Bug #73156
closedFrontendContentAdapterService concatenates multi-line fields by LF without replacing LFs before
100%
Description
FrontendContentAdapterService
, used for compatibility with old field syntax, concatenates some fields (such as description
=> imagecaption
) by line-feed (LF) characters to provide backwards-compatibility with old index-based splitting of combined fields as used before FAL introduction. As image captions have been changed to allow multi-line input with FAL, editors may now enter LF characters into image reference fields which results in shifted indices upon unsanitized concatenation.
As an example, imagine the following input in a content element with multiple images to the image Description fields:
- Image 1:
First description continues<LF>on the next line.
- Image 2:
This is image 2.
- Image 3:
Where's image 3?
This results in a concatenated string as follows:
First description continues on the next line. This is image 2. Where's image 3?
On frontend, as splitting happens over LF (e.g. if CSC 4.5 is being used for output), this will render as:
+------------+ +------------+ +------------+ | image 1 | | image 2 | | image 3 | +------------+ +------------+ +------------+ First description on the next line. This is image 2. continues
This issue can be fixed by replacing all editor-provided line-feed (LF) characters by carriage-return (CR):
First description continues<CR>on the next line. This is image 2. Where's image 3?
Resulting in:
+------------+ +------------+ +------------+ | image 1 | | image 2 | | image 3 | +------------+ +------------+ +------------+ First description This is image 2. Where's image 3? continues on the next line.
The patch provided for this issue first changes CRLF sequences to CR to avoid duplicating line breaks, then replaces all remaining single LFs to CR. Concatenation still happens over LF, requiring no changes to any other code. The HTML generated by CSC 4.5 remains valid:
- single CRs are also recognized as line-breaks for image caption rendering and convert to BR tags
- CRs in attributes are permitted syntax and will be either replaced by simple space characters if browsers can't handle them or they will show as an actual line-break (if used in e.g. title attributes)
As TYPO3 7 no longer provides FrontendContentAdapterService
the patch only applies to 6.2.
Updated by Daniel Neugebauer almost 9 years ago
Patch will be committed to Gerrit in a few minutes...
Updated by Gerrit Code Review almost 9 years ago
- Status changed from New to Under Review
Patch set 1 for branch TYPO3_6-2 of project Packages/TYPO3.CMS has been pushed to the review server.
It is available at https://review.typo3.org/46506
Updated by Gerrit Code Review over 8 years ago
Patch set 2 for branch TYPO3_6-2 of project Packages/TYPO3.CMS has been pushed to the review server.
It is available at https://review.typo3.org/46506
Updated by Daniel Neugebauer over 8 years ago
Pushed the missing unit test to Gerrit which was tested (failing) with current 6.2 head. Applying the patch for this issue, FrontendContentAdapterService passes the test. Please review again.
Updated by Daniel Neugebauer about 8 years ago
Just wanted to bump the issue as I fear the patch might have been forgotten - there have been multiple releases of 6.2 containing not only security but also generic bug fixes since I submitted the missing tests.
Updated by Gerrit Code Review about 8 years ago
Patch set 3 for branch TYPO3_6-2 of project Packages/TYPO3.CMS has been pushed to the review server.
It is available at https://review.typo3.org/46506
Updated by Gerrit Code Review about 8 years ago
Patch set 4 for branch TYPO3_6-2 of project Packages/TYPO3.CMS has been pushed to the review server.
It is available at https://review.typo3.org/46506
Updated by Gerrit Code Review about 8 years ago
Patch set 5 for branch TYPO3_6-2 of project Packages/TYPO3.CMS has been pushed to the review server.
It is available at https://review.typo3.org/46506
Updated by Anonymous about 8 years ago
- Status changed from Under Review to Resolved
Applied in changeset cf20781568558cc95389b2d60bc5862402065d53.