CMS module for Phprojekt

Our answer was:
> Hello! I can't get URL links to work in
> CM documents. Having: <a href="redir.php?
> cm_elink=http ://www.test.com">http://www.test.com
> </a> in a "Edit document" window...

Yes, that is expected as external links are converted to be redirected by the redir.php script.

> after saving I get -CMGT-a href=\-CMDQ-redir.php?
> cm_elink=http ://www.test.com\-CMDQ--CMLT-
> http ://www.test.com-CMGT-/a-CMLT- in a database.

This is expected too, as those characters (<, >, ") are converted before being stored in the database. (The purpose of this is that all content in the database is stored as character entities and those characters should be preserved later).


> And then opening that document my link looks
> this way: http ://myserver.com/phprojekt/cm/
> %5C%22redir.php?cm_elink=http://www.test.com\%22

Ok, now that is weird. That link is equivalent to this:
http://myserver.com/phprojekt/cm/\"redir.php?cm_elink=http://www.test.com\";


The link reference is quoted and the quotes are escaped. This escaping is happening after the data is extracted from the database, as the links in the database are not escaped.


> I use Apache with Oracle database on Windows 2000 server.
> If magic quotes matters, my settings in php.ini are:
> magic_quotes_gpc = Off
> magic_quotes_runtime = Off
> magic_quotes_sybase = Off
> Thanks for suggestion / solution in advance!
> Benjamin

The CMS has not been tested on Oracle (at least by me). I will try to replicate your configuration to search for an answer. Benjamin, in the mean time try the following:

In the script cm/display.php, around line 136, 141, and 147 wrap the fcm_process_markup function call with the stripslashes function so that it looks like this:
echo stripslashes (fcm_process_markup (fcm_secure_html (fcm_decode_htmlfull ($row1[2])), $cm_path, true));

...like this:
echo stripslashes (fcm_process_markup (fcm_htmlentity (fcm_decode_html ($row1[2])), $cm_path, false));

...and like this:
echo stripslashes (fcm_process_markup ($row1[2], $cm_path, false));

Need to test with Oracle and discard some problem with quotes-sybase or the such. The escaping seems to be ocurring when reading from the database. We forgot to confirm the version of the CMS.

The user reported fixing it with by wrapping the output with stripslashes. Pending to replicate environment to test.

Severity changed to Normal, as this render the links in content unusable, but there is an easy workaround.

Priority changed to Medium-low, as there is a workaround and it has not been reported before.