TOPIC: Quotes and apostrophes not escaped correctly

Hi. I just launched my second joomla site--first using !joomlacomment.

On v.3.26 I seem to have come across two bugs in the quote escaping.

1. In comment titles, all quotes and apostrophes ( " and ' ) are displayed with a leading backslash: ( \\" and \\') when displayed on the frontpage as a preview (readmore...) AND under "manage comments" in the back-end. ("Test comment's" displays as \\"Test comment\\'s\\")

This leads to bug #2

2. Our site moderators are seeing the backslashes and trying to edit them out in the backend. But in the backend comment editor includes backslashes with apostrophes for both the titles AND the comment body. So after one attempt to edit just the title, we get:

title: \"Test comment\'s\"
body: How\\'s "this"

Some of our moderators have tried to edit the same post title dozens of times without seeing the apostrophe buried in the comment. We have a few posts now that have several backslashes.

title: \"Test comment\'s\"
body: How\\\\\\\\\\\\\\'s "this"

note that these issues do not seem to affect the front-end.

I've added this to the bug tracker.
dev.compojoom.com/issues/show/35
We will fix this with 4.0

That's great. Thanks!

In the short term, is there anything I can do to at least eliminate the backslashes on the previews? The backend I can workaround but the previews show the error right on the main public page.

Hey there! The bug is fixed! dev.compojoom.com/issues/show/35
Go to your admin.comment.html.php file (in administrator/components/com_comment)
look for
change to
change to

and
change to
There you go!
Have fun!

As it seems, there is an error in the javascript for code highlight (here in the forum) so please look for the changes here:
http://dev.compojoom.com/repositories/diff/jocomment/trunk/administrator/components/com_comment/admin.comment.html.php?rev=68

and here
http://dev.compojoom.com/repositories/diff/jocomment/trunk/administrator/components/com_comment/admin.comment.html.php?rev=68

THanks! I'll give it a try...

Hi Daniel

First off, just want to say, you are an absolute genius and are providing brilliant support.

Am loving the Joomlacomment component, but for a few rough edges, which your posts on this forum have almost single-handedly ironed out.

One follow-up to this post though.

I have made the changes you suggest and they have fixed the back-end 'slash' problem.

However, this does not fix the escape slashes in the preview box, whenever there are apostrophes or quotes.

Is there a quick and easy way of integrating this into comment.class.php or something similar with a stripslashes php?

Many thanks, please keep up the great work!

Hi Kian,

Daniel has headed in for the night, but just to clarify for when he gets this message - are you running the latest JoomlaComment 4.0 Beta 1? It may have been addressed already.

Hi Jonus

Thanks for your quick reply!

I am still on the older version - am slightly frightened that upgrading will overwrite all the modifications, templating and tinkerings I've made to get JoomlaComment working almost exactly as intended. Is that a valid concern?

I understand the 4.0 Beta has fixed the problem and I would like to upgrade as soon as I have a stretch of time to implement, but if there is an easy fix to insert stripslashes into the preview box, that would work a treat for now.

Pretty much everything else in the installation is working beautifully right now.

Thanks for your help - as I said, brilliant work on the component and support!

Hey there Kian,
Can you explain what you mean with:

Am loving the Joomlacomment component, but for a few rough edges, which your posts on this forum have almost single-handedly ironed out.

To problem with the slashes in the preview is fixed in beta one. Look here and you will know what to change:
compojoom.com/forum/9-plugins/3842-not-s...m-mmsblog-posts.html

Daniel, you are a legend, that worked a charm!

I definitely do not mean to sound ungrateful in any way as I think Joomlacomment is thoroughly excellent.

The only thing I noticed was that I seem to have spent considerably more time customising the JoomlaComment component than most other ones on the site.

Part of the reason may be that I don't have great experience with Joomla and php or may not have found the right resources.

