Need to strip % from the auto-permalink in the editor.

[Heyneken]

I made an article with "x = 18,98 * y - %10" as title, and this generated ​http://www.example.com/blog/2006/11/03/x-1898-y-%10/ which doesn't work.

[foolswisdom]

Heyneken thank you for reporting this problem! Thank you for participating in WordPress development!

ENV: WP 2.0.5 reproduced problem
Also WP trunk r4449 repro problem

The bug seems to be caused if the percentage symbol followed by two or more digits.

[pishmishy]

Bug still present. A page called %10 which should have something like

http://www.littledog.org.uk/trunk/2008/01/31/%2510/

as a permalink, has the_permalink() returning

/2008/01/14/x-1898-y-%10/

[pishmishy]

Looking at $rewritereplace it appears that $post->post_name is stored as x-1898-y-%10 in the database and not %10.

[pishmishy]

Problem appears to be rooted in sanitize_title()
sanitize_title("%10") == "x-1898-y-%10"

[pishmishy]

Traced to sanitize_title_with_dashes() - this is the code that causes the bug.

    // Preserve escaped octets.
    $title = preg_replace('|%([a-fA-F0-9][a-fA-F0-9])|', '---$1---', $title);
    // Remove percent signs that are not part of an octet.
    $title = str_replace('%', '', $title);
    // Restore octets.
    $title = preg_replace('|---([a-fA-F0-9][a-fA-F0-9])---|', '%$1', $title);

We could remove that code and apply urlencode($post->post_name) in get_permalink's $rewritereplace but the permalinks seems to point to an archive page instead of a post. Any ideas?

[pishmishy]

Better handling of % in post slugs

[pishmishy]

The attached patch handles % in post slugs by urlencoding them rather than manually attempting to encode them as sanitize_title_with_dashes() attempted.

[Denis-de-Bernardy]

still current, and creating a post with such a title will also break the javascript in trunk. It also returns an error when you seek to save the draft.

[hakre]

I am unable to reproduce with default permalink structure (?p=stuff) which is well - actually known I guess. Switching to nicer "Month and name" setting reveals the bug still is in.

It is not possible to modify the permalink with the inplace editor.

It is not possible to fix it manually by adding a percentage sign to the permalik title in the inplace editor.

The cause of the problem is a function called sanitize_title() (called in get_sample_permalink()). Not itself but the filters it calls then:

$title = apply_filters('sanitize_title', $title, $raw_title);

With the current design of wordpress this bug will never be fixed. % is not an allowed char in a slug, it's not filtered out because of some other bug leaving this open for %[0-9]{2,} matches. the slug need propper filtering first.

This is not a javascript related issue firsthand.

The existing patch is misleading IMHO.

My Suggestion: Wontfix.

[hakre]

See #10758 (for some code improvements, docblocks this time)

[ryan]

See #11238

[thee17]

Although I get a weird ? in a black box icon Using a title Test %84 the following worked for me in trunk,

1) Slug was generated.
2) Auto Draft worked.
3) Auto Draft continued to Save.
4) Post published
5) Permalink Worked.

[miqrogroove]

thee17, try %2f and then you will really have problems. ;)

[thee17]

Changing Title for better clarity.

[miqrogroove]

thee17, if you are still testing, could you also check what happens if you manually edit the slug and put a % in it? Because, if the %2f or %25 or whatever can still be injected, then it is not adequate to just strip in the slug generator, it would also be necessary to either strip or encode the manual inputs for any new slug.

[thee17]

From what I am reading is the sanitation for both cases go through the same function.

[SergeyBiryukov]

#23222 was marked as a duplicate.

[SergeyBiryukov]

Related: #25021

[SergeyBiryukov]

#32462 was marked as a duplicate.

[SergeyBiryukov]

#36384 was marked as a duplicate.