Fix Backup code download with quotes in translations #494
Conversation
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
…is is needed in the event response.data.i18n.title contains a quote or other similar character.
…t this to be HTML encoded as it's presented within a plaintext file.
dd32
changed the title
|
Open to review from @iandunn @georgestephanis or @kasparsd to help land this in the 0.8.0 release |
…s switches from using the domain, to the home url.
…ax_generate_json() to allow it to be unit testable.
…des for another, but that an Administrator can, and that the codes are only usable by the correct user.
dd32
force-pushed
the
fix/460-translation-with-quote
branch
from
f770e6e to
7c0a548
Compare
…will delete the code. This shouldn't have affected the test, as `$current_user` and `$user` should not match, but for safety..
15 tasks
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.
This suggestion is invalid because no changes were made to the code.
Suggestions cannot be applied while the pull request is closed.
Suggestions cannot be applied while viewing a subset of changes.
Only one suggestion per line can be applied in a batch.
Add this suggestion to a batch that can be applied as a single commit.
Applying suggestions on deleted lines is not supported.
You must change the existing code in this line in order to create a valid suggestion.
Outdated suggestions cannot be applied.
This suggestion has been applied or marked resolved.
Suggestions cannot be applied from pending reviews.
Suggestions cannot be applied on multi-line comments.
Suggestions cannot be applied while the pull request is queued to merge.
Suggestion cannot be applied right now. Please check back later.
Fixes #460
encodeURI()doesn't encode enough characters for non-english languages.encodeURIComponent()doesn't encode enough characters for usage withindata:uri'si18n.titleshould not be HTML escaped if it's not going to be used within a HTML context. This results in the translation string having HTML entities. An alternative would be to decode HTML entities client-side in JS and then use it that value, but encoding it in the first place here provides no security benefits.