Opened 16 years ago

Closed 15 years ago

#9185 closed (fixed)

blocktrans auto escape peculiarity

Reported by: Gruffudd Williams Owned by: Marc Garcia
Component: Internationalization Version: 1.0
Severity: Keywords:
Cc: Triage Stage: Accepted
Has patch: no Needs documentation: no
Needs tests: no Patch needs improvement: no
Easy pickings: no UI/UX: no

Description

This does not auto escape value:

{% blocktrans %}This string will have {{ value }} inside.{% endblocktrans %}

but this does:

{% blocktrans value as value %}This string will have {{ value }} inside.{% endblocktrans %}

I think the auto escaping should work in both cases.

Change History (5)

comment:1 by Gruffudd Williams, 16 years ago

Resolution: invalid
Status: newclosed

On second thought, perhaps this is invalid.
It's to do with the order in which substitution is done. In the first example the substitution is done before translation, which doesn't make sense in most cases anyway.

comment:2 by Malcolm Tredinnick, 16 years ago

Component: Template systemInternationalization
Resolution: invalid
Status: closedreopened
Triage Stage: UnreviewedAccepted

I believe your initial report more than your conclusion. :-)

It seems somewhat inconsistent and I can't really see why the behaviours should be different. Your comment seems to explain why they are different due to the implementation, but that's not necessarily good behaviour. I'm going to reopen this, because we need better behaviour here. At the very least, this would have to be something that was very clearly documented, but it's going to take a bit to convince me that the two versions should just behave exactly the same way.

comment:3 by Gruffudd Williams, 16 years ago

If I understand correctly, one of the downsides of adding auto escaping to the first example is that the po file would potentially need html-entitied strings in msgid="bla&bla" in order for a translation to match.
Not doing it, however, means a potential xss hole if somebody forgets to specify the variable in the blocktrans tag.

comment:4 by Marc Garcia, 15 years ago

Owner: changed from nobody to Marc Garcia
Status: reopenednew

comment:5 by Marc Garcia, 15 years ago

Resolution: fixed
Status: newclosed

It looks like this ticket was a duplicate of #10369, and it was fixed on [10519].

Note: See TracTickets for help on using tickets.
Back to Top