Bug Problem with certain characters in meta tags

[montster]

Hi. When users include single quotes, it can cause problems in the meta tags. They come through and break the head information and make it so css is gone.

Example: STs Log

The user's text starts as "32 year old 6' 2" 178lb Weakling trying to get strong. Started my first workout on August 12, 2015. Making some progress, but my leg strength is out of balan..."

In the head area, the user's post content is pulled in and breaks the meta og:description as the single quote is pulled in at ****

<meta property="fb:app_id" content="384445501740477" />
<meta property="og:site_name" content="Starting Strength Forums" />
****<meta property=' 2" 178lb Weakling trying to get strong. Started my first workout on August 12, 2015. Making some progress, but my leg strength is out of balan" />
<meta property="og:url" content="http://startingstrength.com/resources/forum/starting-strength-training-logs/61504-sts-log.html" />
<meta property="og:type" content="article" />
<meta property="og:image" content="http://startingstrength.com/images/ss3/og_forum.jpg" />

I tried to put the single quote as a blocked word, but that didn't seem to change things.

 

[Fillip H.]

Hey,

Sorry for the delay, I'm currently looking into this and will get back to you when I have more information or if I need your help in resolving this

 

[Fillip H.]

Could you please create and PM me with a temporary FTP and AdminCP account?

For security reasons, we recommend you create a new FTP account only for DBTech support, then disable or delete it after we have both confirmed the issue has been solved and there are no further issues.

The same applies to AdminCP accounts; they should ideally be temporary accounts created for us only. If we have created an account on your site already, you can optionally boost that account to Administrator and then de-admin this account once the issue has been solved.

If you use a .htaccess password protection for your AdminCP directory, it is recommended that you create a new authorised user for DBTech and remove this user once the issue has been solved.

Please test any temporary accounts you create to ensure that the FTP account has access to the forum files, and that the AdminCP account can access the administrative controls for the product we are assisting you with.

Ensuring this is all in order before submitting the information will significantly speed up the process of assisting you. We will alert you via PM if there's any issues with the login information you have provided.

When sending the PM, for your security you should also un-tick the "Save a copy in my Sent Items folder" checkbox. When the access details have been received, we will delete the PM from our inbox. Ensuring you have not kept a copy of the PM reduces the risk of security breaches.

Thank you for helping us debug our products and allowing us to assist you, we appreciate it

 

[montster]

I did not receive any response to the report. I got a message that the ticket was submitted and a message that the ticket was closed, but no information in between.

This thread information was not sent and I had absolutely no indication from the ticket entry that the reply would be in a thread and not through a ticketing system.

 

[Fillip H.]

Hi there,

The email you received contained a link to your entry for review. That being said, we can look into enabling automatic thread subscriptions for threads in this forum

I'll look into your query as soon as I can!

 

[Fillip H.]

Update: I removed all cached meta descriptions from the database by running

update thread set dbtech_dbseo_description = ''

and the thread now appears to display correctly

 

[montster]

The problem is still there, it only resolved because the post itself was edited in an attempt to remove the problem before you went in and cleared the cache.

I've just retested the original defect by starting the text in a post with this: 6'1" [I mean that the body of the post starts exactly that way, with a single quote early in the text]

What happens is that the single quote following the 6 is picked up and dropped in the <meta property="og:description" line as:
<meta property='1"" /> [Copied from the source]


If the post starts as --> I am 6'1" - then this problem doesn't occur. It comes up as
<meta property="og:description" content="I am 6'1"" />

I've tested starting posts in a variety of ways to help

These things cause a problem if they're in the first text of a post:
1. 6' (a single number followed by a single quote mark)


These things as first text do not:
1. ' (<-- single quote)
2. ' (<-- space followed by a single quote mark)
3. a' (<-- letter followed by a single quote mark)
4. 33' (<-- two numbers followed by a single quote mark)
5. 6" (<-- a single number followed y a double quote mark)
6. *' (<-- a symbol followed by a a single quote mark)

 

[Fillip H.]

Hi there,

Sorry for the trouble

I'm still unable to replicate this issue, could you please provide an exact page text that reproduces this?

 

[montster]

Hi there,

Sorry for the trouble

I'm still unable to replicate this issue, could you please provide an exact page text that reproduces this?

Strange. It does this on every sub-forum. Here is an example on a non-moderated sub-forum.

Link: test

The title was test
and the only text typed in was 6'

You can see the message after you scroll through all the wrecked css.

 

[Fillip H.]

I receive a Connection Refused error when attempting to visit that page, is your server working?

Can you also double-check that 87.81.216.250 hasn't been added to the firewall by ModSecurity / cPanel if you run those?

 

[montster]

It was down for 5 min.
It is up now.

 

[Fillip H.]

I see the issue, I couldn't replicate it locally because I don't have Facebook enabled locally.

I've discovered a fix which will be available in the next version. Thanks