Package home | Report new bug | New search | Development Roadmap Status: Open | Feedback | All | Closed Since Version 1.2.3

Request #7754 ignorant urlEncode
Submitted: 2006-05-29 18:16 UTC
From: nils at phoque dot de Assigned:
Status: Open Package: Text_Wiki (version 1.1.0)
PHP Version: Irrelevant OS: Windows
Roadmaps: (Not assigned)    
Subscription  


 [2006-05-29 18:16 UTC] nils at phoque dot de (Nils Werner)
Description: ------------ urlEncode does a rawurlencode even if in some situations some special characters (i.e. a slash) shouldn't be encoded. Some option to "enable subpages" or a urlEncode-whitelist would be nice to fix this. Test script: --------------- not really necessary Expected result: ---------------- <a href="page/subpage">subpage</a> Actual result: -------------- <a href="page%2Fsubpage">subpage</a>

Comments

 [2006-05-29 20:06 UTC] justinpatrin (Justin Patrin)
I'd like a test script so that we can look into this further. urlencoding (and htmlencoding) is done to stop XSS attacks. What rule is this happening in that you don't think it should? What part of the input is this from? If it's from configuration I can see tuning this off, but if it's from user data it will have to be thought over thoroughly. Note: you can also extend the Text_Wiki class and write your own urlEncode function.
 [2006-05-31 11:04 UTC] nils at phoque dot de
It doesn't concearn Text_Wiki but Text_Wiki_Mediawiki wich uses Text_Wiki's urlEncode: <?php require_once 'Text/Wiki/Mediawiki.php'; $wiki = new Text_Wiki_Mediawiki; $wiki->setRenderConf('xhtml', 'wikilink', 'pages', false); $wiki->setRenderConf('xhtml', 'wikilink', 'view_url', '/%s/'); echo $wiki->transform("[[page/subpage|Subpage]]"); ?>
 [2006-05-31 12:01 UTC] ritzmo at php dot net (Moritz Venn)
Actually it's not Text_Wiki_Mediawiki, which uses urlEncode but Text_Wiki. The problem occuring is that there is no Class for Subpage-Links, so the used class is - correclty - still Wikilink. So urlEncode happens in the Xhtml-Renderer and not in Mediawiki-Wikilink. This problem obviously only occurs in the Mediawiki-Parser, as its the only one accepting Subpages. So the question is if its better to remove the support of sub-pages in mediawiki or if its more logical to extend the Renderer.
 [2006-06-14 10:39 UTC] nils at phoque dot de
Since Mediawiki itself accepts subpages (Wikipedia does only in the User:-namespace), I think it makes perfectly sense to enable Text_Wiki_Mediawiki to have subpages as well.
 [2006-06-16 16:29 UTC] ritzmo at php dot net (Moritz Venn)
Although I risk to repeat myself... The discussion is not actually of enabling a feature in Text_Wiki_Mediawiki, but in Text_Wiki. So I'm reassigning this to Text_Wiki as I heard nothing from the devs about this issue and I'm not willing to remove support in Text_Wiki_Mediawiki without response.
 [2007-03-27 09:14 UTC] phoque (Nils Werner)
Any updates on this issue? Extending Text_Wiki_Render doesn't work since Text_Wiki makes use of Text_Wiki_Render itself (it would require changes to the source of Text_Wiki to use i.e. Text_Wiki_Render_Supages instead of Text_Wiki_Render).