search

pfefferle / wordpress-webmention

A Webmention plugin for WordPress
https://wordpress.org/plugins/webmention/
MIT License
117 stars 31 forks source link

htmlspecialchars() reply content before dislaying? #2

Closed sandeepshetty closed 11 years ago

sandeepshetty commented 11 years ago

I sent a comment with <http://example.com&gt;, which is Markdown for linking tags but it disappeared on you blog. I'm guessing you are filtering html. Do you want to consider encoding it instead using htmlspecialchars() (P.S. I haven't done enough research on the security implications of this though) ?

pfefferle commented 11 years ago

No, i don't use any stripping, this is purely the mf2 parser that seems to strip it when using p-summary. I will update the plugin to the latest version and will run some tests. Thanks for tip!

pfefferle commented 11 years ago

Can you please change your code (form md) back to html and resend the mention?

pfefferle commented 11 years ago

I am totally sorry! you are sooo right! can you please change your code to the old one, so i could run some tests?

pfefferle commented 11 years ago

I take everything back! I am right though!! you use a not < http://example.com > encoded instead &lt; http://example.com &gt; and that is ignored by the mf2 parser because he thinks it's a html-tag and ignores it! http://pin13.net/mf2/?url=http%3A%2F%2Fwww.sandeep.io%2F92