HTML entities in title, e.g. the ampersand in THIS forum title

[ryborg]

I was about to check the bug tracker, maybe even submit a ticket, then I noticed this official support forum has the same bug. Does anyone else see the

&

in the title?
From what I can find, this has been an issue since some of the 2.x versions.

[Zachery]

Can you take a screen shot of what you're seeing?

[ryborg]

No need to take a screenshot, Zachery. Just visit http://www.vbulletin.com/forum/forum...sues-questions and view the source. You'’ll see

<title>
        
            
            vBulletin 5 Support Issues &amp;amp; Questions
        
         - vBulletin Community Forum
    </title>

That, by the way, was done with wget to make sure that it was nothing to do with the browser.

So here is a freebie fix as I’m quite happy to get one bug out of the way today:
You’ll need to modify the ‘header' template:
Line 40
Change

            {vb:var page.title}<vb:comment>We have a page, not a channel. We don't allow html in page titles at the moment.</vb:comment>

to

            {vb:raw page.title}
<vb:comment>We have a page, not a channel. We don't allow html in page titles at the moment.</vb:comment>

The line break there is to compensate for the syntax colouring which doesn’t work when comments are in the same line as template variables.

What I don’t get about the comment is that it suggests that HTML is being stripped out of the title. But tracing the code, it is clear that vb:var ultimately filters text through vB’s custom version of htmlspecialchars(), so I’m guessing it is a typo.

The offending line in /forum/core/install/vbulletin-style.xml is 53475.

[ryborg]

Amazing! You haven't fixed this. I fixed it for you, even.

[Zachery]

Did you log a bug?

The problem with using vb:raw is that user unvalidated content can cause bad things to happen, since raw means don't do anything to it.