Home › Support › Bug Reports
Howdy, Stranger!
It looks like you're new here. If you want to get involved, click one of these buttons!
CRITICAL SECURITY VERSION UPDATE:
https://github.com/daylightstudio/FUEL-CMS/releases/tag/1.4.13
https://github.com/daylightstudio/FUEL-CMS/releases/tag/1.4.13
safe_htmlentities()
I'm having some issues with safe_htmlentities(). Judging by your notes in the function you know what I'm talking about: re-encoding the entitie's ampersand.
The server my site is on is using PHP 5.1.6. On which htmlentities() only accepts 3 parameters. That seems to be the main issue.
I'm going to try to get the PHP version updated. Are there any solutions until that happens or if the host won't do it?
The server my site is on is using PHP 5.1.6. On which htmlentities() only accepts 3 parameters. That seems to be the main issue.
I'm going to try to get the PHP version updated. Are there any solutions until that happens or if the host won't do it?
Comments
Works locally and on my server. Nothing on the client's server, though.
Looking forward to the htmlentities fix.
http://www.getfuelcms.com/user_guide/libraries/my_model
I've pasted those changes below if you want to make them locally, so you don't have to wait (and can test out too on your end :-):
In the fuel/application/Form.php class, replace the prep() method with the following:
public static function prep($str, $double_encode = TRUE) { $str = (string) $str; if ($double_encode) { $str = htmlspecialchars($str, ENT_QUOTES, 'UTF-8'); } // Do not encode existing HTML entities // From PHP 5.2.3 this functionality is built-in, otherwise use a regex if (version_compare(PHP_VERSION, '5.2.3', '>=')) { $str = htmlspecialchars($str, ENT_QUOTES, 'UTF-8', FALSE); } else { $str = preg_replace('/&(?!(?:#\d++|[a-z]++);)/ui', '&', $str); $str = str_replace(array('<', '>', '\'', '"'), array('<', '>', ''', '"'), $str); } return $str; }In the MY_string_helper functions, replace safe_htmlentities with the following:
function safe_htmlentities($str, $protect_amp = TRUE) { // convert all hex single quotes to numeric ... // this was due to an issue we saw with htmlentities still encoding it's ampersand again'... // but was inconsistent across different environments and versions... not sure the issue // may need to look into other hex characters $str = str_replace(''', ''', $str); // setup temp markers for existing encoded tag brackets existing $find = array('<','>'); $replace = array('__TEMP_LT__','__TEMP_GT__'); $str = str_replace($find,$replace, $str); // encode just & if ($protect_amp) { $str = preg_replace('/&(?![a-z#]+;)/i', '__TEMP_AMP__', $str); } // safely translate now if (version_compare(PHP_VERSION, '5.2.3', '>=')) { $str = htmlspecialchars($str, ENT_NOQUOTES, 'UTF-8', FALSE); } else { $str = preg_replace('/&(?!(?:#\d++|[a-z]++);)/ui', '&', $str); $str = str_replace(array('<', '>'), array('<', '>'), $str); } // translate everything back $str = str_replace($find, array('<','>'), $str); $str = str_replace($replace, $find, $str); if ($protect_amp) { $str = str_replace('__TEMP_AMP__', '&', $str); } return $str; }/vservers/migrationbre/htdocs/assets/images/
Which is correct (I was wondering if it was a path issue, myself).
Folder and file permissions are set to 777.
Also, if you have IRC, I'm at irc.freenode.net in the fuelcms room (first time doing this for FUEL... so hopefully it works).
$tmpfiles
$files
But $return is empty. Which, obviously, is the problem.
Also, I am in the IRC room. Connected just fine with Colloquy but Adium wouldn't find it.
$return = array_slice($return, $offset, $limit);$offset = 0
$limit is not set
$return = (empty($limit)) ? array_slice($return, $offset) : array_slice($return, $offset, $limit);
Seems to be an issue with php 5.16
http://stackoverflow.com/questions/4321416/php-array-slice-null-length-results-in-empty-array
$str = htmlspecialchars($str, ENT_QUOTES, 'UTF-8', FALSE);This will then correctly escape quotes and allow editing of those fields.
public static function prep($str, $double_encode = TRUE) { $str = (string) $str; if ($double_encode) { $str = htmlspecialchars($str, ENT_NOQUOTES, 'UTF-8'); } // Do not encode existing HTML entities // From PHP 5.2.3 this functionality is built-in, otherwise use a regex if (version_compare(PHP_VERSION, '5.2.3', '>=')) { $str = htmlspecialchars($str, ENT_NOQUOTES, 'UTF-8', FALSE); } else { $str = preg_replace('/&(?!(?:#\d++|[a-z]++);)/ui', '&', $str); //$str = str_replace(array('<', '>', '\'', '"'), array('<', '>', ''', '"'), $str); $str = str_replace(array('<', '>'), array('<', '>'), $str); } return $str; }I was able to make this work by changing ENT_NOQUOTES to ENT_QUOTES.