email cloaking problem within introtext

[jsubri]

Steps to reproduce the issue

• Add an "Articles Category" module on the sample site
• Under "Display Options" tab: everything on Hide, except "Introtext= show" and "Show Read More=show"
• Create an article with the below html:

<p>Intro text <a href="mailto:sample@example.com">sample@example.com</a> - more more more</p>
<hr id="system-readmore" />
<p><br />Paragraph 1<br />1<br />2<br />3<br />4<br />5</p>
<p>Paragraph 2<br />1<br />2<br />3<br />4<br />5</p>
<p>Paragraph 3<br />1<br />2<br />3<br />4<br />5</p>
<p>End</p>

Expected result

Introtext shows the email address

Actual result

This email address is being protected from spambots. You need JavaScript enabled to...

System information (as much as possible)

current staging and 3.6.5, older versions probably

Additional comments

n/a

[dgrammatiko]

@jsubri There a few things that make this functionality fail:

• The module will strip out span and script tags
• The length of the introtext is trimmed (removing vital javascript)

To make it work just replace https://github.com/joomla/joomla-cms/blob/staging/modules/mod_articles_category/helper.php#L325-L332 with:

	public static function _cleanIntrotext($introtext)
	{
		$introtext = str_replace(array('<p>','</p>'), ' ', $introtext);
		$introtext = strip_tags($introtext, '<a><em><strong><span><script>');
		$introtext = trim($introtext);

		return $introtext;
	}

And increase the allowed characters (in my test case 1000)

And the million dollar question: can this be patched without this hack?

• well someone needs to spend sometime, I guess

[jsubri]

Thank you for the workaround and yes $introtext is easily above 600 characters long.
Low priority anyway.

[PhilETaylor]

Does not this solution have security implications in so much as now the _cleanIntrotext method would allow script to be output?

[dgrammatiko]

@PhilETaylor I think I should redo #11027, will make patching this a lot easier (but I don't remember the reason we end up reverting it in the first place)

[jwaisner]

@jsubri Is this issue still present in the latest J3?

---

_{This comment was created with the J!Tracker Application at issues.joomla.org/tracker/joomla-cms/13522.}

[jsubri]

I didn't checked recently, the workaround was good enough for me and I've advised my customer (NGO) to refrain adding email address in the introtext. Very high probability the javascript code is still present in the $introtext in current staging. I've not test with J4.

---

_{This comment was created with the J!Tracker Application at issues.joomla.org/tracker/joomla-cms/13522.}

[ReLater]

Is this issue still present in the latest J3?

Yes.

[ReLater]

Is this issue still present in latest Joomla 4 ?

Yes.

[brianteeman]

This is a bug that should be fixed in J3

[alikon]

please test #36602 for j4