Fix EZP-23086: Image thumbnail not shown on backend if alias contains…

… quotes
ezsystems · Jul 9, 2014 · 07de126 · 07de126
1 parent 49d6016
commit 07de126
Show file tree

Hide file tree

Showing 3 changed files with 23 additions and 7 deletions.
diff --git a/design/admin/javascript/ezajaxsubitems_datatable.js b/design/admin/javascript/ezajaxsubitems_datatable.js
@@ -60,9 +60,9 @@ var sortableSubitems = function () {
         }
 
         var thumbView = function(cell, record, column, data) {
-            var url = record.getData('thumbnail_url');
+            var url = encodeURI(record.getData('thumbnail_url'));
             if (url) {
-                var thBack = 'background: url(' + url + ') no-repeat;';
+                var thBack = 'background: url(\'' + url.replace("'", "\\'") + '\') no-repeat;';
                 var thWidth = ' width: ' + record.getData('thumbnail_width') + 'px;';
                 var thHeight = ' height: ' + record.getData('thumbnail_height') + 'px;';
                 cell.innerHTML = '<div class="thumbview"><div id="thumbfield" class="thumbfield"></div><span><div style="' + thBack + thWidth + thHeight + '"></div></span></div>';

diff --git a/extension/ezjscore/classes/ezjscajaxcontent.php b/extension/ezjscore/classes/ezjscajaxcontent.php
@@ -313,7 +313,9 @@ public static function simplify( $obj, $params = array() )
                     $thumbHeight = isset( $imageAlias['height'] ) ? (int) $imageAlias['height'] : 0;
 
                     if ( $thumbUrl !== '' )
-                        eZURI::transformURI( $thumbUrl, true );
+                    {
+                        eZURI::transformURI( $thumbUrl, true, null, false );
+                    }
 
                     break;
                 }

diff --git a/lib/ezutils/classes/ezuri.php b/lib/ezutils/classes/ezuri.php
@@ -591,9 +591,10 @@ public static function instance( $uri = false )
      * @param string &$href
      * @param boolean $ignoreIndexDir
      * @param string $serverURL full|relative
+     * @param boolean $htmlEscape true to html escape the result for HTML
      * @return string the link to use
      */
-    public static function transformURI( &$href, $ignoreIndexDir = false, $serverURL = null )
+    public static function transformURI( &$href, $ignoreIndexDir = false, $serverURL = null, $htmlEscape = true )
     {
         // When using ezroot, immediately stop if the linked element is external
         if ( $ignoreIndexDir )
@@ -604,7 +605,7 @@ public static function transformURI( &$href, $ignoreIndexDir = false, $serverURL
             $modifiedHref = eZClusterFileHandler::instance()->applyServerUri( $trimmedHref );
             if ( $modifiedHref != $trimmedHref )
             {
-                $href = str_replace( '&amp;amp;', '&amp;', htmlspecialchars( $modifiedHref ) );
+                $href = $htmlEscape ? self::escapeHtmlTransformUri( $href ) : $href;
                 return true;
             }
             unset( $modifiedHref );
@@ -622,7 +623,7 @@ public static function transformURI( &$href, $ignoreIndexDir = false, $serverURL
             $href = '/';
         else if ( $href[0] == '#' )
         {
-            $href = htmlspecialchars( $href );
+            $href = $htmlEscape ? htmlspecialchars( $href ) : $href;
             return true;
         }
         else if ( $href[0] != '/' )
@@ -639,14 +640,27 @@ public static function transformURI( &$href, $ignoreIndexDir = false, $serverURL
             $href = preg_replace( "#^(//)#", "/", $href );
             $href = preg_replace( "#(^.*)(/+)$#", "\$1", $href );
         }
-        $href = str_replace( '&amp;amp;', '&amp;', htmlspecialchars( $href ) );
+        $href = $htmlEscape ? self::escapeHtmlTransformUri( $href ) : $href;
 
         if ( $href == "" )
             $href = "/";
 
         return true;
     }
 
+    /**
+     * Encoding cleanup used by transformURI.
+     * Extracted in a private method to avoid duplicated code.
+     *
+     * @param string $href
+     *
+     * @return string
+     */
+    private static function escapeHtmlTransformUri( $href )
+    {
+        return str_replace( '&amp;amp;', '&amp;', htmlspecialchars( $href ) );
+    }
+
     /**
      * Returns the current mode used for transformURI().
      *