Not a bug Unescaped phrase in template navigation_list

[Kirby]

Affected version

2.1.0 Beta 2

tooltip="{{ phrase('enable_disable_x', {'title': $navigation.title}) }}" />

This should be either escaped or the Templater should generally take care of this:

Fixed - Unescaped phrase in \XF\Template\Templater::getDataRowCell()

Phrase delete is not escaped when used in \XF\Template\Templater::getDataRowCell() for a title attribute. if (!$tooltip) { $tooltip = \XF::phrase('delete'); } $html = "";

xenforo.com

 

[Chris D]

Do you have any sort of reproduction case for this, or are you just theorising on the fact that there is a phrase used in an attribute?

Pretty much all attributes used on an XF template tag get processed and escaped appropriately, therefore this example should be fine, unless you have some reason to suspect it isn't?

 

[Kirby]

Actually this is not a bug.

I did have some garbled output on the navigation list with enable/disable phrases, though that was not cused by XenForo.

Sorry