getgrav / getgrav/grav-plugin-admin

Wrong escape handling in metadata

Open
#2,430 1 comment 0 reactions 0 assignees View on GitHub
Dominant language
PHP
Stars
377
Forks
225
Avg merge
11h 51m
Merged PRs (30d)
4

Description

When I add html tags to the metadata field in pages (e.g. via the admin panel) the HTML will be escaped and therefore all possibly dangerous characters are replaced by the PHP function `htmlspecialchars` when using these via TWIG.

These can only be turned off when setting `system.strict_mode.twig_compat` to `true` and `system.twig.autoescape` to `false`.

Thesese parameters will be used in

- system/src/Grav/Common/Twig/Twig.php
- system/src/Grav/Common/Page/Page.php
The line in question determines if an escape has to be performed as followed: `$escape = !$config->get('system.strict_mode.twig_compat', false) || $config->get('system.twig.autoescape', true);`
- system/src/Grav/Framework/Flex/Pages/Traits/PageLegacyTrait.php

The Page.php is the relevant file for me when embedding the variable in a Twig template via `{{ page.metadata.test.content|raw }}`.

The description in the admin panel states, that both fields are defined as followed:

- **`system.strict_mode.twig_compat`:** Enables deprecated Twig autoescape setting. When disabled, |raw filter is required to output HTML as Twig will autoescape output
- **`system.twig.autoescape`:** Autoescapes all variables. This will break your site most likely

Therefore I guess the handling in the code files is different from the description. Or am I missing something?

Contributor guide

Open the contributing guide

Assessment

This issue has not been assessed yet.

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.