Giters

fortran-lang / webpage

New Fortran webpage

Home Page:https://fortran-lang.org/en

Geek Repo:Geek Repo

Github PK Tool:Github PK Tool

Weblate is closing spurious "HTML" tags

14NGiestas opened this issue · comments

commented

In source texts like this one, weblate seems to be appending a close HTML tags to its translation, e.g. </h1></book-title> because there are pseudo-tags like <h1> in the text.

Steps to reproduce:

  1. Remove </h1></book-title> from the translation
  2. Save it and go back, or use the save and stay option
  3. See that the part you just removed it is still there
commented

@14NGiestas these strings are not spurious as they are from minibooks.md from contributing section, (https://fortran-lang.github.io/webpage/en/community/minibooks/?highlight=book+title) (1.1 Writing your mini-book in markdown section)

Thanks and Regards,
Henil Shalin Panchal

CC @awvwgk

commented

These are not html tags as they are just placeholders for examples in making minibooks.

commented

Thus, I would like to request to please close this issue as it seems resolved.

Thanks and Regards,
Henil Shalin Panchal

commented

Weblate has been intended only for providing the UI for the translations, using automatic translations may cause similar bugs , see also #121 .

Thanks and Regards,
Henil Shalin Panchal

CC @awvwgk

commented

We should review the contributing guidelines carefully. Some information is currently outdated (#120) and most of it is rather brief.

commented

Weblate has been intended only for providing the UI for the translations, using automatic translations may cause similar bugs , see also #121 .

Maybe I wasn't clear, I know they are just placeholders, but it seems Weblate sees it as HTML tags and automatically appends a close tag to it.

I keep removing such close tags, but somehow they keep appearing back, so I believe there is something going on with some Weblate configuration.

commented

I've updated the issue description with some steps to reproduce the behavior.
I guess this explains why the Chinese translator changed <book-title> to, just `book-title` so it avoids that kind of trouble with HTML escaping.

commented

Maybe I wasn't clear, I know they are just placeholders, but it seems Weblate sees it as HTML tags and automatically appends a close tag to it.

I removed the safe-html flag from all strings for the webpage. We shouldn't have any raw HTML showing up for translation anyway, in case they do, I would consider it a bug. The <h1> tag in the minibook guide should be removed, because it is currently incorrect, we explicitly create the first header rather than using frontmatter for this purpose.

commented

I just hope that this don't create another issue, a security one, where someone could inject script tags in the translation in which is called XSS (cross-site scripting) sometimes, this can be used to do all sorts of evil things.

If this isn't the case, then I think it's solved now.

commented

@awvwgk to resolve the XSS issue we should maybe keep restricted access to the translations (like github auth on weblate so that we could be able to find user just incase ) or switch to the manual way used earlier .

As it seems that there is no other method to resolve the XSS bug.

Thanks and Regards,
Henil Shalin Panchal

CC @awvwgk @14NGiestas

commented

I will be updating the minibooks.md and also adding the po files in the upcoming PR by this weekend.

Thanks and Regards,
Henil Shalin Panchal

CC @awvwgk

commented

I think the first thing that we should try is to limit the access, submissions, edits, etc. to Webplate and restrict it to a small number of people. At a later time we could try and sanitise the input to Webplate, but that might be unnecessary for now.