Skip to content

Wiki page creation doesn't handle & < > \ as one would expect

Summary

When creating a wiki page through the 'new page' modal, the title will be shown correct-ish, but creating a page with & < > \ \ { } & as it's title results in a title which displays as { } &amp; and is &-----/-/-{-}-& as the url identificator.

Steps to reproduce

  1. Click 'New Page' on a wiki you have create rights for,
  2. In the following modal, fill in & < > \ \ { } & as the page's slug/title
  3. Click Create Page. Notice that on the following page the current title shows & < > / / { } &; it has already replaced \ with /.
  4. After filing in some content, click Create Page to save. Notice that now the page title shows as { } &amp;

Expected behavior

The title should be something like & < > { } & (if single escaping should be allowed) or & < > \ \ { } & if not. If invalid characters are stripped from titles, you should get a warning which states as such when you are creating a page with such chars.

Either way, I'd like some feedback if the thing I fill in to the title/slur field is not the same as the title that would be shown on the final page.

Actual behavior

The page gets created, but replaces \with /, removes <>-characters and doubly escapes &-characters. It also (quite possibly incorrectly) assumes that / is a piece of a URL path, and not part of the name. I/MY/ME currently results in a page called ME under path I/MY, which may not be desired behaviour.

(note: only &<>\ were tested (and tested positive on weird results), there may be other strangely behaving characters)

UPDATE 1&2: better issue description and more tests experience included