Error when website- or section-name includes an ampersand (2.x)

[twiro]

Summary:

Saving an entry will throw an XML-error if the section contains an instance of reflection field 2.x and either the website-name or the section-name contain an ampersand.

Detailed description:

I just updated the reflection field of a project from version 1.4.2 to the current version 2.0.4 and noticed that I got the following error whenever I tried to save an entry of a section that included the reflection field:

Did a little research and stumbled upon this discussion in the symphony forum that put me on the right track to hav a look at ampersands in my project.

Actually the website-name itself included an ampersand that seemed to cause the problem – I removed it and everything worked as expected. Later I ran into the same bug again, and noticed that the section-name (not the handle!) of the affected section also included an ampersand. Removed that too and everything worked again.

I also did another test and included an ampersand in a field-label, but that doesn't seem to cause any problems.

Conclusion

I haven't run into ampersand-based bugs in Symphony for a long time and as far as I can judge Symphony itself gets along with ampersands pretty good by now. As everything worked as expected before I updated reflection field to version 2.x this bug must have somehow been introduced with the 2.x-refactoring of the getXPath-function.

This XML in PHP stuff is a little over my head, so I think I won't be able to fox this myself… @nilshoerrmann or @nitriques – any ideas how to fix this?

[nilshoerrmann]

This XML in PHP stuff is a little over my head, so I think I won't be able to fox this myself…

Same here :(

[nitriques]

Top of my head, without any tests, I would try to add some General::sanitize() calls.

here, 2 times: https://github.com/symphonists/reflectionfield/blob/master/extension.driver.php#L157
for both name and value.

here https://github.com/symphonists/reflectionfield/blob/master/extension.driver.php#L171 for the section name

If not, the problem lies in a field's appendFormattedElement() implementation, which is called here https://github.com/symphonists/reflectionfield/blob/master/extension.driver.php#L203

XML and & do not like each other.

See symphonycms/symphonycms#2770 for a drastic fix.

[twiro]

Fixed in the latest release (2.0.5)