Page MenuHomePhabricator

summary field does not escape HTML entities
Open, LowPublicFeature

Description

Author: gangleri

Description:
Please see also http://test.wikipedia.org/w/index.php?diff=81619&oldid=81618 at tje life site.

Dear friends; If you add a ‎ in the page source you would need to document this using &amp:lrm; . I mean the behaviour has changed but it does not make much sense.

affected user interface: everything showing the summary field (recent changes, wathchlist, related changes, diff and also while editing Show changes and Show preview.

Best regards Reinhardt


Version: unspecified
Severity: enhancement
URL: http://www.wikieducator.org/index.php?diff=next&oldid=490647

Details

Reference
bz21847

Event Timeline

bzimport raised the priority of this task from to Low.Nov 21 2014, 10:52 PM
bzimport set Reference to bz21847.
bzimport added a subscriber: Unknown Object (MLST).

HTML entities are not escaped intentionally in summaries due to bug 13815

Aklapper changed the subtype of this task from "Task" to "Feature Request".Feb 4 2022, 11:01 AM
Aklapper removed a subscriber: wikibugs-l-list.
matmarex subscribed.

This seems to have been fixed, probably many years ago.

image.png (118×426 px, 6 KB)

@matmarex By coincidence I happened to also discover this behaviour myself the other day - I’m not sure what (if anything) might have happened to the previous edit summaries, but I can still reproduce this myself: edit using   as an edit summary, Quarry query for the raw edit summary.

Screenshot for posterity:

screenshot.png (206×726 px, 33 KB)

You're right, I misunderstood this bug report. I thought that edit summary with "‎" was supposed to demonstrate the bug, but I guess it actually demonstrates a workaround? The initial bug report still confuses me.

Anyway, HTML entities are explicitly allowed (not escaped) by the code here: https://gerrit.wikimedia.org/g/mediawiki/core/+/7cd0f4e62adc27c9c7a070bc89a88054795a923b/includes/CommentFormatter/CommentParser.php#178

…which refers to T15815, already mentioned above (as "bug 13815").