Unescaped content sent on votes, leading to invalid forms

[mtancoigne]

Steps to reproduce

1. Create a new text based poll
2. Add an entry with double quotes (i.e: Oui et j'ai un "petit" niveau (appels api, état global avec VueX, évènements)
3. Add some entries and save
4. Visit the poll and change the state of the entry with double quotes.
5. Save your answers

Expected behaviour

The entry with changed state should have its new state saved

Actual behaviour

Status of the "double quoted string" did not change

Server configuration

Operating system:
Ubuntu 16.04
Web server:
Apache 2
Database:
Mysql
PHP version:
7
Nextcloud version: (see Nextcloud admin page)
13.0.2
Where did you install Nextcloud from:
I don't remember
Signing status:

No errors have been found.

Additional informations:

Going to "edit" the poll shows an empty list of options and the JS console states:

SyntaxError: JSON.parse: expected ',' or ']' after array element at line 1 column 9 of the JSON data

After manually removing the quotes with a mysql client, everything went fine.

The issue comes from the fact that when a poll is submitted, the raw values are sent to the server, unescaped, and when the server creates JSON for the edit form, the same thing happens...:

Data sent when voting for two options; foo "foo" and bar bar

changed | true
-- | --
dates | ["foo+","bar bar"]  // good strings would have been ["foo+\"foo\"", "bar bar"]
pollId | 4
receiveNotifications | false
types | [1,1]
userId | admin

Possible things to do to correct this:

• Escape the strings before they are sent to server (and from server to edit form)
• better: send ids to server instead of strings...

[dartcafe]

Error in votes.js. Will inspect. Thanks for reporting

[joergmschulz]

Yes sir, something has still to be done in beta2 for 9.0.
Weird things might happen when you include html tags like:

luckily, a tag has been thrown away just like HREF tags.

https://test.elternserver.de/index.php/apps/polls/poll/7ceCzpgSrEuSD59e

[joergmschulz]

browsers behave differently - while Safari and Firefox don't care about the "", Chrome does:

[dartcafe]

Fixed in 0.9-beta5