EllisLab text mark
Advanced Search
1 of 2
1
   
Critical Textile Plugin Update
Posted: 10 July 2008 02:14 PM
Avatar
Joined: 2002-06-03
6547 posts

The Textile plugin has been updated today as it was discovered that Textile was undoing some protection ExpressionEngine makes to submitted data to prevent variable parsing in user-submitted content.  In certain circumstances this could result in PHP errors and broken content.  If you are using the Textile plugin, this is considered a critical and mandatory update.  Simply replace your existing Textile plugin with the version 1.1 (2.0.0 r2779).

Entry permalink

 Signature 
 
Posted: 10 July 2008 07:07 PM   [ # 1 ]   [ Rating: 0 ]
Avatar
Joined: 2006-01-18
230 posts

I upgraded, but now, when I see a preview of the post in the control panel after publishing or updating, I see

</p

at the end of each paragraph. The code that gets outputted on the site is still good; just the preview is affected. I’m using 1.6.3.

Image Attachments
textile.jpg
 Signature 

Eric Barstad
Shadow Box Creative Media Ltd.

EE Pro Network

 
Posted: 10 July 2008 07:14 PM   [ # 2 ]   [ Rating: 0 ]
Avatar
Joined: 2002-06-03
6547 posts

Try a fresh download, Eric, should fix that.

 Signature 
 
Posted: 10 July 2008 07:19 PM   [ # 3 ]   [ Rating: 0 ]
Avatar
Joined: 2006-01-18
230 posts

Awesome, thanks!

 Signature 

Eric Barstad
Shadow Box Creative Media Ltd.

EE Pro Network

 
Posted: 10 July 2008 09:47 PM   [ # 4 ]   [ Rating: 0 ]
Joined: 2002-10-18
98 posts

I was a little confused by what looks like a retrograde version number. The version for the Textile plugin I had installed was 2.0 (2.0.0 r2779), and yours is version 1.1 (2.0.0 r2779). The difference is only one line and is clearly your security fix. Did you mean 2.1? Or maybe I got 2.0 from some other place (I can’t remember whether I downloaded from the official plugin list)??

 
Posted: 10 July 2008 11:13 PM   [ # 5 ]   [ Rating: 0 ]
Avatar
Joined: 2002-06-03
6547 posts

The version number used to be just 2.0.0 r2779 which was taken entirely from the version of Textile, not the plugin version, as we do not create or maintain that codebase.  This is the first time that the plugin’s code, which is just a gateway to Textile, has been significantly changed, so I decided to be more explicit in the versioning.  The plugin version is the first listed, and the parenthetic version is the version of Textile, i.e. EE Textile Plugin version 1.1, using Textile’s 2.0.0 r2779 codebase.

 Signature 
 
Posted: 11 July 2008 09:33 AM   [ # 6 ]   [ Rating: 0 ]
Avatar
Joined: 2006-03-17
168 posts

Derek, I have a small request. Can we get a “Last Modified” date and time on the plugins, extensions, modules, and expansions? Seeing when it was first posted is great but “Date: Mar 09, 2004” makes it seem like it was the last time the plugin was updated. Just a suggestion. Thanks for the update.

 
Posted: 11 July 2008 01:34 PM   [ # 7 ]   [ Rating: 0 ]
Avatar
Joined: 2002-06-03
6547 posts

ignite, you’re making it too difficult for me!  (added)

 Signature 
 
Posted: 11 July 2008 01:39 PM   [ # 8 ]   [ Rating: 0 ]
Avatar
Joined: 2006-03-17
168 posts

Wow, that was fast! Looks good! I like the “Published” label too. Thanks.

 
Posted: 11 July 2008 02:12 PM   [ # 9 ]   [ Rating: 0 ]
Joined: 2006-03-26
1664 posts

For the record I love the “Last Updated” addition. Thanks for this.

 
Posted: 12 July 2008 05:12 PM   [ # 10 ]   [ Rating: 0 ]
Joined: 2007-06-06
187 posts

Upgrading stopped other plugins from working. The read file plugin and image rotator tags now show as plain text. Help!

{exp:read_file}

 
Posted: 12 July 2008 05:15 PM   [ # 11 ]   [ Rating: 0 ]
Avatar
Joined: 2002-06-03
6547 posts

Share your code, please, Turkish?

 Signature 
 
Posted: 12 July 2008 05:51 PM   [ # 12 ]   [ Rating: 0 ]
Joined: 2007-06-06
187 posts

Example…

=={exp:read_file file="/home/path/file.txt" html="yes"}== 

The equals signs are to stop textile converting the quotes. Basically tell Textile it’s RAW HTML.

 
Posted: 12 July 2008 06:21 PM   [ # 13 ]   [ Rating: 0 ]
Avatar
Joined: 2002-06-03
6547 posts

Yes, but where are you putting this?  In an entry?  A template?  Is it inside a Textile plugin tag?  What’s the full context, Turkish Baker?

 Signature 
 
Posted: 12 July 2008 07:44 PM   [ # 14 ]   [ Rating: 0 ]
Joined: 2007-06-06
187 posts

A weblog entry field with the formatting type set to Textile.

 
Posted: 12 July 2008 08:40 PM   [ # 15 ]   [ Rating: 0 ]
Avatar
Joined: 2002-06-03
6547 posts

That’s what I suspected, but I did not want to make assumptions.  That’s precisely the type of thing this fix is intended to disallow.  EE tags are not parsed in entry content.  There is a plugin you could use in your template “Allow EE Code” which will bypass this restriction if your site has only trusted authors publishing content.

 Signature 
 
1 of 2
1