Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Asset URLs (./?a=1234), Matrix comments (<!--@@) and keywords (%whatever%) don't resolve in Edit+ code #54

Closed
davidjb opened this issue Feb 7, 2017 · 2 comments

Comments

@davidjb
Copy link
Contributor

davidjb commented Feb 7, 2017

Similar to #3, asset URLs like ./?a=1234 don't resolve in Edit+ parse in Designs — presumably because the implicit exit() is causing PHP to abort before reaching that point. The unprocessed asset URLs work to load that specific asset, but if that asset is a JS or CSS file (etc) that in turn uses relative URLs to include other content, those relative URLs will now be incorrect.

The same applies to Matrix comments and keywords -- they get left exactly as they are and don't get stripped out or processed as they should have. This results in either data leakage or things simply not working if %globals_asset_*% is still present in URLs etc.

Example:

  <link rel="stylesheet" href="./?a=12345:dist/styles.min.css">

The workaround for keyword resolution is to nest content via a Design area, because keywords aren't working (and Git file bridge assets can't be referred to via keywords), the only solution is to hard-code the full URL. The workaround for Matrix comments is to avoid their use entirely.

@davidjb davidjb changed the title Asset URLs (./?a=1234) don't resolve in Edit+ code Asset URLs (./?a=1234) and Matrix comments (<!--@@) don't resolve in Edit+ code Feb 7, 2017
@davidjb davidjb changed the title Asset URLs (./?a=1234) and Matrix comments (<!--@@) don't resolve in Edit+ code Asset URLs (./?a=1234), Matrix comments (<!--@@) and keywords (%whatever%) don't resolve in Edit+ code Feb 7, 2017
@davidjb
Copy link
Contributor Author

davidjb commented Feb 7, 2017

Reported at https://squizmap.squiz.net/matrix/10540.

@davidjb
Copy link
Contributor Author

davidjb commented Aug 23, 2017

(un-)Helpfully closed with no further discussion by the vendor:

Just revieiwng this again, and this is expected behaviour. None of these:
./?a=
%global_asset_X%
(Makes sense because /_edit is still the "backend")
Will get evaluated in the parse file when viewing an asset in /_edit.
Will put a comment on hte manuals to make that clear.

So in short, hard code URLs and don't trust things will work where you think they might.

@davidjb davidjb closed this as completed Aug 23, 2017
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Projects
None yet
Development

No branches or pull requests

1 participant