opengraph conten plugin: wrong handling of " (" ")

[Dirk67]

if you have quotes (") in your articles title or article-text
joomla makes " out of them ... (PHP: htmlspecialchars)
so far so good ...

but then in the og: tags
there appears "
(maybe double execution of (PHP: htmlspecialchars) ? -> maybe use the $double_encode = false parameter of htmlspecialchars)

[Dirk67]

it seems that the call
$document->setMetadata
in .../plugins/content/phocaopengraph/phocaopengraph.php
on line 111
does already a htmlspecialchars conversion on its own* (?):

Test: if I insert

Code: Select all

$document->setMetadata(htmlspecialchars($name, ENT_COMPAT, 'UTF-8'), '& < > "', $typeString);

at line 111 for test purposes,
in the html head shows correctly:

Code: Select all

<meta property="og:title" content="&amp; &lt; &gt; &quot;">

strangely enough:
*this works for the $value part only (second argument of $document->setMetadata)
but not for the name part (first argument of $document->setMetadata)

-----------

using Joomla 5.3.0 / PHP 8.4.3

[Dirk67]

I think the second/double htmlspecialchars happens (in Joomla core) here:
https://github.com/joomla/joomla-cms/bl ... r.php#L158

Code: Select all

$buffer .= $tab . '<meta ' . $type . '="' . $name . '" content="'. htmlspecialchars($contents, ENT_COMPAT, 'UTF-8') . '">' . $lnEnd;

"type" and "name" are left unchanged while "content" gets a htmlspecialchars conversion ...

[Jan]

Hi, are you sure, that "setMetadata" method uses this function?

Jan

[Dirk67]

no not sure,

but if I remove* the
the "htmlspecialchars" from the $document->setMetadata calls in
".../plugins/content/phocaopengraph/phocaopengraph.php"
everything works as expected even when inserting the characters " < > & in the title or desription

*(for the $value part only (second argument of $document->setMetadata)
but not for the $name part (first argument of $document->setMetadata))


what results came out with your own tests ?

[Jan]

I get everything OK:





The question is if there is no other process which can somehow influence it.

Jan