Wrong redirect after deleting comment...

[Caspie]

Only when there are cyrillic letters in the post slug.

1. Go to single post and hit Edit link on some comment.
   
2. Delete the comment with the button from the "Status" section in "Edit Comment"
   
3. It redirects but removes all the cyrillic letters from the post slug.

Check out the images.

[Caspie]

Step 1

[Caspie]

Step 2

[Caspie]

Step 3

[hakre]

That might be related with #8446

[Denis-de-Bernardy]

nah, his sounds more like something is getting over-sanitized. It's almost certainly caused by r9592.

[hakre]

Tested. This is not reproduceable with 2.8 bleeding. Looks Fixed to me.

[Denis-de-Bernardy]

I'm definitely getting issues with a post titled:

Quisque общественных Dolor

But it looks more related to international permalink problems (covered in a separate ticket) than anything.

[hakre]

my subject line was: the cyrillic І К Л М Н Ѯ О П Ч
text was: make me wonder. the cyrillic І К Л М Н Ѯ О П Ч

will try to reproduce with your code (testing against 2.8 trunk).

[hakre]

Reproduceable with your text. Will take a closer look.

[hakre]

r9592 is not the problem. testing with that referrer: ​http://192.168.2.106/worpress-trunk/2009/04/29/quisque-%d0%be%d0%b1%d1%89%d0%b5%d1%81%d1%82%d0%b2%d0%b5%d0%bd%d0%bd%d1%8b%d1%85-dolor/comment-page-1/

and cleanurl and stripslashes do not make any probs with that.

anyway an attr() should be added on that line.

[hakre]

Referrer is written correctly into the comment edit form.

[hakre]

url parameter values should be urlencoded...

[hakre]

Found the Bug. Zapped. Tested. Fixed. Please Review.

[automattor]

(In [11120]) urlencode referrer. Props hakre. fixes #8587

[Denis-de-Bernardy]

aren't we double escaping with attr(clean_url($url)) in r11120?

[Denis-de-Bernardy]

I thought that clean_url was turning & into & already. Re-close as fixed if not, else I believe that part needs to be reverted.

[ryan]

(In [11127]) No need to attribute_escape a cleaned url. fixes #8587

[hakre]

shure that clean_url properly sanitizes user input injected via the referrer header?

[Denis-de-Bernardy]

Replying to hakre:

shure that clean_url properly sanitizes user input injected via the referrer header?

clean_url outputs what it's name suggests: a cleaned up url. :-)

[hakre]

clean_url is a gemischtwarenladen* for "whatever URL". kinda filtering but it does not know for what exactly it is filtering. it even ignores the most basic things of an URL as describben in RFC1738.

within wordpress it is widely used for attribute values but might be unfitting there. normally that means, it needs additional processing, like done with attr(). anyway, it is common sense with wordpress developing not to do so (right now), so please leave this buggy but closed.

*gemischtwarenladen: german metaphor, no idea in english. "pick and mix" attitude maybe?

[Denis-de-Bernardy]

Let's open a separate ticket for that. My personal take would be that it should *not* encode the &. (In which case the attr() call becomes valid.) But it's a personal taste...

[hakre]

Replying to Denis-de-Bernardy:

Let's open a separate ticket for that. My personal take would be that it should *not* encode the &. (In which case the attr() call becomes valid.) But it's a personal taste...

yeah nothing to get clear for 2.8. & is already encoded. that is xhtml encoding of an URL.

[hakre]

Replying to Denis-de-Bernardy:

aren't we double escaping with attr(clean_url($url)) in r11120?

for the &, yes.