Summary¶

On the import of extensionlist.xml.gz from ter.typo3.org, TYPO3 CMS does not process all details in field uploadcomment due to a HTML-encoded character (#13;). As a result, the upload comment provided by extension authors is incompletely shown in the Extension Manager in TYPO3 instances. This is the case for several extensions (see examples below).

Description¶

Extension authors can (should) enter a comment, when they upload/publish an extension (or a new version of an extension) to the TYPO3 Extension Repository . The TER features such an upload function and allows authors to enter the upload comment in a textarea. Line breaks can be entered by using <RETURN> (one or more). These line breaks are converted into the HTML-encoded character #13; in the extension list, which is for example downloaded by TYPO3 instances via the Extension Manager.

The Extension Manager stores the extension list in a sub-folder of typo3temp/, extracts and parses the XML file and saves the data into the local database (table: tx_extensionmanager_domain_model_extension). However the parser function treats the character #13; as a separator and only stores the string after the last occurrence of #13; to the database.

As a consequence, the following data in file extensionlist.xml.gz...

...
<uploadcomment>Official AWS SDK for PHP version 3.19.11 with updates and bugfixes for AwsCloudFormation and AwsS3.&#13;
https://github.com/aws/aws-sdk-php/releases/tag/3.19.11</uploadcomment>
...

...results in the fact, that only the last line (in this case the link to github.com) is shown in the TYPO3 instance.

Screenshots¶

Attached screenshot0001.png shows an extract of file extensionlist.xml.gz
Attached screenshot0002.png shows an example of the EM, function "show all versions of ...".
Attached screenshot0003.png shows an example of the EM, dialog when updating an extension.

Impact¶

The character #13; occurs more than 9000 times in file extensions.xml.gz as of Oct/2016. The XML file has a total of approx. 700,000 lines.

# zegrep "&#[0-9]*;" 1.extensions.xml.gz 

Several TYPO3 CMS extensions are affected. Some of them are: a21glossary, aahbook, ab_linklist, constant_editor, ke_yac, aws_sdk_php, captcha, find_and_replace, html5_readykit, lpc_sermons, etc.

Possible Solutions¶

Basically I see at least three options how to fix this problem:

1. Make sure, extensionlist.xml.gz does not contain this character in the first place (or escape it properly)
2. Let the XML Parser function treat the character as a separator, but join all elements together rather than overwriting existing elements
3. Remove the character in question before the XML file gets parsed and the data imported

Affected file for solutions 2 and 3 is: typo3/sysext/extensionmanager/Classes/Utility/Parser/ExtensionXmlPushParser.php.

Reproducibility¶

The issue is reproducible: yes
Tested in TYPO3 CMS version 7.6.11 with PHP version 5.6.26 (standard Debian Jessie environment)
Tested in TYPO3 CMS version 8.3.1 with PHP version 7.0.x

Additional Notes¶

Thanks to Daniel Sun for investigating the issue.