| Description | The function csv_escape_string in csv_api.php only escapes strings which contain a column separator. But it should also escape the " character and the line termination characters.
Here is the modified function:
# --------------------
# escape a string before writing it to csv file.
function csv_escape_string( $p_str ) {
$t_escaped = str_split( '"' . csv_get_separator() . csv_get_newline() );
$t_must_escape = false;
while( ( $t_char = current( $t_escaped ) ) !== false && !$t_must_escape ) {
$t_must_escape = strpos( $p_str, $t_char ) !== false;
next( $t_escaped );
}
if ( $t_must_escape ) {
$p_str = '"' . str_replace( '"', '""', $p_str ) . '"';
}
return $p_str;
}
I also join a diff file made against csv_api.php of Mantis version 1.1.1 |
|---|
| Attached Files |
csv_api.patch (378 bytes)
56c56,62
< if ( strpos( $p_str, csv_get_separator() ) !== false ) {
---
> $t_escaped = str_split( '"' . csv_get_separator() . csv_get_newline() );
> $t_must_escape = false;
> while( ( $t_char = current( $t_escaped ) ) !== false && !$t_must_escape ) {
> $t_must_escape = strpos( $p_str, $t_char ) !== false;
> next( $t_escaped );
> }
> if ( $t_must_escape ) {
issue9338-1.1.x.patch (1,069 bytes)
From 1f5c4f62c850b6edd2a72b54e21a923d372bb336 Mon Sep 17 00:00:00 2001
From: =?utf-8?q?St=82phane=20Veyret?= <sveyret@axway.com>
Date: Wed, 1 Jul 2009 14:36:05 +0200
Subject: [PATCH] Fix 0009338: CSV export does not escape all characters
Adding escaping of newline in the CVS export
---
core/csv_api.php | 8 +++++++-
1 files changed, 7 insertions(+), 1 deletions(-)
diff --git a/core/csv_api.php b/core/csv_api.php
index fa429b0..1777b01 100644
--- a/core/csv_api.php
+++ b/core/csv_api.php
@@ -53,7 +53,13 @@
# --------------------
# escape a string before writing it to csv file.
function csv_escape_string( $p_str ) {
- if ( strpos( $p_str, csv_get_separator() ) !== false ) {
+ $t_escaped = str_split( '"' . csv_get_separator() . csv_get_newline() );
+ $t_must_escape = false;
+ while( ( $t_char = current( $t_escaped ) ) !== false && !$t_must_escape ) {
+ $t_must_escape = strpos( $p_str, $t_char ) !== false;
+ next( $t_escaped );
+ }
+ if ( $t_must_escape ) {
$p_str = '"' . str_replace( '"', '""', $p_str ) . '"';
}
--
1.6.3.2
issue9338-master.patch (1,408 bytes)
From a575fe210f0c4d53478f21cd078f00d97943a890 Mon Sep 17 00:00:00 2001
From: =?utf-8?q?St=82phane=20Veyret?= <sveyret@axway.com>
Date: Wed, 1 Jul 2009 14:43:24 +0200
Subject: [PATCH] Fix 0009338: CSV export does not escape all characters
Changing escaping method (strings could be escaped twice)
---
core/csv_api.php | 21 ++++++++++-----------
1 files changed, 10 insertions(+), 11 deletions(-)
diff --git a/core/csv_api.php b/core/csv_api.php
index 76885ed..d22ecab 100644
--- a/core/csv_api.php
+++ b/core/csv_api.php
@@ -72,18 +72,17 @@ function csv_get_default_filename() {
* @access public
*/
function csv_escape_string( $p_str ) {
-
- # enclose strings with separators with quotaiton marks
- if( strpos( $p_str, csv_get_separator() ) !== false ) {
- $p_str = '"' . str_replace( '"', '""', $p_str ) . '"';
- }
-
- # enclose multi-line strings with quotaiton marks
- if( strpos( $p_str, "\n" ) !== false ) {
- $p_str = '"' . str_replace( '"', '""', $p_str ) . '"';
- }
-
- return $p_str;
+ $t_escaped = str_split( '"' . csv_get_separator() . csv_get_newline() );
+ $t_must_escape = false;
+ while( ( $t_char = current( $t_escaped ) ) !== false && !$t_must_escape ) {
+ $t_must_escape = strpos( $p_str, $t_char ) !== false;
+ next( $t_escaped );
+ }
+ if ( $t_must_escape ) {
+ $p_str = '"' . str_replace( '"', '""', $p_str ) . '"';
+ }
+
+ return $p_str;
}
/**
--
1.6.3.2
|
|---|
