search

WonderCMS / wondercms

Fast and small flat file CMS (5 files). Built with PHP, JSON database.
https://wondercms.com
MIT License
642 stars 163 forks source link

System administration should escape data #298

Open joho1968 opened 1 year ago

joho1968 commented 1 year ago

If I specify the string <a href="https:// åäö, this is cool!, the admin interface does not seem to work very well when I click on the Menu option. I think all output in the System administration section need to escape configuration option values, using htmlentities() or some other mechanism.

joho1968 commented 1 year ago

Having said that, my "trial theme" does precisely that and seem to break the Simple Blog plugin (in one distinct place).

robiso commented 8 months ago

Hello @joho1968, when trying to reproduce the issue with a page named: "åäö, this is cool!", everything worked as expected, would you mind providing a screenshot of the issue?

joho1968 commented 8 months ago

You need to enter the full HTML above: <a href="https:// åäö, this is cool! and then WonderCMS starts to behave somewhat erratically.

This is what I get when I'm in the Menu section of admin:

image

Unfortunately, it's very hard to take a screenshot after clicking on the "Edit" button for the field, but it contains a lot of strange HTML, etc.