These get double-escaped so when you go to user/1/edit, the title shows up as "Eat at Joe & #039;'s"

I checked regular menu items and they seem fine, so this is probably something goofy in profile module.

CommentFileSizeAuthor
#1 profile_check_plain.patch598 bytesrobloach

Comments

robloach’s picture

robloach
he/him
commented
Status: Active » Needs review
StatusFileSize
new profile_check_plain.patch598 bytes

Removing the pass to check_plain seemed to fix the problem. I tried using the PHP tag in there for a simple CSS attack and it escaped the PHP tag cleanly. My guess is that #title is already passed through check_plain.

webchick’s picture

webchick
she/they
Primary language English
Location Vancouver 🇨🇦
commented
Status: Needs review » Reviewed & tested by the community

Yep, tested and works.

gábor hojtsy’s picture

gábor hojtsy
he/him
Primary language Hungarian
Location Hungary
commented
Status: Reviewed & tested by the community » Fixed

Thanks, committed.

gábor hojtsy’s picture

gábor hojtsy
he/him
Primary language Hungarian
Location Hungary
commented
Title: Can't use apostrophes in profile categories » Category names double escaped in profile module

Better title

Anonymous’s picture

Anonymous (not verified) commented
Status: Fixed » Closed (fixed)

Automatically closed -- issue fixed for two weeks with no activity.