The 2026 Drupal Business Survey is open. Your response will help shape the future of the Drupal business ecosystem.Since subject could contain user entered data (in theory), it should probably be sanitized with rawurlencode().
Patch forthcoming.
| Comment | File | Size | Author |
|---|---|---|---|
| #14 | multiple_encoding_fun7.patch | 4.75 KB | berdir |
| #12 | multiple_encoding_fun2.patch | 5.01 KB | berdir |
| #8 | multiple_encoding_fun.patch | 4.9 KB | berdir |
| #6 | privatemsg_encode_subject_and_with_clean_url_decode_check.patch | 4.98 KB | berdir |
| #4 | privatemsg_encode_subject_with_tests_without_debug.patch | 4.85 KB | berdir |
Comments
Comment #1
te-brian commentedFYI, we can't use drupal_urlencode because it preserves '/' characters.
Comment #2
te-brian commentedAlso, this could probably use a test .. but I am clueless when it comes to writing tests.
Comment #3
berdirI haz test 4 u!
And they revealed that it's not that simple to encode a / properly.
The problem is that when clean_url's are enabled, mod_rewrite already decodes the /. This means we need to explicitly encode it twice and decode it again inside privatemsg_new().
Comment #4
berdirAnd now without debug code and code style fixed.
Comment #6
berdirThank you testbot! ;)
Testbot doesn't use clean url's, If I only encode / conditially, then I need to do the same for decoding.
Comment #8
berdirFun stuff.
This patch passes for me both with and without clean_url's. Needs a separate approach. When clean url's are enabled, everything is encoded 2-3 times (because url() is encoding the path again) so that it survives through mod_rewrite and the menu system and everything is passed as a single string as subject.
Wondering about a completely different approach for this, especially since people are asking to control the body field in a similar way. I have no idea how, though.
Comment #9
berdirNeeds to be re-rolled.
Comment #10
berdir#8: multiple_encoding_fun.patch queued for re-testing.
Comment #12
berdirRe-rolled the patch.
Comment #13
berdirCommited.
Comment #14
berdirIt looks like the special case isn't necessary anymore in D7, the non-clean_url's solution worked too for me when using clean_url's. Let's see what the test bot has to say about this.
Comment #15
berdirCommited.