If a user enters special characters (such as less-than) within a report Category, that entry is displayed unfiltered in the My Reports page.

To reproduce: create a report with a category such as "Smaller < Larger"
Expected result: the category name is treated as a literal
Actual result: the category name is presented as invalid HTML

Fix: https://github.com/ulsdevteam/forena/commit/52958fd49f758d3898d5a00504d2...

Also, the $link variable in forena_user_reports() appears to be unused.

Comments

metzlerd’s picture

metzlerd commented

I'm not sure that this is appropriate. If you set a category with a user interface it currently escapes the html prior to putting it in. I tested this with the UI version and by placing the following: 

<frx:category>This &lt; that</frx:category>

In both cases the report displayed correctly in my 7.x-4.x-dev environment. Can you indicate what you're .frx file looks like in your case?

metzlerd’s picture

metzlerd commented
Status: Active » Postponed (maintainer needs more info)

No response from user, shifting status accordingly.

metzlerd’s picture

metzlerd commented
Status: Postponed (maintainer needs more info) » Closed (outdated)