× Help Forum English

Special chars need to be escaped in event title

Début
Précédent
1
Suivant
Fin

Lemke
Auteur du sujet
Membre junior

Plus d'informations

il y a 6 ans 4 mois #17076 par Lemke

Special chars need to be escaped in event title a été créé par Lemke

I am currently evaluating whether ICagenda is suitable for my purposes. In the course I discovered that event titles containing double quotes lead to errors. Example:
The event title is

Industrielle Praxis "Cloud Operations Workshop mit Bosch" (Workshop für Studierende)

This leads to the following generated html:

<div class="event ic-event ic-clearfix">
       <a href="/joomla/index.php/veranstaltungen-2/1-industrielle-praxis-cloud-operations-workshop-mit-bosch-workshop-fuer-studierende?date=2020-11-02-17-30" title="Industrielle Praxis " cloud="" operations="" workshop="" mit="" bosch"="" (workshop="" für="" studierende)"="">

I suppose the event title needs to be escaped using php htmlspecialchars. This might also be a security risk.

Connexion ou Créer un compte pour participer à la conversation.

Lyr!C
Administrateur
Lead Developer

Plus d'informations

il y a 6 ans 4 mois #17077 par Lyr!C

Réponse de Lyr!C sur le sujet Special chars need to be escaped in event title

Hello,

Thank you for this report!

I don't see any security risk here, as it's only in a html layout rendering function.

But it's missing to escape...

Attached a version with the patch!

Best regards,
Cyril

Fichier attaché :

Nom du fichier : iCagenda_3...dev1.zip
Taille du ficher :1,775 ko

Latest version : iCagenda 4.0.17 Joomla! 4 > Joomla! 6
We recommend every user to keep iCagenda updated.
Support for iCagenda version 3.9 (the final version compatible with Joomla 3) ended on October 13, 2026
Extended security support for the iCagenda PRO 3.9 version until October 13, 2027 (to benefit from this extended support, you must have a Pro subscription: www.joomlic.com/extensions/icagenda)
Don't forget to have your Joomla!® up-to-date!

Do you like iCagenda?
I would appreciate if you could take 5 minutes to post a review on JED (Joomla Extensions Directory) .