Backslash escape quote on plugin editor save?

☆ A M B ☆
211 Posts

redstormj Reply #1, 16 years, 7 months ago

Hello, i recently made a fresh install from the svn, I am running the latest Evolution branch 1.0.2 from the svn.

The problem is, when saving a plugin (after editing it) it seems to try and escape quotes by adding \ (slashes) before them.

Here is a sample resulting quote from an array:

// cleanup HOST header, remove leading \\\"www.\\\" and save it
$str_domain = strtolower(trim($_SERVER[\\\'HTTP_HOST\\\'], \\\" \\\\t\\\\n\\\\r\\\\0\\\\x0B.\\\"));
if ( strpos($str_domain, \\\"www.\\\")===0 ) $str_domain = substr($str_domain, 4);

The correct code should be:

// cleanup HOST header, remove leading "www." and save it
$str_domain = strtolower(trim($_SERVER['HTTP_HOST'], " \t\n\r\0\x0B."));
if ( strpos($str_domain, "www.")===0 ) $str_domain = substr($str_domain, 4);

If I keep editing and saving the document, it keeps adding more slashes.

I am not sure if this is a server configuration issue as I had not seen this before and I have installed modx quite a bit in the past. This is from a plugin I have running in many websites yet only this one gives me the problem.

It is worth mentioning this is a brand new server too, so like I said, it may very well a server configuration issue but I am somewhat clueless where to start looking.

Thanks.

☆ A M B ☆
211 Posts

redstormj Reply #2, 16 years, 7 months ago

ugh, someone slap me plz, so dumb, server had magic quotes on.

GRRRRR.

MODX Staff
730 Posts

netProphET Reply #3, 16 years, 7 months ago

Thanks for posting anyway.. it seems to me that MODx should detect magic_quotes, and in fact it does try to handle it in this bit of code in the manager’s front controller:

if (version_compare(phpversion(), "5.3") < 0) {
    @set_magic_quotes_runtime(0);

    // include_once the magic_quotes_gpc workaround
    include_once "quotes_stripper.inc.php";
}

Notice that if it sees that you’re using PHP 5.3 or greater, it just leaves things alone. This must be on the assumption that since magic quotes are deprecated in 5.3, that no one will ever have them on.

I think this may be worth a ticket in Jira.

Mike Schell
Lead Developer, MODX Cloud
Email: [email protected]
GitHub: https://github.com/netProphET/
Twitter: @mkschell

MODX Staff
10,725 Posts

opengeek Reply #4, 16 years, 7 months ago

This was done on purpose to avoid the deprecated errors folks were getting when using PHP 5.3. Since all the error_reporting levels changed with 5.3, and Evolution currently does not properly ignore deprecated errors, to use Evolution on PHP 5.3, you need to turn magic_quotes_gpc off.

Jason Coward
Chief Architect @ MODX
http://www.jasoncoward.com | http://twitter.com/drumshaman | https://github.com/opengeek

MODX Staff
730 Posts

netProphET Reply #5, 16 years, 7 months ago

Just to play devil’s advocate, couldn’t there be situations where users will have 5.3, with magic_quotes_gpc on, and they don’t have ability to change php config? Their only option then is to change hosts, or don’t use MODx.

Mike Schell
Lead Developer, MODX Cloud
Email: [email protected]
GitHub: https://github.com/netProphET/
Twitter: @mkschell

MODX Staff
10,725 Posts

opengeek Reply #6, 16 years, 7 months ago

Quote from: netProphET at Feb 18, 2010, 09:59 AM

Just to play devil’s advocate, couldn’t there be situations where users will have 5.3, with magic_quotes_gpc on, and they don’t have ability to change php config? Their only option then is to change hosts, or don’t use MODx.

The deprecated error handling needs to be fixed first, and then this can be addressed.

Jason Coward
Chief Architect @ MODX
http://www.jasoncoward.com | http://twitter.com/drumshaman | https://github.com/opengeek

30 Posts

iskri Reply #7, 15 years, 7 months ago

I have a similar problem:

I have just upgraded to evo 1.0.5 on a clients live site.
I edited a template but once saved, the template now has loads of escaping backslashes, and it has totally screwed up the site....
All the templates now do this and any new ones as well.

Need help with this urgently...
php 5.3 took down 12 of my sites with my main webhost due to deprecated errors last week. My host fixed this by making modx stop outputting the errors by editing /manager/includes/document.parser.class.inc.php

However, this site is hosted with another company AND is a fresh unmodified evo 1.0.5 install... what the hell is going on?????

<!DOCTYPE html PUBLIC \\\"-//W3C//DTD XHTML 1.0 Transitional//EN\\\" \\\"http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd\\\">
<html xmlns=\\\"http://www.w3.org/1999/xhtml\\\">
<head>
<meta http-equiv=\\\"Content-Type\\\" content=\\\"text/html; charset=utf-8\\\"/>

<title>[(site_name)] | Residual Stress Measurement Experts | [*pagetitle*]</title>

<meta name=\\\"ROBOTS\\\" content=\\\"{{robots}}\\\" />
<meta name=\\\"Copyright\\\" content=\\\"©[[GetCurrentYear]] [(site_name)] Ltd.\\\" />
<meta name=\\\"description\\\" content=\\\"VEQTER - Residual Stress Measurement Experts | [*longtitle*]\\\" />

30 Posts

iskri Reply #8, 15 years, 7 months ago

I have managed to fix by turning off this function in the .htaccess file.

#php_flag register_globals Off

becomes

php_flag register_globals Off

MODX Staff
730 Posts

netProphET Reply #9, 15 years, 7 months ago

I continue to be amazed at the number of hosts who leave register_globals turned On, when the default setting was changed from On to Off from PHP 4.2 onwards. And as of PHP 5.3, the setting itself is deprecated.

In any case, MODX should have warned you that register_globals was On by way of a configuration warning when you logged into your manager. Did it fail to do so?

Mike Schell
Lead Developer, MODX Cloud
Email: [email protected]
GitHub: https://github.com/netProphET/
Twitter: @mkschell

☆ A M B ☆
24,524 Posts

sottwell Reply #10, 15 years, 6 months ago

Actually that extra escaping backslash has nothing to do with register_globals (which in itself is a security problem), but is from magic_quotes_gpc. This needs to be turned off as well. Perhaps your host already did that in the php.ini file.

Studying MODX in the desert - http://sottwell.com
Tips and Tricks from the MODX Forums and Slack Channels - http://modxcookbook.com
Join the Slack Community - http://modx.org