Page MenuHomePhabricator

Group names with html entities in them get double encoded in Special:Userrights
Closed, ResolvedPublic

Description

If you create a group with an HTML entity in it, say A&B, the group name is displayed on Special:Userrights as A&B. This is because the groupCheckboxes function in SpecialUserrights.php calls htmlspecialchars on the group name and then calls Xml::checkLabel which does another htmlspecialchars.

I haven't tested this on 1.16.5 but a quick glance at the code shows that the problem still exists in trunk.


Version: 1.20.x
Severity: normal

Event Timeline

bzimport raised the priority of this task from to Medium.Nov 21 2014, 11:30 PM
bzimport set Reference to bz29340.
bzimport added a subscriber: Unknown Object (MLST).
brion added a comment.Jun 10 2011, 6:03 PM

Group names are expected to be plaintext, I think...

Seems like the code should either not allow group names with entities or display them correctly. Incidentally, group names with entities works fine everywhere else.

(In reply to comment #1)

Group names are expected to be plaintext, I think...

So, is this WONTFIX or ... ?

Hmm, I think the correct action would be 'validate group names'. A central place to validate the names, and calling that to check on various group-related entry points, should show up bad entries pretty quick.

If there's any UI allowing to create or specify group names by hand those should call the validation as well.

Another place these group names doesn't work is on Special:Statistics. You get no results for users in that group.

Change 177979 had a related patch set uploaded (by Nikerabbit):
Remove over/underescaping detected in Special:UserRights

https://gerrit.wikimedia.org/r/177979

Patch-For-Review

Nemo_bis set Security to None.

Change 177979 merged by jenkins-bot:
Remove over/underescaping detected in Special:UserRights

https://gerrit.wikimedia.org/r/177979

Umherirrender closed this task as Resolved.Dec 29 2014, 5:22 PM
Umherirrender added a subscriber: Umherirrender.