Opened 12 years ago
Closed 12 years ago
#11811 closed Bug (fixed)
Widget's data are not encoded correctly when passed to attribute
| Reported by: | Piotrek Koszuliński | Owned by: | Piotr Jasiun |
|---|---|---|---|
| Priority: | Normal | Milestone: | CKEditor 4.4.1 |
| Component: | General | Version: | 4.3 |
| Keywords: | Cc: |
Description (last modified by )
- Open codesnippet sample.
- Create snippet with
<!--Foo-->content. - Copy it.
- Paste it.
- Results:
- Chrome: OK.
- FF, IE: snippet contains:
{cke_protected_1}.
That's because FF and IE do not encode "<" in attribute values. Chrome does this automatically.
Change History (13)
comment:1 Changed 12 years ago by
| Description: | modified (diff) |
|---|---|
| Status: | new → confirmed |
comment:3 Changed 12 years ago by
| Owner: | set to Piotr Jasiun |
|---|---|
| Status: | confirmed → assigned |
This ticket is definitely related to #11777.
comment:5 Changed 12 years ago by
| Status: | assigned → review |
|---|
Encoding data-cke-widget-data attribute using encodeURIComponent seems to be the best way to fix this issue. Changes in t/11811b and corresponding test branch.
comment:6 Changed 12 years ago by
| Status: | review → review_failed |
|---|
- Please merge these tests to widgetapi.html.
- Do not create unnecessary editor instances. You can register widgets dynamically, and if they have unique names, there won't be conflicts with other tests.
- Correct other widget system tests.
This change revealed a bug in code snippet plugin. I'll create a ticket for it.
comment:8 Changed 12 years ago by
| Status: | review_failed → review |
|---|
I merged tests into widgetapi.html, improved performance and corrected other tests (excluding code snippert tests which will be fixed in #11926). Changes in t/11811b test branch.
comment:9 Changed 12 years ago by
| Status: | review → review_failed |
|---|
You should extract a function calling encodeURIComponent(JSON.stringify(obj)) to widget test tools. That pair cannot be repeated in every related test. What if we change the form again?
comment:10 Changed 12 years ago by
I changed data2Attr and added getAttrData to widgets tools and used them in tests instead encodeURIComponent and decodeURIComponent so there is a single pair of function for data encoding/decoding. Changes in t/11811b test branch.
comment:11 Changed 12 years ago by
| Status: | review_failed → review |
|---|
comment:12 Changed 12 years ago by
| Status: | review → review_passed |
|---|
I force pushed rebased branches plus I added one additional commit in tests.
comment:13 Changed 12 years ago by
| Resolution: | → fixed |
|---|---|
| Status: | review_passed → closed |
- git:edf271d
- tests:ffc89d0

I pushed branch:t/11811 with the simplest solution. Simplest but very locally working, because the real issue is somewhere else. The HTML data processor should not protect comment inside attribute. Unfortunately that may be extremely hard to achieve because of the way how comments protection must work - on HTML string.