Anyway, I have outlined some of the changes that have taken the most time for me, which I hope may be useful in future development. I have also mentioned a couple of minor suggestions. Apologies if you have addressed some already in the latest beta and if those should go in the wishlist forum.

- Out of the box I could not find any of the JoomlaComment templates that meshed well with the design of JA_Purity and certain colour schemes. It'd be great if there was one ultra-minimalistic template set which was cleaner by eliminating most of the bells and whistles and colours. Somewhat like the default Wordpress commenting system or something even simpler, which almost appears as text only but has a lot of the underlying power of the Joomlacomment system.
A more logical renaming and/or brief descriptions of what the different templates and styles do would be helpful too - I still don't really understand how to tell emotops, slides and all of those things apart: maybe something that explains what these things mean or what makes one template different from another, without needing to save, preview, etc. Would save newbies around 10 minutes of confusion, i guess.

- I spent some time changing the content of the title to posts in the html files. What I wanted to get was something like this above every post, rather than the default:
240 @09/07/09 @02:17 > by Anonymous
The 240 being the most important part - an option to display a unique sequential number to each comment would be great if it existed out of the box.
It is used to great effect on some sites as it lets anonymous commenters easily address each other (e.g. abovethelaw.com/2009/07/non-sequiturs_07...ow=comments#comments ).
I am now fairly happy with displaying the comment-id but this could become unwieldy if there are Id numbers one day run into thousands. If you have a quick hack for displaying numbers 1 to X for each article (i.e., resetting that counter for each new article to start again from 1), that would be amazing - I am not well versed enough in php to do this myself unfortunately.

- The back-end could automate a few more things perhaps: such as reversing the order of read more and comment with the onAfterDisplayContent::JOSCusereturn
compojoom.com/forum.html?func=view&catid=10&id=205

- I had to mess around a lot with CSS relative positioning of the Previews and number of comments field, which I don't feel is so elegant and bulletproof. Particularly after the above solution, which places the previews after the content but leaves a gaping white space. Editing the article-separator CSS has caused problems with other elements on the site. Would be great if the 'Preview/number of comments' was closer to the "Read more" link by default so you can modify with simple CSS padding or margins.

- A minor AJAX posting bug or incompatibility with another component - ultimately disabled AJAX posting, which solved the problem, but took me ages to figure out that AJAX was the culprit (again, probably my own fault and I realise what I've said without recalling the details is terribly unhelpful)

- Timezone - is it possible to introduce support for half-hour timezones, such as India, which is +4:30 GMT ?

- Tiny thing: would be great if there was a back-end option that enables registered users to the site to still post anonymous comments without logging out (you answered this in another post, I believe, by hacking the code but it took me a long time to find the solution - maybe I'm rubbish with google - in fact, I have just tried searching the forums again for 10 minutes and have not been able to find the answer again, apart from this
compojoom.com/forum.html?func=view&catid=8&id=4495 ).

- Tiny: would be great if the comment email also included a direct link to the back-end to moderate a comment, rather than going through manage comments.

- Would also be great if there was a bit more commenting in the template files or code, or perhaps a brief help text that explains to newbies what the different html / css files are responsible for. Perhaps a couple more stickies in the forums to answer frequently asked modifications?

Anyway, I don't want to sound like a whiner and most of the things on the above list are tiny and it is probably my fault for not posting on the forum sooner and just lurking.

Ultimately, I am really happy with the component and now have it looking and working in almost exactly the way I like it. I just couldn't help feeling that some of those customisations could have been done more easily from the back-end, although I understand that featuring every option in the back-end is also impossible.

Keep up the wonderful work and thanks again for your help on this and other posts.

Hey Kian,
Yep, you are right! Joomalcomment is not very friendly to novice users. I know that and I wish to address this problem in joomlacomment 4.1 . But tell me - how to do it? What should we change, how should we make it better. There are already so much options in the backend - even I forget how they are working sometimes

Do you have any suggestions how to organize the backend?

