{"action":"created","issue":{"url":"https://api.github.com/repos/xpressengine/xe-core/issues/2301","repository_url":"https://api.github.com/repos/xpressengine/xe-core","labels_url":"https://api.github.com/repos/xpressengine/xe-core/issues/2301/labels{/name}","comments_url":"https://api.github.com/repos/xpressengine/xe-core/issues/2301/comments","events_url":"https://api.github.com/repos/xpressengine/xe-core/issues/2301/events","html_url":"https://github.com/xpressengine/xe-core/issues/2301","id":361121580,"node_id":"MDU6SXNzdWUzNjExMjE1ODA=","number":2301,"title":"템플릿 보안 향상을 위한 auto-escape 적용 범위 확대","user":{"login":"bnu","id":53764,"node_id":"MDQ6VXNlcjUzNzY0","avatar_url":"https://avatars1.githubusercontent.com/u/53764?v=4","gravatar_id":"","url":"https://api.github.com/users/bnu","html_url":"https://github.com/bnu","followers_url":"https://api.github.com/users/bnu/followers","following_url":"https://api.github.com/users/bnu/following{/other_user}","gists_url":"https://api.github.com/users/bnu/gists{/gist_id}","starred_url":"https://api.github.com/users/bnu/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/bnu/subscriptions","organizations_url":"https://api.github.com/users/bnu/orgs","repos_url":"https://api.github.com/users/bnu/repos","events_url":"https://api.github.com/users/bnu/events{/privacy}","received_events_url":"https://api.github.com/users/bnu/received_events","type":"User","site_admin":false},"labels":[{"id":159696359,"node_id":"MDU6TGFiZWwxNTk2OTYzNTk=","url":"https://api.github.com/repos/xpressengine/xe-core/labels/type/SECURITY","name":"type/SECURITY","color":"e11d21","default":false},{"id":26925725,"node_id":"MDU6TGFiZWwyNjkyNTcyNQ==","url":"https://api.github.com/repos/xpressengine/xe-core/labels/type/enhancement","name":"type/enhancement","color":"207de5","default":false}],"state":"open","locked":false,"assignee":{"login":"bnu","id":53764,"node_id":"MDQ6VXNlcjUzNzY0","avatar_url":"https://avatars1.githubusercontent.com/u/53764?v=4","gravatar_id":"","url":"https://api.github.com/users/bnu","html_url":"https://github.com/bnu","followers_url":"https://api.github.com/users/bnu/followers","following_url":"https://api.github.com/users/bnu/following{/other_user}","gists_url":"https://api.github.com/users/bnu/gists{/gist_id}","starred_url":"https://api.github.com/users/bnu/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/bnu/subscriptions","organizations_url":"https://api.github.com/users/bnu/orgs","repos_url":"https://api.github.com/users/bnu/repos","events_url":"https://api.github.com/users/bnu/events{/privacy}","received_events_url":"https://api.github.com/users/bnu/received_events","type":"User","site_admin":false},"assignees":[{"login":"bnu","id":53764,"node_id":"MDQ6VXNlcjUzNzY0","avatar_url":"https://avatars1.githubusercontent.com/u/53764?v=4","gravatar_id":"","url":"https://api.github.com/users/bnu","html_url":"https://github.com/bnu","followers_url":"https://api.github.com/users/bnu/followers","following_url":"https://api.github.com/users/bnu/following{/other_user}","gists_url":"https://api.github.com/users/bnu/gists{/gist_id}","starred_url":"https://api.github.com/users/bnu/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/bnu/subscriptions","organizations_url":"https://api.github.com/users/bnu/orgs","repos_url":"https://api.github.com/users/bnu/repos","events_url":"https://api.github.com/users/bnu/events{/privacy}","received_events_url":"https://api.github.com/users/bnu/received_events","type":"User","site_admin":false}],"milestone":{"url":"https://api.github.com/repos/xpressengine/xe-core/milestones/74","html_url":"https://github.com/xpressengine/xe-core/milestone/74","labels_url":"https://api.github.com/repos/xpressengine/xe-core/milestones/74/labels","id":3498685,"node_id":"MDk6TWlsZXN0b25lMzQ5ODY4NQ==","number":74,"title":"1.11.0","description":"","creator":{"login":"bnu","id":53764,"node_id":"MDQ6VXNlcjUzNzY0","avatar_url":"https://avatars1.githubusercontent.com/u/53764?v=4","gravatar_id":"","url":"https://api.github