Thomas Jakobi
Thomas Jakobi
i could add something into _build (or whereever this should be placed) next week to make a semi automatic check possible.
3.0 would be a good time for doing that.
An initial check is prepared. It has to be checked for 3.x.
These errors are 'just' PHP warnings and can be disabled, when `error_reporting` is not including `E_WARNING`.
Did your php version change during that time? Or something else that changed the `error_reporting`?
The lexicon cache has to be cleared automatically during an update. That should be the issue for the w_configcheck and other not replaced lexicon strings. We should also think about...
@Mark-H If it is only a browser caching (refreshing) issue, this could be solved with cache busting too.
There is one problem in the original issue: Normally the parsing of nested output filters are going from inside out. Since the Wayfinder call is uncached it won't be already...
[3.x] Restrict tag usage and ensure proper escaping of element name, caption, and description fields
Disallowing script tags is not enough. Each element can have several `on` attributes that can execute javascript.
[3.x] Restrict tag usage and ensure proper escaping of element name, caption, and description fields
MODx.util.safeHtml does this and should be quite safe.