This repository has been archived by the owner on Jan 10, 2020. It is now read-only.
This repository has been archived by the owner on Jan 10, 2020. It is now read-only.
Model attributes converted to HTML incorrectly #168
Open
Description
Describe the bug
When updating a model attribute (blog title, event title, page title, faq question, menu name or widget name), the attribute gets converted to HTML. The input is HTML escaped every time.
To Reproduce
Steps to reproduce the behavior:
- Go to 'CMS'
- Click on 'Pages'
- Click on 'Edit' of a row
- Add a special html character into the title box, i.e.
"Sons & Daughters"
- Click Save. The title box shows
"Sons & Daughters"
- Click Save again. The title box shows
"Sons & Daughters"
Expected behavior
The value of the attributes should be displayed exactly at it was entered.
Additional context
These lines convert user input to html incorrectly:
vendor\grafite\cms\src\Repositories
BlogRepository.php
$payload['title'] = htmlentities($payload['title']);
$payload['title'] = htmlentities($payload['title']);
EventRepository.php
$payload['title'] = htmlentities($payload['title']);
$payload['title'] = htmlentities($payload['title']);
FAQRepository.php
$payload['question'] = htmlentities($payload['question']);
$payload['question'] = htmlentities($payload['question']);
MenuRepository.php
$payload['name'] = htmlentities($payload['name']);
$payload['name'] = htmlentities($payload['name']);
PageRepository.php
$payload['title'] = htmlentities($payload['title']);
$payload['title'] = htmlentities($payload['title']);
WidgetRepository.php
$payload['name'] = htmlentities($payload['name']);
$payload['name'] = htmlentities($payload['name']);
Possible solution
Remove these lines.
Metadata
Assignees
Labels
No labels
Activity