Tried this and tested in a case where my Node title contained an apostrophe, e.g. "Joe's"
menu_token menu link output result: "Edit Joe's"

screen captures attached.

CommentFileSizeAuthor
#2 menu_token-special-chars-2343693-2.patch457 bytesericclaeren
Screen Shot 2014-09-23 at 1.47.43 PM.png5.72 KBemjayess
Screen Shot 2014-09-23 at 1.47.55 PM.png4.27 KBemjayess

Comments

emjayess’s picture

emjayess commented
Issue summary: View changes
ericclaeren’s picture

ericclaeren commented
StatusFileSize
new menu_token-special-chars-2343693-2.patch457 bytes

Hi, I have made a patch, current-user:name has a check plain, but seems like menu is also sanitizing the link and this creates a double encoding.

Hence to can put a h2 in a menu link title, the extra sanitizing hasn't got much purpose, so we might as well disable it.
Have tried it with the token in the url with a " and it doesn't break.

Could you look and test this patch?

tessa bakker’s picture

tessa bakker
she/they
Primary language Dutch
commented
Status: Active » Reviewed & tested by the community

Works nice with title and path.

Tested with

  1. &
  2. <b></b>
  3. javascript:alert('yeah')

  • develCuy committed dc001d9 on 7.x-1.x authored by ericclaeren 
    Issue #2343693 by ericclaeren, Tessa Bakker: Improperly Escaping Special...
develcuy’s picture

develcuy commented
Status: Reviewed & tested by the community » Needs review

Thanks for the patch!

EVERYONE, please help me test this patch. If somebody complains I'll revert it.

garchris’s picture

garchris commented

Tried 7.x-1.0-beta7 and 7.x-1.x-dev. Still experiencing this problem.

develcuy’s picture

develcuy commented
Version: 7.x-1.0-beta5 » 7.x-1.x-dev

@ReboundToday, thanks for reporting! What symbols are you entering?

develcuy’s picture

develcuy commented
Status: Needs review » Closed (outdated)