search

Automattic / jetpack

Security, performance, marketing, and design tools — Jetpack is made by WordPress experts to make WP sites safer and faster, and help you grow your traffic.
https://jetpack.com/
Other
1.59k stars 799 forks source link

Uploaded image metadata has escaped quotes #6119

Open johngodley opened 7 years ago

johngodley commented 7 years ago

Uploading an image via the WordPress.com API to a Jetpack blog and setting either the caption or title to a string that includes a single quote results in the quotes being escaped inside WordPress.

Steps to reproduce the issue

I'm using the Lightroom plugin here which issues a /media/new request with the appropriate values set for caption and title. The same effect should be reproducable via other means (I reproduced it using curl)

  1. Export a photo to a WordPress.com blog with a title and caption that includes a single quote. Note that the media library correctly shows the values:

media_library_ _testomattic_site_s_ _wordpress

  1. Export the same photo with the same title/caption to a Jetpack site and note that the media library shows escaped values:

gfd

This is using Jetpack 4.5, WP 4.7.1, and PHP 7.0. The same behaviour has been seen on another host with PHP 5.6 and the same WP and Jetpack 4.4.2.

I'm not sure whether the problem is in the Jetpack plugin itself, or in the Jetpack part of the API, but I'm logging it here as it only affects Jetpack blogs.

jeherve commented 7 years ago

Related: #5505

thingalon commented 7 years ago

I tried to replicate this issue. I tried both with the latest Jetpack from the repo, and with Jetpack 4.5. I tried with WordPress 4.7.2, and with WordPress 4.7.1. All on PHP 7.0... and I can't replicate the issue.

I used the following query in the WP developer console: wordpress_com_console

... which correctly filled in the title and caption: media_library

@johngodley, you mentioned that you managed to replicate the issue in cURL. Would you be able to send me what your cURL POST body looked like? Please make sure you leave out any authorization headers. I am particularly interested to see the attrs in your request.

johngodley commented 7 years ago

I think this only occurs when you upload the image directly, rather than with media_urls.

This is what I'm using on a Jetpack site:

curl --form 'media[]=@lemon.jpg' --form "attrs[0][title]=title's" --form "attrs[0][caption]=This will be the caption's for file1.jpg" -H 'Authorization: BEARER XXX 'https://public-api.wordpress.com/rest/v1/sites/urbangiraffe.com/media/new' -i -v

Which results in:

{"media":[{"id":"1351","date":"2017-02-10T08:15:09+00:00","parent":0,"link":"\/images\/blog\/2017\/02\/lemon.jpg","title":"title\\'s","caption":"This will be the caption\\'s for file1.jpg"

Note the \\ in the title and caption.

Strangely when I do this against a WP.com site the title and caption are ignored.

stale[bot] commented 5 years ago

This issue has been marked as stale. This happened because:

No further action is needed. But it's worth checking if this ticket has clear reproduction steps and it is still reproducible. Feel free to close this issue if you think it's not valid anymore — if you do, please add a brief explanation.

adityabhaskar commented 4 years ago

This issue is still occurring. I spent a while trying to identify the source of those quotes, till discovering they only appear on image attributes in Jetpack sites, not on WordPress.com sites.

Is there a chance of this getting resolved? Is there a workaround to adding image attributes without those quotes that works on both Jetpack and WP.com sites?

Cheers!

Adi

adityabhaskar commented 4 years ago

@designsimply @johngodley @jeherve @thingalon

Hey folks, is there any chance of any work happening on this bug? Or a known workaround? I'll really appreciate any help!

Cheers!

Adi

jeherve commented 4 years ago

@adityabhaskar We are not working on this part of plugin at the moment, but we'll update this issue as soon as we start working on this.

adityabhaskar commented 4 years ago

@jeherve Thanks for the update!

Do you accept outside contributions? If yes, and if you could guide me to the part of the code base related to this issue, I could have a go at resolving this.

Cheers!

Adi

jeherve commented 4 years ago

We do, yes. The WordPress.com REST API lives in different places though, so I can't really tell you exactly where the problem comes from and where it can be solved without investigating further.