These get double-escaped so when you go to user/1/edit, the title shows up as "Eat at Joe & #039;'s"

I checked regular menu items and they seem fine, so this is probably something goofy in profile module.

CommentFileSizeAuthor
#1 profile_check_plain.patch598 bytesRobLoach
Support from Acquia helps fund testing for Drupal Acquia logo

Comments

RobLoach’s picture

RobLoach
he/him
CreditAttribution: RobLoach commented
Status: Active » Needs review
FileSize
profile_check_plain.patch598 bytes

Removing the pass to check_plain seemed to fix the problem. I tried using the PHP tag in there for a simple CSS attack and it escaped the PHP tag cleanly. My guess is that #title is already passed through check_plain.

webchick’s picture

webchick
she/they
Primary language English
Location Vancouver 🇨🇦
CreditAttribution: webchick commented
Status: Needs review » Reviewed & tested by the community

Yep, tested and works.

Gábor Hojtsy’s picture

Gábor Hojtsy
he/him
Primary language Hungarian
Location Hungary
CreditAttribution: Gábor Hojtsy commented
Status: Reviewed & tested by the community » Fixed

Thanks, committed.

Gábor Hojtsy’s picture

Gábor Hojtsy
he/him
Primary language Hungarian
Location Hungary
CreditAttribution: Gábor Hojtsy commented
Title: Can't use apostrophes in profile categories » Category names double escaped in profile module

Better title

Anonymous’s picture

Anonymous (not verified) CreditAttribution: Anonymous commented
Status: Fixed » Closed (fixed)

Automatically closed -- issue fixed for two weeks with no activity.