WordPress.org

Make WordPress Core

Opened 6 years ago

Closed 2 months ago

Last modified 2 months ago

#14268 closed defect (bug) (fixed)

Comments editor HTML tag

Reported by: pkirk Owned by: ocean90
Milestone: 4.6 Priority: normal
Severity: normal Version: 3.0
Component: Text Changes Keywords:
Focuses: Cc:

Description

With a vanilla (2.8.4 -> 3.0) installation, if you go and edit the comment from Mr Wordpress, you will see that in the editor you can find the HTML code of the apostrophe for "post's".

Hi, this is a comment.<br />To delete a comment, just log in and view the post&#039;s comments. There you will have the option to edit or delete them.

The problem comes with a production env with European languages where comments are full of accented letters that make the reading almost impossible.

Attachments (1)

esc_html_comment_form.php (368 bytes) - added by scribu 6 years ago.
Force esc_html() escaping

Download all attachments as: .zip

Change History (10)

#1 @scribu
6 years ago

This would be a case for using esc_html() instead of esc_textarea(). See #15454

#2 @scribu
6 years ago

... because esc_html() doesn't escape special characters.

@scribu
6 years ago

Force esc_html() escaping

#3 @scribu
6 years ago

  • Milestone changed from Awaiting Review to 3.1

Turns out the content is escaped twice: first in get_comment_to_edit() and then again in wp_htmledit_pre().

In esc_html_comment_form.php I had to use $wpdb directly because the cached version returned from get_comment() is the escaped one. This should definitely be fixed.

#4 @scribu
6 years ago

Actually, the problem is that get_comment() checks $GLOBALScomment?.

#5 @scribu
6 years ago

  • Keywords needs-patch added
  • Milestone changed from 3.1 to Future Release

No easy fix for this, unfortunately. Punting.

#6 @nacin
3 years ago

  • Component changed from General to Text Changes

What we should actually do is remove the entity from upgrade.php, and let texturize do the work. Otherwise, what's happening when editing the comment appears to be proper, as this *is* what's in the DB.

This ticket was mentioned in Slack in #core by sergey. View the logs.


11 months ago

#9 @ocean90
2 months ago

  • Owner set to ocean90
  • Resolution set to fixed
  • Status changed from new to closed

In 37888:

Comments: Improve author and content of the default comment.

The new comment:

A WordPress Commenter <wapuu@wordpress.example>:

Hi, this is a comment.
To moderate comments, just log in. There you will have the option to edit or delete them.
Commenter avatars come from <a href="https://gravatar.com">Gravatar</a>.

Also introduces a network setting to set the email address of the first comment author on a new site.

Props Ipstenu, rachelbaker, jorbin, jeremyfelt.
Fixes #36702, #14268.

#10 @ocean90
2 months ago

  • Keywords needs-patch removed
  • Milestone changed from Future Release to 4.6
Note: See TracTickets for help on using tickets.