Logout Module emitting invalid html. Update default_logout.php (enclose params JRoute parameter in htmlentities) #17367
Add this suggestion to a batch that can be applied as a single commit.
This suggestion is invalid because no changes were made to the code.
Suggestions cannot be applied while the pull request is closed.
Suggestions cannot be applied while viewing a subset of changes.
Only one suggestion per line can be applied in a batch.
Add this suggestion to a batch that can be applied as a single commit.
Applying suggestions on deleted lines is not supported.
You must change the existing code in this line in order to create a valid suggestion.
Outdated suggestions cannot be applied.
This suggestion has been applied or marked resolved.
Suggestions cannot be applied from pending reviews.
Suggestions cannot be applied on multi-line comments.
Suggestions cannot be applied while the pull request is queued to merge.
Suggestion cannot be applied right now. Please check back later.
Enclose JRoute param in htmlentities to emit valid html.
The getInstance part is right, but params remains unprotected, can emit invalid html!
Pull Request for Issue # .
Summary of Changes
Testing Instructions
Create some contacts with associated tags
Create a menu item of type tagged-elements of contacts type
Publish a login/logout module on that page.
Expected result
valid html
Actual result
Invalid html. The logout form url contains invalid '[' and ']' chars; th eurl will be similar to (when sef url disabled): /index.php?option=com_tags&view=tag&id[0]=2&types[0]=2&Itemid=nnn
This problem is related to issue "Bug in AbstractUri::buildQuery - invalid HTML emitted ('[' and ']' not encoded in tagged elements list) #21" (joomla-framework/uri#21).
I think the preferred way to solve both problems is solving the above mentioned problem in AbstractUri:buildQuery
Similar problem in PR #17368
Documentation Changes Required