Make WordPress Core

Opened 13 years ago

Closed 7 years ago

Last modified 7 years ago

#14268 closed defect (bug) (fixed)

Comments editor HTML tag

Reported by: pkirk's profile pkirk Owned by: ocean90's profile ocean90
Milestone: 4.6 Priority: normal
Severity: normal Version: 3.0
Component: Text Changes Keywords:
Focuses: Cc:


With a vanilla (2.8.4 -> 3.0) installation, if you go and edit the comment from Mr Wordpress, you will see that in the editor you can find the HTML code of the apostrophe for "post's".

Hi, this is a comment.<br />To delete a comment, just log in and view the post&#039;s comments. There you will have the option to edit or delete them.

The problem comes with a production env with European languages where comments are full of accented letters that make the reading almost impossible.

Attachments (1)

esc_html_comment_form.php (368 bytes) - added by scribu 13 years ago.
Force esc_html() escaping

Download all attachments as: .zip

Change History (10)

#1 @scribu
13 years ago

This would be a case for using esc_html() instead of esc_textarea(). See #15454

#2 @scribu
13 years ago

... because esc_html() doesn't escape special characters.

13 years ago

Force esc_html() escaping

#3 @scribu
13 years ago

  • Milestone changed from Awaiting Review to 3.1

Turns out the content is escaped twice: first in get_comment_to_edit() and then again in wp_htmledit_pre().

In esc_html_comment_form.php I had to use $wpdb directly because the cached version returned from get_comment() is the escaped one. This should definitely be fixed.

#4 @scribu
13 years ago

Actually, the problem is that get_comment() checks $GLOBALScomment?.

#5 @scribu
13 years ago

  • Keywords needs-patch added
  • Milestone changed from 3.1 to Future Release

No easy fix for this, unfortunately. Punting.

#6 @nacin
9 years ago

  • Component changed from General to Text Changes

What we should actually do is remove the entity from upgrade.php, and let texturize do the work. Otherwise, what's happening when editing the comment appears to be proper, as this *is* what's in the DB.

This ticket was mentioned in Slack in #core by sergey. View the logs.

8 years ago

#9 @ocean90
7 years ago

  • Owner set to ocean90
  • Resolution set to fixed
  • Status changed from new to closed

In 37888:

Comments: Improve author and content of the default comment.

The new comment:

A WordPress Commenter <wapuu@wordpress.example>:

Hi, this is a comment.
To moderate comments, just log in. There you will have the option to edit or delete them.
Commenter avatars come from <a href="">Gravatar</a>.

Also introduces a network setting to set the email address of the first comment author on a new site.

Props Ipstenu, rachelbaker, jorbin, jeremyfelt.
Fixes #36702, #14268.

#10 @ocean90
7 years ago

  • Keywords needs-patch removed
  • Milestone changed from Future Release to 4.6
Note: See TracTickets for help on using tickets.