Issue Details (XML | Word | Printable)

Key: MDL-19324
Type: Bug Bug
Status: Open Open
Priority: Major Major
Assignee: Koen Roggemans
Reporter: Jeffrey Silverman
Votes: 0
Watchers: 2
Operations

Add/Edit UI Mockup to this issue
If you were logged in you would be able to see more operations.
Moodle

Lang files do not excape single quotes in the string index; can cause site failure, especially when editing local lang files for contrib plugins

Created: 28/May/09 11:02 PM   Updated: 28/May/09 11:49 PM
Return to search
Component/s: Languages
Affects Version/s: 1.9.5
Fix Version/s: None

Environment: n/a

Participants: Jeffrey Silverman, Koen Roggemans and Petr Skoda
Security Level: None
Difficulty: Easy
Affected Branches: MOODLE_19_STABLE


 Description  « Hide
Some descriptive background first...

 - Single quotes are technically allowed by PHP in array indexes. It is not good coding practice though!
 - The $string variable is an array, and thus technically allows a single quote.
 - If you include a single quote in the index, and then do "local language editing" through the Moodle interface for that, Moodle does not escape the single quote.

Easy fix: escape the single quote in the string *index* as well as in the value.

Simple workaround: Don't edit lang files that suffer from this issue.

At least one contrib module suffers from this problem, which I have detailed here: CONTRIB-1264

The Wimba "Liveclassroom" module. Example snippet from that file: Line 129

----- BEGIN -----
$string['Enable Student\'s microphones at presentation start'] = "Enable Student's microphones at presentation start";
----- END -----

I know the reason why single quotes are used in the string indexes is because they just use the same value for the index and the value. But I'm not saying it is a good idea.

Thanks!

 All   Comments   Change History   Version Control      Sort Order: Ascending order - Click to sort in descending order
Petr Skoda added a comment - 28/May/09 11:49 PM
solution is to use var_export() instead of custom escaping code