Errors displaying achievements tooltips with quotes in forum posts
Mindhral opened this issue · comments
Describe the bug
Forum posts with achievements links ([ach] tags) provoke javascript warnings and errors in the browser console, and the tooltip doesn't display, when the game title or the achievement title contains single quotes.
To Reproduce
Steps to reproduce the behavior:
- Go to Achievement of the Week 2023 topic for example
- Open the browser console: it's full of warnings and errors
- Hover on a link such as "Masked Jungle Warrior": the tooltip doesn't display and a bunch of other errors appears in the console (because of the quote in the game title (it's "Majora's Mask")
- Hover on a link such as "Warhawk's Rooftop": same result because of the quote in achievement's title
Expected behavior
Tooltips on all achievements, no JS errors.
Screenshots
While hovering over the link:
Example of warning:
Alpine Expression Error: missing ) after argument list
Expression: "tooltipComponent($el, { staticHtmlContent: useCard('achievement', '55510', '', '<div class=\'tooltip-body flex items-start gap-2 p-2\' style=\'max-width: 400px\'><img src=\'https://media.retroachievements.org/Badge/119641.png\' width=\'64\' height=\'64\' /><div><div><b>Witch's Brew</b></div><div class=\'mb-1\'>Obtain a bottle from the Old Hag.</div><div>2 Points</div><div><i>Legend of Zelda, The: Majora's Mask</i></div></div></div>') })"
<span class="inline" x-data="tooltipComponent($el, { …></div></div></div>') })" @mouseover="showTooltip($event)" @mouseleave="hideTooltip" @mousemove="trackMouseMovement($event)">
app-ee02857a.js:1:4982
HTML code of the corresponding element:
<span class='inline' x-data="tooltipComponent($el, { staticHtmlContent: useCard('achievement', '55529', '', '<div class=\'tooltip-body flex items-start gap-2 p-2\' style=\'max-width: 400px\'><img src=\'https://media.retroachievements.org/Badge/119652.png\' width=\'64\' height=\'64\' /><div><div><b>Masked Jungle Warrior</b></div><div class=\'mb-1\'>Obtain Odolwa\'s Remains.</div><div>5 Points</div><div><i>Legend of Zelda, The: Majora's Mask</i></div></div></div>') })"
@mouseover="showTooltip($event)"
@mouseleave="hideTooltip"
@mousemove="trackMouseMovement($event)"><a class='inline-block' href='[https://retroachievements.org/achievement/55529](view-source:https://retroachievements.org/achievement/55529)'><img loading='lazy' decoding='async' width='24' height='24' src='[https://media.retroachievements.org/Badge/119652.png](view-source:https://media.retroachievements.org/Badge/119652.png)' alt='Masked Jungle Warrior' class='badgeimg'> Masked Jungle Warrior (5)</a></span>
Desktop (please complete the following information):
- OS: Windows 10
- Browser Firefox 120.0
Additional context
The description seems to be correctly escaped.
I believe that in
RAWeb/app/Helpers/render/achievement.php
Lines 81 to 101 in b83f054
the blades renders HTML entities for quotes, so that
RAWeb/app/Helpers/render/avatar.php
Lines 51 to 60 in b83f054
doesn't escape them.