Zen Cart Logo
Forums / Bug Reports / htm speciall characters in configuration fields

htm speciall characters in configuration fields

Views: 7,988

Results 1 to 4 of 4
11 Dec 2019, 13:59
#1
brittainmark avatar

brittainmark

Totally Zenned

Join Date:
Apr 2009
Posts:
507
Plugin Contributions:
1

htm speciall characters in configuration fields

Site Url: Innerlightcrystals.co.uk/sales
PHP version: 7.3

There is an issue with including any htmlspecial characters in fields in Admin configuration.
For example:
The default Bread Crumbs Navigation Separator in configuration>layout settings is  ::  if you edit and save without changing the value it becomes  ::  do it again and you get  :: and so on.

I have gone in to phpmyadmin and edited the value back to the correct value which works. This however would be an issue for any field that contains &, ",>,<, and may be more.

11 Dec 2019, 14:22
#2
brittainmark avatar

brittainmark

Totally Zenned

Join Date:
Apr 2009
Posts:
507
Plugin Contributions:
1

Re: htm speciall characters in configuration fields

Think part of the issue is that double encoding is turned on for html special characters. so existing special chars like & are being converted again. Even with that set to false on line 207 ```php
eval('$value_field = ' . $cInfo->set_function . '"' . htmlspecialchars($cInfo->configuration_value, ENT_COMPAT, CHARSET, FALSE) . '");');

in configuration.php. This stops the duplication of the & characters but still dose not allow you to enter html as the characters are still converted.
11 Dec 2019, 14:40
#3
brittainmark avatar

brittainmark

Totally Zenned

Join Date:
Apr 2009
Posts:
507
Plugin Contributions:
1

Re: htm speciall characters in configuration fields

Have found a possible solution:
changing line 24 :```php
$configuration_value = zen_db_prepare_input(htmlspecialchars_decode($_POST['configuration_value']));

to include htmlspecialchars_decode appears to work.
Ignore previous post.
Not sure what the implications of doing this are so if this proposal is ok please let me know.
11 Dec 2019, 15:05
#4
mc12345678 avatar

mc12345678

Totally Zenned

Join Date:
Jul 2012
Posts:
16,908
Plugin Contributions:
2

Re: htm speciall characters in configuration fields

The issue is caused by strict sanitization performed on configuration_key entry in the admin's sanitization in absence of specific sanitization by key. A path for addressing this is in ZC 1.5.7 and discussed elsewhere in this forum.