Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Improve support for special characters in blognames #7

Merged
merged 2 commits into from
Jan 16, 2023

Conversation

kadamwhite
Copy link

I actually think that this patch doesn't fix my problem, but to report the problem: special characters in the blog name are not properly escaped in the sender field of the email dispatched by this plugin. Example,
image

The attached change mirrors how the wordpress/two-factor plugin does things upstream:

https://github.com/WordPress/two-factor/blob/master/providers/class-two-factor-email.php#L227

but I assume it would not impact how the blog name is rendered in what I am guessing is the sender name field. So possibly something that needs to be fixed outside of this plugin.

kadamwhite and others added 2 commits October 31, 2022 16:47
<img width="235" alt="image" src="https://user-images.githubusercontent.com/442115/199106435-f82bc6d7-51ea-45fe-970d-a62c18a334b7.png">

The emails sent by this plugin mangle the site name of blogs with non-english special characters. I am not confident this fully resolves the issue, because running these two strings via `wp shell` on an environment with a Japanese or accented-french blog name renders the same output, but there is a definite issue with how special characters are handled when sending these emails, and this change mirrors how the wordpress/two-factor plugin does things upstream:

https://github.com/WordPress/two-factor/blob/master/providers/class-two-factor-email.php#L227
@humanmade humanmade deleted a comment from ajvillegas Jan 12, 2023
@@ -148,7 +148,7 @@ public function generate_and_email_token( $user ) {
$token = $this->generate_token( $user->ID );

/* translators: %s: site name */
$subject = wp_strip_all_tags( sprintf( __( 'Your login confirmation code for %s', 'two-factor' ), get_bloginfo( 'name' ) ) );
$subject = wp_strip_all_tags( sprintf( __( 'Your login confirmation code for %s', 'two-factor' ), mb_encode_mimeheader( get_option( 'blogname' ), ENT_QUOTES ) ) );

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

What about html_entity_decode()? Looks fine if it works as expected though.

Copy link
Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

I'd defer to @ajvillegas on whether that was tried or not. wp_specialchars_decode which the upstream uses definitely does not fix it, so I would guess that the more specific function here is likely necessary.

@kadamwhite kadamwhite merged commit 70e4c77 into master Jan 16, 2023
@kadamwhite kadamwhite deleted the special-characters-email branch January 16, 2023 14:03
@kadamwhite
Copy link
Author

@roborourke This had worked locally but when I installed on a dev stack just now, I got this fatal when trying to initiate an email code resend:

Uncaught ValueError: mb_encode_mimeheader(): Argument #2 ($charset) must be a valid encoding, "3" given in /usr/src/app/vendor/humanmade/two-factor/providers/class.two-factor-email.php:151
Stack trace:
#0 /usr/src/app/vendor/humanmade/two-factor/providers/class.two-factor-email.php(151): mb_encode_mimeheader('Blo...', '3')
#1 /usr/src/app/vendor/humanmade/two-factor/providers/class.two-factor-email.php(171): Two_Factor_Email->generate_and_email_token(Object(WP_User))
#2 /usr/src/app/vendor/humanmade/two-factor/class.two-factor-core.php(361): Two_Factor_Email->authentication_page(Object(WP_User))
#3 /usr/src/app/vendor/humanmade/two-factor/class.two-factor-core.php(303): Two_Factor_Core::login_html(Object(WP_User), '0d498aca32a1c7d...', 'https://site...', '', Object(Two_Factor_Email))
#4 /usr/src/app/wordpress/wp-includes/class-wp-hook.php(307): Two_Factor_Core::backup_2fa('')
#5 /usr/src/app/wordpress/wp-includes/class-wp-hook.php(331): WP_Hook->apply_filters('', Array)
#6 /usr/src/app/wordpress/wp-includes/plugin.php(474): WP_Hook->do_action(Array)
#7 /usr/src/app/wordpress/wp-login.php(518): do_action('login_form_back...')
#8 {main}
  thrown

I recommend we untag and un-publish 0.3.1 for now

@ajvillegas
Copy link

@kadamwhite The mb_encode_mimeheader function is expecting the charset as the second parameter, but I left the ENT_QUOTES flag from the wp_specialchars_decode we had previously on the PR and think this is what's causing the error. It looks like the second parameter should be UFT-8.

@kadamwhite
Copy link
Author

Reverted in 59b577a and will open a new PR to iterate

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
None yet
Projects
None yet
Development

Successfully merging this pull request may close these issues.

3 participants