Maintenance mode message doesn't parse HTML

Maintenance mode message doesn't parse HTML Started by Adrek · December 20, 2015, 03:04:52 pm · Read 4662 times 0 Members and 1 Guest are viewing this topic. previous topic - next topic

Maintenance mode message doesn't parse HTML

December 20, 2015, 03:04:52 pm

Hi,

I have clean Elkarte 1.0.5, and it seems that HTML code is not parsed in maintenance mode message.
Where I need to make changes to enable HTML in this message?

Re: Maintenance mode message doesn't parse HTML

Reply #1 – December 20, 2015, 07:00:10 pm

In Auth.controller.php, find function action_maintenance_mode

Code: (find) [Select]

		// Basic template stuff..
		$context['sub_template'] = 'maintenance';

Code: (replace) [Select]

		// Basic template stuff..
		$mmessage = un_htmlspecialchars($mmessage);
		$context['sub_template'] = 'maintenance';

should do it ... I think. Not sure why thats not enabled by default, @emanuele any ideas on that (I'm not sure why its assigned by reference either)

Re: Maintenance mode message doesn't parse HTML

Reply #2 – December 20, 2015, 11:25:33 pm

I'm not entirely sure, but I do believe this was not enabled in SMF, because the powers that be, figured their usual "It's not what we want, so..."

I think Arantor once said that it was an issue that very rarely came up, so that was why he also left it that way. Which, in a sense, was typical for SMF.

Re: Maintenance mode message doesn't parse HTML

Reply #3 – December 21, 2015, 02:20:56 am

This is the Issue of SMF respect in message doesn't parse HTML
https://github.com/SimpleMachines/SMF2.1/pull/2401

Re: Maintenance mode message doesn't parse HTML

Reply #4 – December 21, 2015, 07:52:29 am

Not sure what that github issue is about TBH, its not really an explanation of why it was like that to begin with (plus thats just the forum name not the MM message). I'll add it to the tracker as a feature request for 1.1 so we remember to take a look at it.

Re: Maintenance mode message doesn't parse HTML

Reply #5 – December 21, 2015, 04:11:44 pm

@Spuds thanks, HTML works now

I looked when it started to be like that, because I knew for sure that in SMF and ElkArte 1.0.0 was working right.

From my tests it started from 1.0.1, when saving HTML message it changes to:

Code: [Select]

$mmessage = '&lt;a href=&quot;http://example.com/&quot;&gt;Link title&lt;/a&gt;';

Re: Maintenance mode message doesn't parse HTML

Reply #6 – December 26, 2015, 05:26:42 pm

I'm not sure this is a bug or a feature... LOL
I know for sure after some testing there is a bug: when Elk saves data to the file, the single quotes are converted to #something; and the next time the file is saved the "#" is considered the starting of a comment, messing up the line (the text is repeated). This is probably due to the htmlspecialchars, there is to revert the entities back and use addslashes before saving.

The saving of html I think it's "disabled" just as usual safety measure, though if it is worth or not... well, I don't know at the moment.

Re: Maintenance mode message doesn't parse HTML

Reply #7 – February 04, 2016, 06:12:26 pm

Seems pointless to disable saving HTML for an administrator that can edit template files from the same interface. Not saying it is worth it to change (I think maintenance should be a class and all you should change in settings.php is whether it is enabled) but... just saying

Re: Maintenance mode message doesn't parse HTML

Reply #8 – February 06, 2016, 02:34:36 pm

Yup .. if the admin is hell bent on breaking there forum, there are lots of other ways to proceed that are better than this

Re: Maintenance mode message doesn't parse HTML

Reply #9 – February 07, 2016, 03:15:59 pm

In an ideal world, "at some point" the admin should not be able to edit any php file (that "just" means no code edits in addons and templates not php-based), but that is not something that will happen tomorrow.
Actually I have always in mind that ask for ftp password any time a file edit is performed would be a nice thing to do (security-wise).

Then, yes, limit the possibility to use HTML when you are already editing a php file sure is kind of overkill, but it's just one of those things done that way so that it's "ready-for-the-future".
Not saying it cannot be changed. Just saying.