Boards Update - Character Encoding, Hot Sorting Fix, & Notification Service Fix

Modmichaelchan·Feb 13, 2019·9 votes·3,590 views

Hi all,

The issue where characters were automatically decoded when a thread was initially posted has been resolved.

What this means: When you first post a thread with characters like > or #, etc, it will no longer show as > or #, but rather as the appropriate markup. As an example, this thread will include the quotation markup, which would have not have encoded properly prior to the update, and would've required a thread edit to fix. No more "amp;gt;"'s.

This is the example quote

I'd like to thank the folks who've been working on this fix, along with many of the other issues that've been brought up. And of course, thanks to all of you for your reports.

That being said, the Notification System is now working again, and the Hot sorting appears to be working as well!

Cheers!

15 Comments

Salvor HardınFeb 13, 20192 votes

No more "amp;gt;"'s

Goodbye to those days of having to edit the post as soon as you publish it. https://uploads.disquscdn.com/images/0c97cbc7ed9c81d89ad73d6c3195b2f0ae0415d79831d1c942103418f2a442de.gif

A little question Wuks, do you think that someday we can have an application of the forum for mobiles?

ModmichaelchanFeb 13, 20191 votes

Definitely a possibility. Will have to get back to you on this.

dome025Feb 14, 20191 votes

I think it´s broken again. At least posts which have more downvotes than upvotes are stuck in the hot section (even though they should normally disappear).

2nd ChanceFeb 14, 20191 votes

Bless

DrCyanideFeb 14, 20191 votes

https://www.youtube.com/watch?v=5VL_5MX7z94

KFCeytronFeb 17, 20191 votes

I actually had an issue recently where a ">" that I'd manually HTML-encoded so that it would show up as such was being turned into a quoted section as if I'd used the bare character. The resulting post was different from the live preview, which showed a literal ">" character. The only way I could get the literal character to show up properly in the actual post was to escape with a backslash. Is this related to the fix that forces the leading ">" characters in an OP to be parsed as block quote markdown rather than escaped?

I'm gonna go ahead and try it again here.

this has a simple leading ">" which should be the only one of these that shows a block quote

and

this is encoded with gt

and

this is encoded with #62

and

> this is escaped with a backslash

KFCeytronFeb 17, 20191 votes

{quoted}

I actually had an issue recently where a ">" that I'd manually HTML-encoded so that it would show up as such was being turned into a quoted section as if I'd used the bare character. The resulting post was different from the live preview, which showed a literal ">" character. The only way I could get the literal character to show up properly in the actual post was to escape with a backslash. Is this related to the fix that forces the leading ">" characters in an OP to be parsed as block quote markdown rather than escaped?

I'm gonna go ahead and try it again here.

and

and

and

> this is escaped with a backslash

Now that that's confirmed as breaking the old workaround of HTML encoding, I wonder what happens with:

encoded with gt and the ampersand encoded with amp

and

encoded with 62 and the ampersand encoded with 38

and

each character in a gt encoding fully escaped (38, 103, 116, 59)

KFCeytronFeb 17, 20191 votes

{quoted}

Now that that's confirmed as breaking the old workaround of HTML encoding, I wonder what happens with:

and

and

Okay, wow, that's some enthusiastic escaping there. I wonder what happens if I escape the ">" over and over again:

> There's a paragraph worth of "&#nnn;" here, so I wonder if it'll all be collapsed into a single ">" to make a block quote

KFCeytronFeb 17, 20191 votes

{quoted}

Okay, wow, that's some enthusiastic escaping there. I wonder what happens if I escape the ">" over and over again:

There's a paragraph worth of "&#nnn;" here, so I wonder if it'll all be collapsed into a single ">" to make a block quote

Okay, one more level; let's see what happens.

&#62; that's a lot of escaping

EDIT: Looks like it isn't unescaping forever in a loop until the content stops changing, but it's still incredibly aggressive.

ModmichaelchanFeb 17, 20191 votes

Intentional

KFCeytronFeb 17, 20191 votes

{quoted}

Intentional

Land o' Goshen.

When the current team working on Boards applies this kind of fix, are you able to work with the original string that the user typed into the text field, or are you only able to access that content after some other part of the framework ~~mangles~~ processes it?

KFCeytronFeb 21, 20191 votes

{quoted}

Intentional

I just learned that this change also messes with hyperlinking a URL ending in a querystring and following it with an unsafe character (like this). I even HTML-encoded the literal ")" I wanted with ) to no avail.

It's displaying properly and showing the correct URL in the preview, but then I post it and it doesn't show up the same way.

EDIT: I encoded the ampersand for the "...I wanted with )" so it would show an HTML escape code, but it unescaped that too. Escaping is just broken across the board (or Board, ha ha), and basically doesn't work anymore. This makes it a lot harder to write what we want to write. Personally, I don't think it was worth making certain things impossible to do just to avoid having to edit ">" back into an OP, and would suggest reverting this change.

ModWuksFeb 21, 20191 votes

As I understand it, this change will not be reverted due to security reasons.

KFCeytronFeb 21, 20191 votes

{quoted}

As I understand it, this change will not be reverted due to security reasons.

How could HTML escaped characters affect security? We can't even use HTML tags.

Can we escape at all now?

EDIT: The four lines above were escaped multiple times: first line once, second line twice, etc. The preview displayed as Boards used to show, but, on posting, the first three lines didn't appear escaped, while the last appeared escaped. I refreshed a couple more times, and now all the escaping has been removed. Is HTML escaping fully not a thing anymore on Boards? That's gonna make it kinda hard to deal with formatting.