search

PHPfox-Official / phpfox-v4-issues

phpFox Public Bug Tracker
https://phpfox.com
30 stars 21 forks source link

Localized text phrase "align_left" breaks javascript code if contains quote #3027

Open daniol opened 2 years ago

daniol commented 2 years ago

What's happened?

If the the text phrase with var_name="align_left" contains a quote ', the complete site gets unusable because the generated javascript code is broken as it is not escaped with a backslash \'. It produces a hundred of errors that can be seen on the javascript console.

Steps to reproduce:

  1. Add a quote in the phrase var_name="align_left" (see screenshot below)

What's expected?

All localized strings should be properly escaped. Quotes should be escaped with a backslash.

Server information

PHP Version 7.3.28

phpFox version

phpfox 4.8.8 (problem did not exist on previous versions)

Screenshots

Database entry: alinea

Broken JS code: htmljscode Text correctly escaped with backslash marked in blue. Affected text not escaped marked in red (backslash is missing).

Notices

harrison05 commented 2 years ago

Hi @daniol

We will check this issue. Thanks for your report.