{"action":"created","issue":{"url":"https://api.github.com/repos/s9y/Serendipity/issues/250","labels_url":"https://api.github.com/repos/s9y/Serendipity/issues/250/labels{/name}","comments_url":"https://api.github.com/repos/s9y/Serendipity/issues/250/comments","events_url":"https://api.github.com/repos/s9y/Serendipity/issues/250/events","html_url":"https://github.com/s9y/Serendipity/issues/250","id":52602476,"number":250,"title":"entity functions and double_encoding issues with ISO-8859-1","user":{"login":"ophian","id":1105372,"avatar_url":"https://avatars.githubusercontent.com/u/1105372?v=3","gravatar_id":"","url":"https://api.github.com/users/ophian","html_url":"https://github.com/ophian","followers_url":"https://api.github.com/users/ophian/followers","following_url":"https://api.github.com/users/ophian/following{/other_user}","gists_url":"https://api.github.com/users/ophian/gists{/gist_id}","starred_url":"https://api.github.com/users/ophian/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/ophian/subscriptions","organizations_url":"https://api.github.com/users/ophian/orgs","repos_url":"https://api.github.com/users/ophian/repos","events_url":"https://api.github.com/users/ophian/events{/privacy}","received_events_url":"https://api.github.com/users/ophian/received_events","type":"User","site_admin":false},"labels":[{"url":"https://api.github.com/repos/s9y/Serendipity/labels/2.0","name":"2.0","color":"eb6420"},{"url":"https://api.github.com/repos/s9y/Serendipity/labels/discuss","name":"discuss","color":"bfd4f2"},{"url":"https://api.github.com/repos/s9y/Serendipity/labels/enhancements","name":"enhancements","color":"f7c6c7"}],"state":"open","locked":false,"assignee":null,"milestone":{"url":"https://api.github.com/repos/s9y/Serendipity/milestones/1","labels_url":"https://api.github.com/repos/s9y/Serendipity/milestones/1/labels","id":589613,"number":1,"title":"Stable","description":null,"creator":{"login":"yellowled","id":326223,"avatar_url":"https://avatars.githubusercontent.com/u/326223?v=3","gravatar_id":"","url":"https://api.github.com/users/yellowled","html_url":"https://github.com/yellowled","followers_url":"https://api.github.com/users/yellowled/followers","following_url":"https://api.github.com/users/yellowled/following{/other_user}","gists_url":"https://api.github.com/users/yellowled/gists{/gist_id}","starred_url":"https://api.github.com/users/yellowled/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/yellowled/subscriptions","organizations_url":"https://api.github.com/users/yellowled/orgs","repos_url":"https://api.github.com/users/yellowled/repos","events_url":"https://api.github.com/users/yellowled/events{/privacy}","received_events_url":"https://api.github.com/users/yellowled/received_events","type":"User","site_admin":false},"open_issues":7,"closed_issues":14,"state":"open","created_at":"2014-03-06T17:18:58Z","updated_at":"2015-01-02T17:54:28Z","due_on":null,"closed_at":null},"comments":9,"created_at":"2014-12-21T18:34:58Z","updated_at":"2015-01-03T21:26:46Z","closed_at":null,"body":"follow-up from #236 \r\n\r\n> We would need to find the places where we actually do double encoding, and fix those.\r\n\r\nTo sum this behaviour mentioned in #236:\r\n\r\nNone supported chars are stored as entities to database. eg `日本 and äöü and € β ♥` as `&#26085;&#26412; and äöü € and &#946; &#9829;`.\r\n\r\nserendipity_printEntries() will now run htmlspecialchars() to $entry['title'], $entry['title_rdf'] and $entry['author'] but not to $entry['body'] etc. This is why $entry['body'] etc works, but the title will be double_encoded to `&amp;#26085;&amp;#26412; and äöü € and &amp;#946; &amp;#9829;` (each `&` to `&amp;`), while htmlspecialchars does not care (if you don't advice it) and encodes every found `&` again.\r\n\r\nThis happens to staticpages too, We can now say \"_don't use such chars then..._\" or find a solution to not let it happen like this and unescape first before escape, or just by setting double_encoding behaviour to false particularly or generally."},"comment":{"url":"https://api.github.com/repos/s9y/Serendipity/issues/comments/68610226","html_url":"https://github.com/s9y/Serendipity/issues/250#issuecomment-68610226","issue_url":"https://api.github.com/repos/s9y/Serendipity/issues/250","id":68610226,"user":{"login":"garvinhicking","id":273326,"avatar_url":"https://avatars.githubusercontent.com/u/273326?v=3","gravatar_id":"","url":"https://api.github.com/users/garvinhicking","html_url":"https://github.com/garvinhicking","followers_url":"https://api.github.com/users/garvinhicking/followers","following_url":"https://api.github.com/users/garvinhicking/following{/other_user}","gists_url":"https://api.github.com/users/garvinhicking/gists{/gist_id}","starred_url":"https://api.github.com/users/garvinhicking/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/garvinhicking/subscriptions","organizations_url":"https://api.github.com/users/garvinhicking/orgs","repos_url":"https://api.github.com/users/garvinhicking/repos","events_url":"https://api.github.com/users/garvinhicking/events{/privacy}","received_events_url":"https://api.github.com/users/garvinhicking/received_events","type":"User","site_admin":false},"created_at":"2015-01-03T21:26:46Z","updated_at":"2015-01-03T21:26:46Z","body":"The ISO charsets were german ones... Asians would use this koi8r charset.... So usually if someone uses a local charset he uses local characters and not pnes that aren't available. For such content UTF-8 was created, so I really think we'd be fine with that ;)\r\n\r\nI don't have specific examples for the exploiting, it's more a gut feeling and I would rather inspect other issues ;-)\r\n\r\n\r\n> On 03.01.2015, at 16:11, Ian <notifications@github.com> wrote:\r\n> \r\n> Hm. I'd say that those chars should really not be used then; if someone asian would need the chars they should use a UTF-8-Blog.\r\n> \r\n> Simply the best, yes!  I came into talk with that, since you claimed Serendipity being widely used in Asia with native or ISO charsets and this being a unique characteristic. Since I could not play around with native charset other than german, I used ISO to test this. I am quite sure there are a lot of these users having native keyboards and write for their own lang only, which includes titles, names etc.\r\n> \r\n> Just to use char encoding prevention that could possibly result in security issues for those installs is IMO not the proper way to go.\r\n> \r\n> This is still a question for me: how this could be exploited?\r\n> \r\n> —\r\n> Reply to this email directly or view it on GitHub.\r\n> "}}