Automattic / jetpack

Security, performance, marketing, and design tools — Jetpack is made by WordPress experts to make WP sites safer and faster, and help you grow your traffic.
https://jetpack.com/
Other
1.59k stars 798 forks source link

Publicize: HTML entities are being encoded when they shouldn't be #4227

Open chaselivingston opened 8 years ago

chaselivingston commented 8 years ago

Steps to reproduce the issue

The user is using FeedWordPress to populate their database with links gathered from a Google alert. They're being saved correctly there, but when the posts are publicized, the links are HTML encoded, which is breaking them.

Examples: On their site: https://www.google.com/url?rct=j&sa=t&url=http%3A%2F%2Fwww.lanouvelle.net%2FActualites%2F2016-06-18%2Farticle-4564333%2FSe-preparer-a-sauver-des-vies%2F1&ct=ga&cd=CAIyG2JkNjZmZDhmMzhlMDY5MmU6Y2E6ZnI6Q0E6Ug&usg=AFQjCNFrTiFi5XShgmBON15-W_5BDDtv4g

What was publicized: https://www.google.com/url?rct=j&amp%3Bsa=t&amp%3Burl=http%3A%2F%2Fwww.lanouvelle.net%2FActualites%2F2016-06-18%2Farticle-4564333%2FSe-preparer-a-sauver-des-vies%2F1&amp%3Bct=ga&amp%3Bcd=CAIyG2JkNjZmZDhmMzhlMDY5MmU6Y2E6ZnI6Q0E6Ug&amp%3Busg=AFQjCNFrTiFi5XShgmBON15-W_5BDDtv4g

2707969-t

kraftbj commented 8 years ago

On the WP.com side'permalink' =>"https://www.google.com/url?rct=j&sa=t&url.... so something is happening when processing the sync. On the client site, the URL saved in post meta from FWP does not have these values encoded. It would seem somewhere between where the client site passes this as the permalink and when we save it as one on our end is doing this.

kraftbj commented 8 years ago

I haven't looked much more, but I'm thinking something is being escaped with esc_url, which by default will do that. Need to use esc_url( $url, null, null) to save the amps.

stale[bot] commented 6 years ago

This issue has been marked as stale. This happened because:

No further action is needed. But it's worth checking if this ticket has clear reproduction steps and it is still reproducible. Feel free to close this issue if you think it's not valid anymore — if you do, please add a brief explanation.