View Issue Details
| ID | Project | Category | View Status | Date Submitted | Last Update |
|---|---|---|---|---|---|
| 0001011 | Main CAcert Website | translations | public | 2012-01-30 20:22 | 2013-01-15 18:08 |
| Reporter | NEOatNHNG | Assigned To | NEOatNHNG | ||
| Priority | normal | Severity | minor | Reproducibility | have not tried |
| Status | closed | Resolution | fixed | ||
| Fixed in Version | 2012 Q2 | ||||
| Summary | 0001011: HTML tags in translations are not escaped | ||||
| Description | Translators could introduce HTML tags (e.g. <script>). Probably always escape the '<' and '>' and maybe also the '&' (but then we would have to get rid of all those existing HTML entities). For a few strings the HTML has to be pulled out of the gettexted string. | ||||
| Tags | No tags attached. | ||||
| Reviewed by | dastrath, NEOatNHNG | ||||
| Test Instructions | |||||
|
|
One could replace the PHP line in the makefile by: php -r 'while (!feof(STDIN)) { $$line = fgets(STDIN); $$line = strtr($$line, array("<" => "<", ">" => ">")); mb_convert_encoding($$line, "HTML-ENTITIES", "UTF-8"); echo $$line; }' But that also breaks some meta information in the PO files most notably the plural specification. So maybe we have to replace the whole gettext function calls with a custom one wrapping the standard gettext and stripping HTML special characters |
|
|
I have extended the escaping routine into a full-blown PHP script that should keep the meta data intact while escaping the rest. Please review and test whether there are major places where this escaping breaks things. |
|
|
On account.php&id=40 the link to bugs at the end of the page shows in German <a href='https://bugs.cacert.org/'>bugs.cacert.org</a> as HTML text and not as link. => OK While creating an error eg. to short titel on advertising.php the line break is visible as . =>OK |
|
|
Reviewed by Dirk, ready to go |
|
|
ready to deploy |
|
|
Mail sent to critical admins |
|
|
The patch has been installed on the production system on April 29, 2012. See also: https://lists.cacert.org/wws/arc/cacert-systemlog/2012-04/msg00012.html |
| Date Modified | Username | Field | Change |
|---|---|---|---|
| 2012-01-30 20:22 | NEOatNHNG | New Issue | |
| 2012-01-30 20:22 | NEOatNHNG | Assigned To | => NEOatNHNG |
| 2012-01-30 21:06 | NEOatNHNG | Note Added: 0002809 | |
| 2012-01-31 02:35 | NEOatNHNG | Source_changeset_attached | => cacert-devel testserver e7f53d62 |
| 2012-01-31 02:35 | NEOatNHNG | Source_changeset_attached | => cacert-devel testserver d30dd44c |
| 2012-01-31 03:05 | NEOatNHNG | Source_changeset_attached | => cacert-devel testserver 29176a66 |
| 2012-01-31 03:05 | NEOatNHNG | Source_changeset_attached | => cacert-devel testserver 56cff58b |
| 2012-01-31 03:11 | NEOatNHNG | Note Added: 0002815 | |
| 2012-01-31 03:11 | NEOatNHNG | Status | new => needs review & testing |
| 2012-01-31 03:11 | NEOatNHNG | Assigned To | NEOatNHNG => Ted |
| 2012-01-31 03:11 | NEOatNHNG | Reviewed by | => NEOatNHNG |
| 2012-02-07 22:12 | INOPIAE | Note Added: 0002825 | |
| 2012-02-07 22:29 | INOPIAE | Note Edited: 0002825 | |
| 2012-02-07 22:56 | INOPIAE | Note Edited: 0002825 | |
| 2012-02-07 23:35 | NEOatNHNG | Source_changeset_attached | => cacert-devel testserver 7ec2398e |
| 2012-02-07 23:35 | NEOatNHNG | Source_changeset_attached | => cacert-devel testserver 453ad50d |
| 2012-04-24 22:49 | INOPIAE | Note Added: 0002959 | |
| 2012-04-24 22:50 | INOPIAE | Note Added: 0002960 | |
| 2012-04-24 22:50 | INOPIAE | Assigned To | Ted => NEOatNHNG |
| 2012-04-24 22:50 | INOPIAE | Status | needs review & testing => ready to deploy |
| 2012-04-28 22:06 | NEOatNHNG | Reviewed by | NEOatNHNG => dastrath, NEOatNHNG |
| 2012-04-28 22:24 | NEOatNHNG | Note Added: 0002967 | |
| 2012-04-28 22:24 | NEOatNHNG | View Status | private => public |
| 2012-04-28 22:40 | NEOatNHNG | Source_changeset_attached | => cacert-devel release 8184d0ab |
| 2012-04-29 18:37 | wytze | Note Added: 0002971 | |
| 2012-04-29 18:37 | wytze | Status | ready to deploy => solved? |
| 2012-04-29 18:37 | wytze | Resolution | open => fixed |
| 2012-05-30 21:09 | NEOatNHNG | Status | solved? => closed |
| 2012-09-11 23:55 | NEOatNHNG | Relationship added | related to 0001097 |
| 2013-01-15 18:08 | Werner Dworak | Fixed in Version | => 2012 Q2 |
