Hey,

Thanks for the module. I am using it for its simplicity. However, using [node:title] as a token to replace for the page title, the characters get encoded if there happens to be a quote in the title.

However, from the token_replace description, the sanitization is already done on the replace side: https://api.drupal.org/api/drupal/includes%21token.inc/function/token_re...

sanitize: A boolean flag indicating that tokens should be sanitized for display to a web browser. Defaults to TRUE. Developers who set this option to FALSE assume responsibility for running filter_xss(), check_plain() or other appropriate scrubbing functions before displaying data to users.

Could we therefore remove the 'useless' check_plain?

Comments

vdsh created an issue. See original summary.

ykyuen’s picture

Hi @vdsh,

Sorry for the bug and thanks for the suggestion. I have removed all check_plain() functions and push to the dev branch. See if it works.

i will make the 7.x-1.6 release later.

Regards,
Kit

ykyuen’s picture

Assigned: Unassigned » ykyuen
Status: Active » Needs review
vdsh’s picture

Looking good to me! Thanks for the quick update

ykyuen’s picture

Released to 7.x-1.6.

Thanks @vdsh for reporting the issue and test it.

ykyuen’s picture

Status: Needs review » Fixed
ykyuen’s picture

Status: Fixed » Closed (fixed)