P.S. and with beta one the modern template looks fine with ja purity.

It most definately is a valid concern. I think that's the main reason why anyone chooses to not upgrade - while it may fix bugs and even intriduce new features, it would also require new configuration, in this case your own modifications and fine tunings.

Not to mention, there were some changes with the template structure in Beta 1 from what I remember. It wasnt too much, but it's enough to force older templates to need a re-edit.

Well you could implement the new text parse engine from 4.0b1 into your copy to try and fix it, but unfortunately that's beyond my scope of expertise - and I think Daniel would be too busy to help with it right now if at all not to mention you would then have a technically unsupposrted release of JoomlaComment... that's just the way it is with new software everywhere though, I think you're going to have to work towards organising a method of implementing the newest version with as little disruption as possible

Hello,

Sorry for taking so long to reply, it's been manic.

I've been doing some thinking, though I've not come up with anything too helpful I'm afraid.

This is perhaps stating the obvious, but here go some thoughts on making the back-end more friendly for novices. It is quite a major project, I think, but could be worth it.

- In general, perhaps it is worth doing a from-the-ground re-write of the backend, structuring it differently and pruning anything the average user won't need.

- From the general category, remove anything that a novice won't need and move to a different section e.g.:
-- Uninstall - move this to an advanced section. There is no need for it to be on the front-page.
-- Mambot content functions - move to an Advanced tab and add some more help text, such as briefly explaining a couple of options to include, such as onAfterDisplayContent::JOSCusereturn or anything else funky you can do with this option.
-- charset could also go to an advanced tab, though I understand it should go closely with language. Perhaps make a completely separate language tab, which includes only these options?
-- Content items by ID (do not use anymore) - this could go into an advanced tab or be deleted if not useful.
-- Technical debug params - again, advanced category.
-- Tiny point: the language used in include/exclude is a bit confusing. Perhaps reword this to "Exclude or Include toggle?", with help text: "This choice will toggle whether the selections you make in the lists below will act to respectively exclude or include comments from selected article IDs, sections or categories."

- Security
This tab is pretty good for the most parts.
-- Maybe delete Notify admin (do not use anymore) and Admin email address, unless required for backwards compatibility?
-- Notify moderator help text: add "is posted?" to the end, just to make it a complete sentence.
-- Move "enable user's notification" to the 'posting' tab?
-- Move "enable RSS feed" to "general" tab?
-- Overflow: add a note to line and word length that if this is set to a safe number to use other than -1 -- it took me a while to realise that URLs were getting truncated and lines had weird breaks in them (I know, stupid mistake, but it happens, I guess).
-- Help text Captcha usertypes: add "will have to pass Captcha text"? I know these are tiny bits, but they probably improve the newbie experience some.
-- Censorship:
--- Rename 'usertypes' to 'Censored usertypes?'
--- the selection of words is a bit too random to be useful out of the box - I've rarely seen nastyb*tch used, for example. While putting in a dictionary of profanities might have other drawbacks, for those who want to actually implement censorship it'd be a lot more usable to just rip off a list from:
www.bannedwordlist.com/ Or perhaps, because you might not want to make the component R-rated, you could just provide a link to that site? Or perhaps, scratch that, I guess anyone could google it.

The posting tab is really good and self-explanatory.
- can you add an option to allow registered users to post anonymously?

Layout:
- the Read on language is quite confusing and I don't quite understand the interaction between the different options (though maybe I'm being a bit thick here). Perhaps a rewording and simpler explanation?
- Templates - This is perhaps the most confusing area, as none of template names are memorable or are easy to select (you have to select the template, apply, reload the page, go back, change the CSS, apply, reload page, etc). What would really really simplify this is a link to a help page or forum post that has an explanation of the different templates and the significance of emotop, default, slideboth, etc - i.e., is it collapsible? Will input box be above or below comments, etc. Small screenshots of all the different default template options would also be helpful. That way a newbie can just pick one that looks ok and modify it.
Same goes for the CSS names - some are not very descriptive, such as age, redevoscrap, css, etc.
- in layout, include an explanation of the onAfterDisplayContent::JOSCusereturn fix or just have a checkbox that will reverse the order of read more and the comments box/previews?
- a selection box to disable things such as search or other fancy functions that might not be necessary for those who want a simpler, bare-bone commenting implementation?