.com/users/bnu","html_url":"https://github.com/bnu","followers_url":"https://api.github.com/users/bnu/followers","following_url":"https://api.github.com/users/bnu/following{/other_user}","gists_url":"https://api.github.com/users/bnu/gists{/gist_id}","starred_url":"https://api.github.com/users/bnu/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/bnu/subscriptions","organizations_url":"https://api.github.com/users/bnu/orgs","repos_url":"https://api.github.com/users/bnu/repos","events_url":"https://api.github.com/users/bnu/events{/privacy}","received_events_url":"https://api.github.com/users/bnu/received_events","type":"User","site_admin":false},"open_issues":5,"closed_issues":15,"state":"open","created_at":"2018-07-16T07:35:27Z","updated_at":"2018-09-21T06:19:18Z","due_on":"2018-10-02T07:00:00Z","closed_at":null},"comments":14,"created_at":"2018-09-18T03:26:37Z","updated_at":"2018-09-25T15:40:40Z","closed_at":null,"author_association":"MEMBER","body":"#2300 이슈에 더해 추가 개선을 적용합니다.\r\n- XE1에 내장된 관리페이지 등에 표시되는 모든 템플릿에 'autoescape' 모드 적용\r\n  - 배포본에 포함된 모든 템플릿 파일\r\n  - 이 템플릿 파일은 3rd-party 자료 및 서비스 페이지에서도 사용될 수 있음\r\n    - 예) 확장변수 입력 폼 등\r\n- 'auto' 혹은 'autoescape' 모드일 때에도 특정 데이터 출력시에는 'noescape' 적용\r\n  - 명시적으로 변경 가능\r\n  - `$content`, `$page_content`\r\n  - getUrl() 및 유사 함수\r\n  - getContent(), getEditor(), getFormHTML(), Context::getHtmlHeader() 등 HTML 출력이 필수적인 알려진 함수\r\n\r\n\r\n---\r\n\r\n이 이슈에 변경사항으로인한 영향입니다.\r\n추가 내용에 대해서는 [XE 1.11.0 버전의 중요 변경사항 안내](https://www.xpressengine.com/devlog/23277227)에서 확인해주시기 바랍니다.\r\n\r\n## 필터(모드) 설명\r\n- escape\r\n  - 출력되는 결과물에 htmlspecialchars()가 적용되며, double_encode 옵션은 `true`입니다\r\n- autoescape\r\n  - 출력되는 결과물에 htmlspecialchars()가 적용되며, double_encode 옵션은 `false`입니다\r\n- noescape\r\n  - 별도 처리하지 않고 그대로 출력합니다\r\n\r\n## 공통\r\n내장 모듈의 template 파일에 대한 'autoescape' 기본 활성화\r\n(해당 템플릿의 모든 변수는 자동으로 htmlspecialchars가 적용되어 출력됨을 의미합니다.)\r\n\r\nXE1 배포본에 포함된 템플릿 파일은 항상 'autoescape' 필터가 적용됩니다\r\n\r\n## 1.9이하의 사이트에서 업데이트 시\r\n위 '공통' 부분의 적용 사항과 동일합니다.\r\n\r\n## 처음 설치 시 기본 값\r\n모든 템플릿에 'autoescape' 적용됩니다.\r\n\r\n위 공통 사항과 더불어 3rd-party 자료를 포함하여 모든 템플릿에 적용되며, 모든 값의 출력물이 htmlspecialchars() 함수가 적용됨을 의미합니다.\r\n\r\n출력되는 데이터에 따라 HTML 코드가 텍스트로 그대로 노출될 수 있습니다.\r\n- 레이아웃 템플릿, 스킨(모듈, 위젯 등 포함) 템플릿 등에서 출력하는 값과\r\n- XE 관리페이지에서 제공하는 메뉴 설명란에 HTML 을 사용한 경우 등\r\n- 레이아웃이나 모듈, 애드온, 위젯, 스킨 설정에서 제공하는 설명 또는 HTML 입력란의 값\r\n등이 영향을 받습니다."},"comment":{"url":"https://api.github.com/repos/xpressengine/xe-core/issues/comments/424394812","html_url":"https://github.com/xpressengine/xe-core/issues/2301#issuecomment-424394812","issue_url":"https://api.github.com/repos/xpressengine/xe-core/issues/2301","id":424394812,"node_id":"MDEyOklzc3VlQ29tbWVudDQyNDM5NDgxMg==","user":{"login":"howtoxe","id":16565958,"node_id":"MDQ6VXNlcjE2NTY1OTU4","avatar_url":"https://avatars3.githubusercontent.com/u/16565958?v=4","gravatar_id":"","url":"https://api.github.com/users/howtoxe","html_url":"https://github.com/howtoxe","followers_url":"https://api.github.com/users/howtoxe/followers","following_url":"https://api.github.com/users/howtoxe/following{/other_user}","gists_url":"https://api.github.com/users/howtoxe/gists{/gist_id}","starred_url":"https://api.github.com/users/howtoxe/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/howtoxe/subscriptions","organizations_url":"https://api.github.com/users/howtoxe/orgs","repos_url":"https://api.github.com/users/howtoxe/repos","events_url":"https://api.github.com/users/howtoxe/events{/privacy}","received_events_url":"https://api.github.com/users/howtoxe/received_events","type":"User","site_admin":false},"created_at":"2018-09-25T15:40:40Z","updated_at":"2018-09-25T15:40:40Z","author_association":"CONTRIBUTOR","body":"여러분들이 우려하시는대로 서드파티 대부분이 못쓰게 되고 파편화가 일어나는 상황이 될 것 같습니다. \r\n\r\n그리고 ignoreEscape 패턴에 등록이 되어있는데 왜 $content를 또 noescape하는지 잘 모르겠습니다. 예제에도 굳이 $content를 예시로 드셨던데 이유가 있는건가요?\r\n\r\n한동안 XE 관련 개발을 안하고 있지만 이 정도의 사안이면 미리 공론화가 되었더라면 더 좋지 않았을까 하는 아쉬움이 남습니다.\r\n\r\nps. 졸린 눈으로 코드를 잘못 읽고 달았다가 삭제하고 다시 썼습니다ㅋ;;"}}
{"actor":{"display_login":"howtoxe"}}