CU202: Modifying the openbox method in header.pl broke French accents
And more …
I can confirm the issue
There was a fix implemented in header.pl to escape the titles in the openbox section to prevent a potential vulnerability.
The escape command on its own doesn’t work well with characters with diacritical marks.
This needs to have the cleanhtml command run in place of the escape command as that decodes the utf-8 text then runs the escape command (the decode ensures that umlauts, accents etc are treated correctly by the escape command. Then after the escape step the text is encoded back to utf-8 which then ensures the characters are displayed correctly.
The above is my conclusion from first look.
I will try to find some time to test this out and if correct to submit a patch to fix it.
A little test shows this is the reason of the issue.
Your explanation shows clearly the problem and a little change
-my $title = &Header::escape(shift);
+my $title = &Header::cleanhtml(shift);
in header.pl ( line 340 ) does the job.
Thank you.
I just made the correction in and it works fine.
// var/ipfire/header.pl
339: # Clean the title
340: my $title = &Header::cleanhtml(shift);
341:
Some other candidates for the problem
escape.pdf (2,7 KB)
It is just a text file, but upload doesn’t allow .txt
It may not be complete, some lines are commented #.......
Solved.
Many thanks.
Did you perhaps upload the wrong file?
You are right. Corrected.
Indeed,
The problem is more significant than just the page titles
It also affects values in forms.
It’s surprising no one noticed it sooner.
(It is true that I avoid using accented letters in comments 
)
To avoid modifying all pages, it is therefore preferable to modify the escape and cleanhtml functions as follows.
// var/ipfire/header.pl
628: sub escape($) {
629: my $outstring = shift;
630: # decode the UTF-8 text so that characters with diacritical marks such as
631: # umlauts are treated correctly by the escape command
632: $outstring = &Encode::decode("UTF-8",$outstring);
633: $outstring = HTML::Entities::encode_entities($outstring);
634: $outstring = &Encode::encode("UTF-8",$outstring);
635: return $outstring;
636: }
637:
...
650: sub cleanhtml {
651: my $outstring =$_[0];
652: $outstring =~ tr/,/ / if not defined $_[1] or $_[1] ne 'y';
653: $outstring = escape($outstring);
654: return $outstring;
655: }
656:
I tested it in French, It works, but there are some side effects; I found one in firewall.cgi.
// html/cgi-bin/firewall.cgi
2351: $fwdfwsettings{'ruleremark'}=~ s/,/;/g;
2352: utf8::decode($fwdfwsettings{'ruleremark'});
2353: $fwdfwsettings{'ruleremark'}=&Header::escape($fwdfwsettings{'ruleremark'});
2354:
It would need more extensive testing; we’ll see in a future version…
Hello Phil,
I would like to encourage you to open bug reports for things like this in the future, so that they can be fixed.
This is a pure support forum and although there is a lot of development effort going on here, posting clear bugs in a thread will definitely result in them getting lost.
You’re right, but I didn’t want to publish a bug report without your permission.
You don’t need my permission to open one, but coordinating before can be very useful.