![(please configure the [header_logo] section in trac.ini)](/chrome/site/your_project_logo.png){kind=logo}
Opened 12 years ago
Closed 11 years ago
#27942 closed defect (bug) (fixed)
Site Title not escaped when using HTML entities
| Reported by: | BandonRandon | Owned by: | kovshenin |
|---|---|---|---|
| Priority: | normal | Milestone: | 4.5 |
| Component: | Options, Meta APIs | Version: | 2.9 |
| Severity: | normal | Keywords: | has-patch has-unit-tests commit |
| Cc: | Focuses: | administration |
Description
Today I tried to set my site title to <Brooke><Codes> and learned that the site title field escapes the < character. This is fine I thought, I'll use HTML entities. While this worked at first this also failed in the end. Is there a way to use the same escaping used on posts titles on site titles?
Here are a few screenshots to show the problem:
Title using HTML entities:
After saving the above:
After saving the above:
To me the real issue is that it fails silently. I know enough to know why it fails but to many of our users they may have a WTF reaction.
Attachments (6)
Change History (19)
#3
@
12 years ago
- Focuses administration added
- Keywords needs-unit-tests added
- Version trunk → 2.9
Seems like a simple fix, should probably update the patch to space out the attribute to conform with the coding standards.
I did test a few versions back, and in 2.0 when sanitize_option was introduced this was not a problem, but in 2.9 it does happen, so somewhere along that road a regression occurred that was missed.
We should probably also have unit tests for sanitize_option when considering all the functions the various cases relies on.
#4
@
12 years ago
Should probably update the patch to space out the attribute to conform with the coding standards.
Added in 27942.2.patch
This ticket was mentioned in IRC in #wordpress-dev by Clorith. View the logs.
12 years ago
#10
@
11 years ago
- Keywords needs-testing has-unit-tests added
Updated patch against trunk and added unit test.
#11
@
11 years ago
- Keywords 2nd-opinion added
Seems to work. Unit tests pass. Much better user experience.
I dung into this some more and learned that you are able to use valid HTML in the site title. For example if you decided to use
<em>Site</em> <strong> Title</strong>the title will save and output correctly.It looks like this problem is only occurring when using invalid HTML.
I have submitted a patch that switches from using
wp_kses_posttohtmlentities2in formatting.php resolving this issue.