blank page on video submit

[cesagonchu]

Tested whith XoopsTube 1.08 RC-2 (07/25/2021)https://github.com/mambax7/xoopstube
and Xoops 2.5.11 latest version.

When I try to submit a video on the user side (/modules/xoopstube/submit.php), I get a blank page like this:

1. xoopstube
2. Submit video Form
   SQL Injection found
   None All Errors (0) Deprecated (0) Queries (22) Blocks (3) Extra (2) Timers(5)
   Errors

---

My config:

Apache/2.4.18 (Ubuntu)
PHP version 7.4.9
MySQLi extension mysqlnd 7.4.9

[cesagonchu]

According to JJDai, it may be because of an accent in the title of the video.
I will test, but if it is the case, we will often have this problem because we French often use accents and the titles of our Youtube videos contain them frequently.

[mambax7]

Can you test it with a title in English, with no accents?

[mambax7]

I tested here, and the submission worked without problems. Maybe you can provide a link to the video that you're submitting that is not posting, and I'll test it here too?

[cesagonchu]

I entered this code: 4n_RABfrg0U
and the title of the video: Extrait du concert The voice 3 de Saint-laurent-du-var : Bruno Moreno interprète On s'attache
https://www.youtube.com/watch?v=4n_RABfrg0U

So yes, if I enter a title without accent it works.

[mambax7]

Hmm, I don't know what to tell you, because I was able to add it on our demo site:
http://demo.xoops.org/modules/xoopstube/singlevideo.php?cid=2&lid=8
XOOPS 2.5.11 Beta-2
PHP Version 7.3.29

[mambax7]

There might be also an issue/conflict related to your French translation or your theme templates. Try testing with xBootstrap or with the Default theme, and if you're using xLanguage, then also switch to English, and see if it made a difference...

[cesagonchu]

It's all in english. When I do my tests I don't install french.

Did you try to submit the video on user side?
I tried on admin side and I was able to submit, but I get a bug when I submit on user side.

[cesagonchu]

I use xswatch4, without modifications.

[mambax7]

I submitted it on the Admin side.
I just tested it on the User side and I've got the same error as you did.
The good news: I was able to replicate it. Bad news: I don't have yet a fix for it, I'll need to do some tests! :)

[cesagonchu]

No worries, at least we're making progress 👍🏻

[mambax7]

My only concern is that it might be caused by the Protector, and this would be more difficult to fix it, because touching Protector is always very risky, and I would have to ask Richard for help. But let's first do some testing...

[montuy337513]

The problem comes from protector, indeed, it detects an SQL injection.
I just quickly looked at the difference in the treatment of the "title" variable between the backoffice and the frontoffice.
The backoffice is still processed with the old method, with an htmspecialchar, on the frontoffice it is a new method.
I think the processing of 'is not done correctly with the new method.
Raw characters must be transformed into HTML characters to avoid injections

[montuy337513]

in module xoopstube ;)

[montuy337513]

' = single quote