Umlauts are replaced in the subjects

Isaac

I'm testing the ticket creation from emails and when you use umlauts in the email subjects the generated ticket looks like

As you can see ITFlow do htmlentities() for the subject (in cronticketemail_parser.php) but not for the message itself for example:

So either we have to htmlspecialchars_decode() the subject in all ticket views or we give up to htmlentities() the subject when creating the ticket, haven't we? (I would go for the 2nd)

What do you think?

johnny

Thanks wrongecho and Isaac

Fix has been applied we may be able to use our new sanitizeInput() Function on the rest of them too since they are going into the DB

as these outputs are all filtered during output

https://github.com/itflow-org/itflow/commit/426b07a093e9bc12aa31cdcc42971a7be9ea06fc

johnny

Hi @Isaac I don't disagree as htmlentities is used on the subject var already when your in the ticket view portion of ITFlow. So I don't see any issue removing it here. Some of these sensitization may be unnecessary in the mail parser. but lets get @wrongecho opinion then we will proceed.

wrongecho

I think strip tags + mysqli real escape string is enough for the subject as long as we definitely use htmlentities for the output on the ticket view page.

We handle the message text differently as there's a HTML editor.

Isaac

johnny I found another place (in the modal popup window for merging) where the umlauts are not displayed correctly.

johnny

I see the problem it does htmlentities then jsonencode in reality it should just do a json_encode will fix this in the next update

johnny

Hi @Isaac

This has been fixed, go ahead and update

https://github.com/itflow-org/itflow/commit/4a2d76b0563acf308d27a38329596a298867442e

Also keep up the great work of reporting umlauts, nobody likes them umlauts