Geeklog-Core / geeklog

Geeklog - The Secure CMS.
https://www.geeklog.net
24 stars 19 forks source link

Article Submission HTML View and Preview Button Acts like Submission #1031

Closed eSilverStrike closed 4 years ago

eSilverStrike commented 4 years ago

When you contribute an article (that goes into the submission queue) hitting the preview button a second time actual submits the article instead of previewing it again.

In HTML post mode when previewed the previews shows certain HTML code for some reason. For example the spans from this text (which was copied and pasted from a popular Word Processor):

<p style="text-align:start; text-indent:0px; -webkit-text-stroke-width:0px"><span style="font-size:medium"><span style="font-family:Calibri, sans-serif"><span style="caret-color:#000000"><span style="color:#000000"><span style="font-style:normal"><span style="font-variant-caps:normal"><span style="font-weight:normal"><span style="letter-spacing:normal"><span style="orphans:auto"><span style="text-transform:none"><span style="white-space:normal"><span style="widows:auto"><span style="word-spacing:0px"><span style="-webkit-text-size-adjust:auto"><span style="text-decoration:none">This is a test. This is a test. This is a test.</span></span></span></span></span></span></span></span></span></span></span></span></span></span></span></p>

Looking at the source of the page the html tags have been converted to html entities so maybe the preview doesn't know the post mode is html???

eSilverStrike commented 4 years ago

@mystralkk Okay tested preview button and submit with recaptcha invisible and v2, with and without advanced editor, and it looks to be working now. Geeklog.net has been updated with the latest code.

In regards to the html tags showing in html mode.

Submit.php calls STORY_renderArticle in lib-article. It then calls getPreviewText from the article class which then uses GLText::getPreviewText. For some reason when htmlLawed is used it is converting the html that users do not have access to, to entities and not removing them.

I must be missing something as I I don't really see why (COM_mail does get them removed by _htmLawed I believe, see issue #1000)

mystralkk commented 4 years ago

How about changing the line 333 of "gltext.class.php" from

            'keep_bad'           => 1, // Neutralize both tags and element content

to

            'keep_bad'           => 4, // Remove tags but neutralize element content if text (pcdata) is invalid in parent element

? Source: http://www.bioinformatics.org/phplabware/internal_utilities/htmLawed/htmLawed_README.htm

eSilverStrike commented 4 years ago

Ahh that seems to work. I had read the doc but thought keep_bad only had 2 options.

I also notice that article submissions doesn't strip this extra html tags on save. (like it does for comments and if article submission are not queued) so I will update the article submission save function.

eSilverStrike commented 4 years ago

This commit fixes article submissions on save will strip the html tags that the user doesn't have access to when the article submission queue is enabled. 6fe1a3a522dc5c8c816ec9226f3a950274645007