      This can be seen at:

      https://github.com/Islandora/islandora_solution_pack_compound/blob/7.x/islandora_compound_object.module#L528-L533

      This piece of code, part of https://github.com/Islandora/islandora_solution_pack_compound/pull/56

      Double encodes entities like "&".
      drupal_set_title() by default uses check_plain https://api.drupal.org/api/drupal/includes%21bootstrap.inc/function/drupal_set_title/7 for output
      filter_xss() converts & to &
      This produces a double "&" encoding.

      Since the expected behaviour is to not render HTML in titles (for object labels, because check_plains disallows them, having filter_xss is not a good idea, because that particular function was build to deal with HTML.

      Solution (pull to come) is:

      `if ($compound_info)

      { drupal_set_title(t('@parent - @child', array( '@parent' => $compound_info['parent_label'], '@child' => $compound_info['label'], )), PASS_THROUGH); }

      `
      Allow @ replacement to deal with check_plain (same functionality as doing a direct drupal_set_title) and make drupal_set_title bypass check plain.

      This behaviour is also seen in islandora core, when editing an object label (properties management) and adding html to the label, makes the "delete button" which displays the object label double encode html and entities.
      At: https://github.com/Islandora/islandora/blob/7.x/includes/object_properties.form.inc#L89-L90

      The label is passed as @ which already does check_plain and then during theming drupal uses https://api.drupal.org/api/drupal/includes%21common.inc/function/drupal_attributes/7
      applying check_plain() again.

      Same for the message after label change
      https://github.com/Islandora/islandora/blob/7.x/includes/object_properties.form.inc#L132-L134

        Attachments

          Activity

            People

            • Assignee:
              dpinokrayon Diego Pino Navarro
              Reporter:
              dpinokrayon Diego Pino Navarro
            • Votes:
              0 Vote for this issue
              Watchers:
              3 Start watching this issue

              Dates

              • Created:
                Updated:
                Resolved:

                Time Tracking

                Estimated:
                Original Estimate - 1 day
                1d
                Remaining:
                Remaining Estimate - 1 day
                1d
                Logged:
                Time Spent - Not Specified
                Not Specified