Anyway, those are some of the tiny things I spotted, nothing is major, but I hope they are perhaps useful.

For the record, playing with Joomlacomment was perhaps the most useful learning experience to get better with PHP and joomla components. I now feel quite comfortable and am very happy with Joomlacomment, as it works pretty much as I need it to right now.

I will try to upgrade to the new version and integrate with current modifications soon, it looks good.

Thanks again for making such a great component!

JonusC loves long and detailed posts of feedback/suggestions

Kian wrote:

This is perhaps stating the obvious, but here go some thoughts on making the back-end more friendly for novices. It is quite a major project, I think, but could be worth it. In general, perhaps it is worth doing a from-the-ground re-write of the backend, structuring it differently and pruning anything the average user won't need.

Already planned. Daniel has to completely redesign the class files though and the way the database is used, it probably won't be until that is done (or at least at the same time) which would be JoomlaComment 4.1 at the very earliest.

- From the general category, remove anything that a novice won't need and move to a different section e.g.:
-- Uninstall - move this to an advanced section. There is no need for it to be on the front-page.
-- Mambot content functions - move to an Advanced tab and add some more help text, such as briefly explaining a couple of options to include, such as onAfterDisplayContent::JOSCusereturn or anything else funky you can do with this option.

All very valid points, it's too soon to talk about specifics though. I plan to personally add a great deal of documentation to the backend too.

-- charset could also go to an advanced tab, though I understand it should go closely with language. Perhaps make a completely separate language tab, which includes only these options?

A 'Language' tab is a good idea. It could also be the new tab where a user can edit custom E-Mail forms for the Notifications (something i've been working on).

-- Tiny point: the language used in include/exclude is a bit confusing. Perhaps reword this to "Exclude or Include toggle?", with help text: "This choice will toggle whether the selections you make in the lists below will act to respectively exclude or include comments from selected article IDs, sections or categories."

Yeah I agree, the Include/Exclude system in general kinda sucks I'd like to re-do it but it'd be hard to implement and my ideas for a new layout on that are nil.

-- Maybe delete Notify admin (do not use anymore) and Admin email address, unless required for backwards compatibility?

Do not use anymore? What do you mean? We use this option to let the user decide if they want to be emailed of every new comment. On a fresh, small site, thats very important to have it turned ON so you can follow up any comment ASAP to help your site get a good reputation. But on a larger site that you work fulltime on that gets hundreds of comments a day, the user might want to turn email notifications off as there will be HEAPS and they are working 24/7 fulltime on their site

-- Notify moderator help text: add "is posted?" to the end, just to make it a complete sentence.
-- Move "enable user's notification" to the 'posting' tab?
-- Move "enable RSS feed" to "general" tab?

Yeah, tedious stuff but good points.

-- Overflow: add a note to line and word length that if this is set to a safe number to use other than -1 -- it took me a while to realise that URLs were getting truncated and lines had weird breaks in them (I know, stupid mistake, but it happens, I guess).

Huh? You've lost me there! I think the default is 500 or something because -1 can break the template (not sure there, can't remember)

-- Help text Captcha usertypes: add "will have to pass Captcha text"? I know these are tiny bits, but they probably improve the newbie experience some.

Yeah, probably something even more verbose like "Specify which usergroups are required to pass Captcha security checks (Captcha security will be hidden for the unselected groups)".

