Problem with dead issue hyperlinks

[evan]

Hello to all,

I've only recently started using OJS, and I seem to have a problem when I create hyperlinks with tinymce in an issue's text body. The version of ojs i'm using is 2.3.7 (a fresh install), and any hyperlink I create, appears dead later, when I'm viewing the current issue on http://siteroot/index.php/journal/issue/current.

I checked that all the hyperlinks are stored properly in the database in the issue_settings table (they are not malformed), which means tinymce hasn't got a
problem. To be totally sure about this, I took the tinymce plugin from an older version of ojs (that worked correctly), and installed
it to the latest version (2.3.7), but the problem persists. Even when i disabled the tinymce and created the issue's hyperlinks by hand,
they still appeared dead later.

After a bit of delving into the ojs code, i found out that the ojsroot/templates/issue/view.tpl template file, actually strips off
the href attribute when it comes to displaying the links, with the use of strip_unsafe_html. So I changed the following line

Code: Select all

<div id="issueDescription">{$issue->getLocalizedDescription()|strip_unsafe_html|nl2br}</div>

to the one below

Code: Select all

<div id="issueDescription">{$issue->getLocalizedDescription()|nl2br}</div>

Hyperlinks are now restored, but I don't know whether that solution is the optimal or not (probably it isn't).
Has anyone else faced the same problem?

Any syggestions would be greatly appreciated.

evan

[oherrero]

Works for me!

After updating to 2.3.7 I had the same problem with the hyperlinks in the issue description. Changed the code and now everything seems to be OK.

Thanks!

[ramon]

Hello all,

This indeed does create a hacked fix for the issue, but comparing the same file in ojs 2.3.6 and 2.3.8, there are no differences...
In 2.3.6, the problem didn't appear to happen, but in 2.3.8 it does.

Removing the strip_unsafe_html is NOT a good idea.

The issue may lie in NOT configuring OJS correctly.
Looking at a standard config.inc.php (version 2.3., there is a "hint" to what we need to do, but this is generally overlooked.

Code: Select all

; Allowed HTML tags for fields that permit restricted HTML.
; For PHP 5.0.5 and greater, allowed attributes must be specified individually
; e.g. <img src|alt> to allow "src" and "alt" attributes. Unspecified
; attributes will be stripped. For PHP below 5.0.5 attributes may not be
; specified in this way.
allowed_html = "<a> <em> <strong> <cite> <code> <ul> <ol> <li> <dl> <dt> <dd> <b> <i> <u> <img src|alt|class|id|style> <sup> <sub> <br> <p>"


This is a suggestion, and it should/could be added as a default in the distribution, as other tags may be added (such as table, tr, th, td, tfoot, tbody, thead)

Code: Select all

allowed_html = "<a href|class|id|style|title|alt> <em> <strong> <cite> <code> <ul class|id|style> <ol class|id|style> <li class|id|style> <dl class|id|style> <dt class|id|style> <dd class|id|style> <b> <i> <u> <img src|alt|class|id|style> <sup> <sub> <br> <p class|id|style>"


This enables the link to have the href, class, id, style, title and alt attributes (as well as id, class, style for all other tags allowed).
It may seem odd that the strip_unsafe_html function clears the href attribute, but it is just being thorough.
Also, in 2.3.6 the warning in the config is slightly different.

Again, we usually overlook README's, and general configurations, but the HREF attribute should be added as a default.
I don't think many people use older versions of PHP, and it would be nice to know what is the effect of adding the attributes in older versions (does it break or nothing happens?).

_______________________________
Ramón Martins Sodoma da Fonseca
Analista em C&T
Coordenação de Tecnologias de Informação
Instituto Brasileiro de Informação em Ciência e Tecnologia - IBICT
Ministério da Ciência e Tecnologia - MCT