WordPress.org

1. thomask
   Member
   Posted 8 months ago #
   

   If you will write non-ascii characters to custom statuses descriptions (and also to other similar fields), they are replaced with their number, e.g. from
   příliš žluťoučký kůň úpěl ďábelské ódy
   you will get
   pu0159u00edliu0161 u017eluu0165ouu010dku00fd ku016fu0148 u00fapu011bl u010fu00e1belsku00e9 u00f3dy

   http://wordpress.org/extend/plugins/edit-flow/

2. Daniel Bachhuber
   Member
   Plugin Author
   Posted 8 months ago #
   

   Yep, this is a known issue. Pull requests welcome :)

3. thomask
   Member
   Posted 8 months ago #
   

   uff, this is tough, i!m triing it for an 2 hours and i know where is the problem but do not have nerves and time to finish it:

   1. problem is using htmlentities without utf-8 encoding (for php < 5.4 it uses ISO)
   2. you must utf_8 encode string before using json_encode

   so line 383 should be
   $sanitized_args[$key] = utf8_encode(htmlentities( $sanitized_args[$key], ENT_QUOTES, 'UTF-8' ));

   similar on line 409 you should have probably
   $string_or_unencoded_array[$key] = html_entity_decode( utf8_decode($value), ENT_QUOTES, 'UTF-8' );

   but that json_encode is anyway cripling it, it need to be probably repaired also somewhere else. Imho you should use serialize / unserialize, not json_encode

   also i am lookin in the get_encoded_description function and for me it seems as a very "strange" code.

   1. imo you should use something like http://codex.wordpress.org/Function_Reference/sanitize_text_field

   2. the whole function get_encoded_description function is completely useless, because you putting sanitized strings to $sanitized_args variable, but at the end you are returning original non-sanitized $args

4. Daniel Bachhuber
   Member
   Plugin Author
   Posted 8 months ago #
   

   What do you think of my proposal to base64 encode the data instead?

5. thomask
   Member
   Posted 8 months ago #
   

   imo it should be utf-secure, but anyway i do not understand why encoding characters - all plugins i know use in such case seralize/unserialize. WordPress also counts with it with e.g. maybe_serialize data function (http://codex.wordpress.org/Function_Reference/maybe_serialize)

6. Daniel Bachhuber
   Member
   Plugin Author
   Posted 8 months ago #
   

   I've implemented a fix for this and it will be out in v0.7.4

Reply

You must log in to post.