need to clean html tag classes in comments

Bug #1804328 reported by Cecilia Vela Gurovic
6
This bug affects 1 person
Affects Status Importance Assigned to Milestone
Mahara
Fix Released
High
Cecilia Vela Gurovic
18.04
Fix Released
High
Unassigned
18.10
Fix Released
High
Cecilia Vela Gurovic
19.04
Fix Released
High
Unassigned

Bug Description

When adding a comment, the text can include html tags with classes that might interfere with the styling classes used by core. This could break the functionality of the page.

To replicate

- create a page and display it
- at the bottom, in the comment text area, expand the toolbar
- click on the 'Source code' button and add the text:

<div class="post list-group-item clearfix flush">
<div id="user_feedbacktable_0123456789" class="feedback modal modal-docked active">
<div class="modal-dialog modal-lg">
<div class="modal-content">
<div class="modal-body flush">
<div class="list-group list-group-lite">
<div id="user_comment12345" class="comment-item list-group-item list-group-item-warning r0">
<div class="comment-text">
<div class="comment-content">
<p>Comment text.</p>
</div>
</div>
</div>
</div>
</div>
</div>
</div>
</div>
</div>
<div class="post list-group-item clearfix flush"> </div></div>

Expected result:
- The page refreshes and the text "Comment text." is displayed

Actual result:
- The comment is not displayed

Changed in mahara:
milestone: none → 19.04.0
assignee: nobody → Cecilia Vela Gurovic (ceciliavg)
importance: Undecided → High
status: New → In Progress
Revision history for this message
Mahara Bot (dev-mahara) wrote : A patch has been submitted for review

Patch for "master" branch: https://reviews.mahara.org/9325

description: updated
Revision history for this message
Steven (stevens-q) wrote :

Environment tested: Master
Browser tested: Chrome

Preconditions:

Test Steps:
1. create a page and display it
2. at the bottom, in the comment text area, expand the toolbar
3. click on the 'Source code' button and add the HTML code shown below and then press save

<div class="post list-group-item clearfix flush">
<div id="user_feedbacktable_0123456789" class="feedback modal modal-docked active">
<div class="modal-dialog modal-lg">
<div class="modal-content">
<div class="modal-body flush">
<div class="list-group list-group-lite">
<div id="user_comment12345" class="comment-item list-group-item list-group-item-warning r0">
<div class="comment-text">
<div class="comment-content">
<p>Comment text.</p>
</div>
</div>
</div>
</div>
</div>
</div>
</div>
</div>
</div>
<div class="post list-group-item clearfix flush"> </div></div>

Expected result: The page refreshes and the text "Comment text." is displayed

Actual result: As expected
==========================================================================

Test script

1. Follow the above test script
2. Edit the comment and in the comment text area, expand the toolbar
3. click on the 'Source code' button and re-enter the HTML code shown above and then press save

Expected result: The page refreshes and the text "Comment text." is displayed

Actual result: - The comment is not displayed

Catalyst QA Failed Testing ✘

Revision history for this message
Steven (stevens-q) wrote :

Test script - Edit and re-enter the HTML code shown above

1. Follow the above test script
2. Edit the comment and in the comment text area, expand the toolbar
3. click on the 'Source code' button and re-enter the HTML code shown above and then press save

Expected result: The page refreshes and the text "Comment text." is displayed

Actual result: - As expected

Revision history for this message
Mahara Bot (dev-mahara) wrote : A change has been merged

Reviewed: https://reviews.mahara.org/9325
Committed: https://git.mahara.org/mahara/mahara/commit/c7dc45bc00574129b6621473062a12a3200d2403
Submitter: Cecilia Vela Gurovic (<email address hidden>)
Branch: master

commit c7dc45bc00574129b6621473062a12a3200d2403
Author: Cecilia Vela Gurovic <email address hidden>
Date: Wed Nov 21 12:07:11 2018 +1300

Bug 1804328: Clean 'modal' and 'modal-..' classes from comments

behatnotneeded

Change-Id: I5b59c45ef7b84b947615ed4ccd8a0651aa935fdb

Revision history for this message
Mahara Bot (dev-mahara) wrote : A patch has been submitted for review

Patch for "18.10_STABLE" branch: https://reviews.mahara.org/9327

Revision history for this message
Mahara Bot (dev-mahara) wrote : A change has been merged

Reviewed: https://reviews.mahara.org/9327
Committed: https://git.mahara.org/mahara/mahara/commit/65a23474b629f4eddb058457310a8f0cecfbadb2
Submitter: Cecilia Vela Gurovic (<email address hidden>)
Branch: 18.10_STABLE

commit 65a23474b629f4eddb058457310a8f0cecfbadb2
Author: Cecilia Vela Gurovic <email address hidden>
Date: Wed Nov 21 12:07:11 2018 +1300

Bug 1804328: Clean 'modal' and 'modal-..' classes from comments

behatnotneeded

Change-Id: I5b59c45ef7b84b947615ed4ccd8a0651aa935fdb
(cherry picked from commit c7dc45bc00574129b6621473062a12a3200d2403)

Revision history for this message
Mahara Bot (dev-mahara) wrote : A patch has been submitted for review

Patch for "18.04_STABLE" branch: https://reviews.mahara.org/9328

Revision history for this message
Mahara Bot (dev-mahara) wrote : A change has been merged

Reviewed: https://reviews.mahara.org/9328
Committed: https://git.mahara.org/mahara/mahara/commit/ca51e4f73ee2fc2a59707bbe217c10c5be577665
Submitter: Cecilia Vela Gurovic (<email address hidden>)
Branch: 18.04_STABLE

commit ca51e4f73ee2fc2a59707bbe217c10c5be577665
Author: Cecilia Vela Gurovic <email address hidden>
Date: Wed Nov 21 12:07:11 2018 +1300

Bug 1804328: Clean 'modal' and 'modal-..' classes from comments

behatnotneeded

Change-Id: I5b59c45ef7b84b947615ed4ccd8a0651aa935fdb
(cherry picked from commit c7dc45bc00574129b6621473062a12a3200d2403)
(cherry picked from commit 65a23474b629f4eddb058457310a8f0cecfbadb2)

Revision history for this message
Mahara Bot (dev-mahara) wrote : A patch has been submitted for review

Patch for "master" branch: https://reviews.mahara.org/9334

To post a comment you must log in.
This report contains Public information  
Everyone can see this information.

Other bug subscribers

Remote bug watches

Bug watches keep track of this bug in other bug trackers.