[GLPI 10.0.0-rc2] HTML source rendering in ITIL objects

VladoTTX commented 2 years ago

Code of Conduct

[X] I agree to follow this project's Code of Conduct

Is there an existing issue for this?

[X] I have searched the existing issues

Version

10.0.0-rc2

Bug description

Noticed this with forms but I assume this is more general problem with rendering of HTML from content fields so I rather summit the issue to the project.

If in source code of "content" for example in tickets or follow-ups contains both types of HTML escaping like < > and < and > result is that content is rendered fully escaped. Example one with combination:

&lt;div&gt;&lt;h1&gt;Form data&lt;/h1&gt;&lt;h2&gt;TEST SECTION&lt;/h2&gt;&lt;div&gt;&lt;b&gt;1) Description : &lt;/b&gt;&#60;p&#62;TEST&#60;/p&#62;&lt;/div&gt;&lt;div&gt;&lt;b&gt;2) Attachment : &lt;/b&gt;No attached document&lt;/div&gt;&lt;div&gt;&lt;b&gt;3) TEST1 : &lt;/b&gt;3&lt;/div&gt;&lt;div&gt;&lt;b&gt;4) TEST2 : &lt;/b&gt;3181&lt;/div&gt;&lt;/div&gt;

Example 2 with just < and >

&lt;div&gt;&lt;h1&gt;Form data&lt;/h1&gt;&lt;h2&gt;TEST SECTION&lt;/h2&gt;&lt;div&gt;&lt;b&gt;1) Description : &lt;/b&gt;&lt;p&gt;TEST&lt;/p&gt;&lt;/div&gt;&lt;div&gt;&lt;b&gt;2) Attachment : &lt;/b&gt;No attached document&lt;/div&gt;&lt;div&gt;&lt;b&gt;3) TEST1 : &lt;/b&gt;3&lt;/div&gt;&lt;div&gt;&lt;b&gt;4) TEST2 : &lt;/b&gt;3181&lt;/div&gt;&lt;/div&gt;

Relevant log output

No response

Page URL

No response

Steps To reproduce

No response

Your GLPI setup information

GLPI 10.0.0-rc2 with Formcreator 2.12.2

Anything else?

Looks like different escaping is used for fields itself in input and whole content which cases these double types. I am not sure why it should be a problem to combine both types of escaping.

cedric-anne commented 2 years ago

@btry

I think the issue has to be fixed in Fromcreator side.

cedric-anne commented 2 years ago

@VladoTTX

Could you try with Formcreator v2.13.0-alpha.3 ?

btry commented 2 years ago

Hi

I had similar report with Formcreator + GLPI 9.5. HTML tags appears when an answer to a textarea question contains < br / >. @VladoTTX : This report should be created in Formcreator.

VladoTTX commented 2 years ago

@btry from what I have seen problem is with formcreator generating both types of escaping. It is not related only to <br/> This happens in case Text Area is used both < > and < and >

I've tried also with the 2.13.0-alpha3 and issue is still present. I'll open issue to formcreator, but for me it looks like generic issue.

@trasher is this expected behavior of HTML content in GLPI now? Does it need to contain just one type of escaping of HTML brackets?

btry commented 2 years ago

With GLPI 10 escaping HTML tags changed. This is a game changing point for the plugin. Many changes were done after Alpha.3 release then I suggest you test the latest revision of the branch support/2.13.0. Please, mention the URL of this issue in the new one you will create on the Formcreator's repo.

glpi-project / glpi