--- the selection of words is a bit too random to be useful out of the box - I've rarely seen nastyb*tch used, for example. While putting in a dictionary of profanities might have other drawbacks, for those who want to actually implement censorship it'd be a lot more usable to just rip off a list from:
www.bannedwordlist.com/ Or perhaps, because you might not want to make the component R-rated, you could just provide a link to that site? Or perhaps, scratch that, I guess anyone could google it.

Yeah I know, they are just there as an example I would like to include a better "default" but I had the same thoughts as you, we dont want an R-Rated component! Even though a webmaster who's configuring JoomlaComment must be fully prepaired for foul language in my opinion... We will probably have a section here on Compojoom very soon for curse word lists, and anyone can contribute to the list, then people can copy/paste the massive shit=sh*t etcetera entries themselves and edit as they wish

- can you add an option to allow registered users to post anonymously?

Already implemented. It's at the "Log out of your account and post as a Guest" option Haha nah seriously though... that's a bit of a useless option because they could just logout! You might now be thinking "What if it's at a non-public section of the site...?" Well then Guest comments are disabled, by design!

I think I know what you mean actually. Like a checkbox for "Stealth Mode" just to hide details on a particular comment.. that could lead to some abuse or dishonest activity though. Hmm... No, I don't see the point of the option. Feel free to give an example of why it'd be useful though!

Layout:
- the Read on language is quite confusing and I don't quite understand the interaction between the different options (though maybe I'm being a bit thick here). Perhaps a rewording and simpler explanation?

Don't worry it confuses the hell outa me too, I had to ranomly experiment with these to figure out what they do and how they work

- Templates - This is perhaps the most confusing area, as none of template names are memorable or are easy to select (you have to select the template, apply, reload the page, go back, change the CSS, apply, reload page, etc). What would really really simplify this is a link to a help page or forum post that has an explanation of the different templates and the significance of emotop, default, slideboth, etc - i.e., is it collapsible? Will input box be above or below comments, etc. Small screenshots of all the different default template options would also be helpful. That way a newbie can just pick one that looks ok and modify it. Same goes for the CSS names - some are not very descriptive, such as age, redevoscrap, css, etc.

The templates need to be reworked/redesigned, some might even be dropped before 4.0 final. I'm also trying to convince Daniel to install SOBI2 or a Wiki system or a Knowledge Base extension on the CompoJoom website so I can write some documentation, FAQ's and guides

- in layout, include an explanation of the onAfterDisplayContent::JOSCusereturn fix or just have a checkbox that will reverse the order of read more and the comments box/previews?

Agreed. I think it'd be good enough to update the description of this option with other possible choices to enter, explaining why they could be used. Leaving it as text is ideal though so we can allow a custom render method if the user chooses so.

- a selection box to disable things such as search or other fancy functions that might not be necessary for those who want a simpler, bare-bone commenting implementation?

There already is a radio selection to enable or disable Search and also RSS... what else could we choose to enable/disable?

Anyway, those are some of the tiny things I spotted, nothing is major, but I hope they are perhaps useful.

Very usefull I enjoy this kind of feedback and will make a note of the thread here.

For the record, playing with Joomlacomment was perhaps the most useful learning experience to get better with PHP and joomla components. I now feel quite comfortable and am very happy with Joomlacomment, as it works pretty much as I need it to right now.

Me too. I didn't know anything about Joomla or PHP about 2-3 months ago, but I was keen to join in, learn, and help out... and here we are

Yes, try to upgrade to Beta 2 when it's out (soon!) as many many bugs are fixed!

Hi Jonus,

Thanks for your detailed response, I'm glad some of the suggestions may be helpful (even if nitpicky).

And sorry for the slow reply but didn't have the time to consider properly. Anyway, just wanted to give a brief update.

I've installed beta 2 and it was a cakewalk. It'll even work right out of the box without breaking any old customised templates, which I was amazed by (although you might lose some of the new functionality if using the old template I guess).

