[#MDL-10633] Event names in Calendar are not properly escaped with recursive_stripslashes

Issue Details (XML | Word | Printable)

Key:	MDL-10633
Type:	Bug
Status:	Closed
Resolution:	Fixed
Priority:	Minor
Assignee:	Dongsheng Cai
Reporter:	Kenneth Newquist
Votes:	10
Watchers:	5

Operations

Add/Edit UI Mockup to this issue

If you were logged in you would be able to see more operations.

Moodle

Event names in Calendar are not properly escaped with recursive_stripslashes

Created: 28/Jul/07 05:55 AM Updated: 10/Jul/08 04:33 PM

Component/s:

Calendar

Affects Version/s:

1.8.5, 1.9.1

Fix Version/s:

1.8.6, 1.9.2

File Attachments:	1. calendar_recursive_event_patch.txt (0.8 kB)
Environment:	Moodle 1.8.2+ (2007021520)

Participants:	Dongsheng Cai, Eloy Lafuente (stronk7), Kenneth Newquist, Nicolas Connault and Petr Skoda
Security Level:	None
QA Assignee:	Petr Skoda
Resolved date:	02/Jul/08
Affected Branches:	MOODLE_18_STABLE, MOODLE_19_STABLE
Fixed Branches:	MOODLE_18_STABLE, MOODLE_19_STABLE

Description

« Hide

Event titles in Calendar are not properly escaped for events spanning multiple days because it relies on "stripslashes" rather than "recursive_stripslashes" in /htdocs/calendar/event.php

This works for single events, but not multpile events, presmably because the names for multiple events are stored in an array.

The following code (on lines 163 and 173):

$form->name = stripslashes($form->name);

Needs to be replaces with:

$form->name = stripslashes_recursive($form->name);

All

Comments

Change History

Version Control

Sort Order:

[ Permalink | « Hide ]

Kenneth Newquist added a comment - 16/Oct/07 09:27 PM

[bump]

[ Permalink | « Hide ]

Kenneth Newquist added a comment - 06/Jan/08 03:37 AM

This bug remains in Moodle 1.8.3 (2007021534).

To recreate it:

1. Create an event with quotes in the header or single quotes in the body.
2. Set the event to repeat for multiple days.
3. Save the event.
4. Open the event for editing. The slashes appear in the quotes and are saved when you save the event,.

[ Permalink | « Hide ]

Kenneth Newquist added a comment - 20/Jun/08 12:36 AM

This problem still exists in Moodle 1.9.1.

[ Permalink | « Hide ]

Kenneth Newquist added a comment - 20/Jun/08 03:24 AM

I verified the bug still exists in Moodle 1.9.1 (Build: 20080515). My proposed fix from way back in 1.7, however, is wrong; as that dealt with the logged version of the form name. I think the proper fix is to strip the slashes when loading the form data, and I've generated a patch that reflects that.

[ Permalink | « Hide ]

Eloy Lafuente (stronk7) added a comment - 22/Jun/08 09:17 AM

Hi Dongsheng, can you please take a look to this? TIA!

Ciao

[ Permalink | « Hide ]

Dongsheng Cai added a comment - 27/Jun/08 11:06 AM

Hi, Kenneth, thanks your patch, stripshashes and addslashes are called several times during these process, single and double quotes will be escaped again, so your change is good.