Small bug: User titles with special characters can't be set in profile

We have a group called ‘Blockchain & beyond’. If a non-admin user tries to change the user title in the profile to a group with special characters like ‘&’, the change doesn’t get saved. Admins can change the title, but then the ‘&’ shows up as & in the profile.

1 Like

This seems like a bit of a bug @eviltrout

Can you look into this @Roman_Rizzi? Thanks!

3 Likes

Titles are escaped for security reasons.

https://github.com/discourse/discourse/commit/629bb8adf2f4e96ef69e2f975f6860ad4fbe204b

Here’s a PR to fix it:

https://github.com/discourse/discourse/pull/7979

5 Likes

Are you confident this won’t regress us on security @eviltrout? If so then let’s close this as done.

Yes the issue is it was “double” secure. We were storing the secure version then making that “extra” secure.

3 Likes