Bug #71692: Fluid does not encode objects that act as string (have the __toString method) - TYPO3 Core - TYPO3 Forge

Actions

Copy link

Bug #71692

closed

Fluid does not encode objects that act as string (have the __toString method)

Added by Claus Due about 9 years ago. Updated over 8 years ago.

Status:

Closed

Priority:

Should have

Assignee:

Category:

Target version:

Start date:

2015-11-19

Due date:

% Done:

Estimated time:

TYPO3 Version:

PHP Version:

Tags:

Complexity:

Is Regression:

Sprint Focus:

Description

See https://github.com/TYPO3/TYPO3.CMS/blob/master/typo3/sysext/backend/Resources/Private/Partials/ButtonBar.html

Uses {button} without escaping with f:raw which should cause the output to be escaped. It does not.

This problem does not exist in standalone Fluid.

Actions

Copy link

Updated by Helmut Hummel about 9 years ago

Project changed from TYPO3 Core to 1716
Category deleted (~~Fluid~~)

Actions

Copy link

Updated by Helmut Hummel about 9 years ago

Subject changed from SECURITY: HTML does not get escaped in EXT:backend/Resources/Private/Partials/ButtonBar.html to Fluid does not encode objects that act as string (have the __toString method)

We should keep it like that as changing it would be breaking and we will include standalone Fluid in TYPO3 8 anyway where this (and more inconsistencies) will be fixed.

Actions

Copy link