Adjusted the template from scratch anyway and copied all previous modifications across, so now working just as intended and then some. (I noticed it also really helps that I am getting towards being an intermediate joomla/joomlacomment user so I am facing less problems with customisation, etc.).

Anyway, I'm really happy with beta2, it's a lot slicker and more intuitive in many ways, great job guys!

-- Maybe delete Notify admin (do not use anymore) and Admin email address, unless required for backwards compatibility?

This has been fixed in the latest version I think - the text used to imply not to use that 'notify admin' functionality anymore but to use 'notify moderators'.

Like the idea of a swearword forum, sounds like fun!

I think I know what you mean actually. Like a checkbox for "Stealth Mode" just to hide details on a particular comment.. that could lead to some abuse or dishonest activity though. Hmm... No, I don't see the point of the option. Feel free to give an example of why it'd be useful though!

Maybe you're right - have recently gone back to not allowing anonymous commenting when logged in. Will hopefully raise the tone of conversation in the comments too, rather than a completely anonymous free-for-all.

--The new modern template is nice, I like. Though personally I still prefer an even cleaner more pared down version without as many boxes and more whitespace, but that's fairly easy to do in CSS I guess.

--I noticed in another forum that you are working on updating the voting function to enable a total aggregate score and burying of bad comments. Good idea, I think that's the main thing that joomlacomment could really do with that would make it pretty much perfect.

--There was one tiny thing which had been stumping me for ages but I don't know if you can replicate it. I enabled AJAX, after it had been off/broken for a while and enabled voting, but for ages users could just vote on their own posts rather than anyone else's. What fixed it was to briefly turn on the 'allow only registered' users to comment function, then turn it back on again. Just a strange minor glitch, perhaps it had to do with my installation/config, but thought I'd let you know and put it in the forum so someone can find it on google one day if they happen to have the same problem.

Will keep you posted if anything else comes to mind, even if some are red herrings (thanks for pointing them out in my previous post).

Cheers,
Kian

ps: There was one tiny thing I noticed in the beta2 - I don't know if it's a bug or something I've done wrong. The component seems to be slightly too keen to addline breaks inside the comments. It appears to add two "br"s for every newline that a user inputs. Now some of the comments are full of whitespace, whenever a user likes having one blank line between paragraphs, four BRs magically appear. Dunno if you've come across this before.

change max line width to -1 in the backend and the white spaces should go away.

Daniel Dimitrov wrote:

change max line width to -1 in the backend and the white spaces should go away.

Yep that's it. Would you consider adding this to the FAQ Daniel? You remember my post here - I updated it to a more definate answer compojoom.com/forum/6-bug-report/5947-te...rease-size.html#6026

Thanks for the great feedback Kian. The voting system is something i hope to work on, although Daniel and I havn't come to an agreement yet as to whether to allow "dual mode" for a template to use traditional voting or combined-number voting depending on template tag used (messy code), or to replace the old dual-number with the completely-new combined number score (will require old templates be re-written).

Also, we're considering on making the vote not only restrict on a username basis, but also check the IP to further prevent duplicate votes - but this only applys to the case where anonymous users can vote.

Thanks Daniel, thanks Jonus, works a treat.

On the voting, I think that's a great idea.

My personal preference would be to ditch the separate numbers completely in favour of a combined +ve or -ve number of some sort, but others may have different views about it.

Digg's commenting implementation works quite well and is similar to joomlacomment already. If you could add 'registered only' toggle and a 'combined number' toggle, that would be great, though you are right, it would make things a little messy in the templates.

A quick and dirtier fix might be to have both at the same time, which may not require a template rewrite at all (though I'm not sure about that). I.e., if you change the <voting> </voting> block in the php, could it be possible to just display the aggregate of + or - votes before the individual votes?

So you would end up with front-end reading: <normal etc font>+10</font> [red thumbsdown logo] 5 [red thumbsup] 15

Dunno, just thinking out loud...