Skip to content

Object: Remove deprecated list encoding - #11978

Merged
kergomard merged 1 commit into
ILIAS-eLearning:release_10from
iszmais:bugfix/obj-list-encoding
Aug 25, 2026
Merged

Object: Remove deprecated list encoding#11978
kergomard merged 1 commit into
ILIAS-eLearning:release_10from
iszmais:bugfix/obj-list-encoding

Conversation

@iszmais

@iszmais iszmais commented Aug 24, 2026

Copy link
Copy Markdown
Contributor

@iszmais
iszmais requested a review from kergomard August 24, 2026 14:22
@iszmais iszmais added bugfix php Pull requests that update Php code labels Aug 24, 2026

@kergomard kergomard left a comment

Copy link
Copy Markdown
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

I do not agree with your assessment. Setting titles and descriptions on UI components is the domain of ILIASObject. The renderer should never sanitize anything and it was the wrong move to (partially) introduce this in the framework as it can and should not care what data it receives as long as it is printable. The problem with this approach can easily be seen by the places where we had to introduce withoutStriptags(). So, this should currently be fixed by preventing double-encoding in the corresponding htmlentities in the renderer of the item.

@kergomard
kergomard merged commit 75a8bfe into ILIAS-eLearning:release_10 Aug 25, 2026
3 checks passed
@kergomard

kergomard commented Aug 25, 2026

Copy link
Copy Markdown
Contributor

Sorry, no, I just gave this some more thought. I'm wrong, you are right: The problem with using strip-tags was strip-tags itself not the output sanitization. I will merge this. Sorry! Merged and picked ILIAS 11 and trunk.

Some more of my reasoning here, but we should give this more thought, as we are doing this completely inconsistently:

  • The renderer always has the problem that it doesn't know what it receives. This problem should be solved by a denser description of the input. Until then we should only accept pure text as input and sanitizing with htmlentities is ok.
  • We need to do the sanitization in the renderer, if we want the renderers to be exchangeable in the future.

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

bugfix php Pull requests that update Php code

Projects

None yet

Development

Successfully merging this pull request may close these issues.

2 participants