#2852 - Improper rendering of custom modules

By PDStig
Added 3rd Oct 2016, 7:36 AM
0 views

Identifier	#2852
Issue type	Major issue (breaks an entire feature)
Title	Improper rendering of custom modules
Status	Closed (rejected)
Handling member	Chris Graham
Addon	core
Description	Custom modules do not properly parse nor render. For example, if I make a custom topicview.php and place it in forum/pages/modules_custom , regardless whether or not it's an exact copy of the original, time tags fail to render properly (displays the literal tag), the control functions and marked posts dropdowns are left blank/empty, and the attachment manager info in the quick reply box displays literal code instead of rendering the text it should.
Steps to reproduce
Funded?	No

The system will post a comment when this issue is modified (e.g., status changes). To be notified of this, click "Enable comment notifications".

Rating

Unrated

Comments

By Guest posted 3rd Oct 2016, 4:31 PM

As of v10 any overridden code will have auto-escaping, which may break things because not everything can be tracked.

A programmer has to add:

i_solemnly_declare(I_UNDERSTAND_XSS); to turn off auto-escaping, indicated to Composr that you really do know enough about security for Composr to not try and save you from yourself.