Malformed activity feed with paths containing ampersand

[almoehi]

Hi everybody,

I have a question concerning RSS feeds. Recently one of our Alfresco users created a folder containing an ampersand character (let it be "this & that" for example). That broke the site activities RSS feed because Alfresco did not replace the "&" in the link URLs (should be %26, I think). Here is the xml of the feed (real names replaced). The validation fails in line 10.

<code lang="xml" linenumbers="normal">
<?xml version="1.0" encoding="UTF-8"?>
<feed xmlns="http://www.w3.org/2005/Atom">
<generator version="1.0">Alfresco (1.0)</generator>
<link rel="self" href="https://TheServer:443/share/page/feed/components/dashlets/activities/list?format=atomfeed&mode=site&..." />
<id>https://TheServer:443/share/page/feed/components/dashlets/activities/list?format=atomfeed&mode=site&...</id>
<title>Alfresco Activities Site Feed for TheSite</title>
<updated>2013-02-04T08:31:45.000+01:00</updated>
<entry xmlns='http://www.w3.org/2005/Atom'>
   <title><![CDATA[TheUser added folder this &amp;amp; that]]></title>
   <link rel="alternate" type="text/html" href="https://TheServer:443/share/page/site/TheSite/documentlibrary?path=/this & that" />
   <id>1.129</id>
   <updated>2013-02-04T16:06:58.000+01:00</updated>
   <summary type="html">
     <![CDATA[<a href="https://TheServer:443/share/page/user/TheUser/profile">TheUser</a> added folder <a href="https://TheServer:443/share/page/site/TheSite/documentlibrary?path=/this & that">this &amp; that</a>]]>
   </summary>
   <author>
     <name>TheUser</name>
     <uri>https://TheServer:443/share/page/user/TheUser/profile</uri>
   </author>
</entry>
</feed>
</code>

Based on my rudimentary html knowledge I expect to see something like this instead:

href="https://TheServer:443/share/page/site/TheSite/documentlibrary?path=/this%20%26%20that"
‍‍‍

Some RSS readers seem to ignore the malformed entry, but thunderbird for example completely refuses to load the whole feed. I have renamed the folder, but I also have to remove the defective entry from the feed somehow. So my question is: Where can I find it? Where is the feed cache?

PS: This seems to be a bug, should it be reported? According to a quick search in the bug database the issue is not known by now.

Thanks in advance,
Alex

[afaust]

Hello,

I agree, this appears to be a bug. Every template should take care to properly escape all input that can originate from users and isn't already being sanitized in another component earlier in the chain of processing.
Please report this as a JIRA.

You can only remove the defective entry from the feed via direct database manipulation, since as far as I know, there is no API for you to use to query and delete individual entries. You can use the <id> as a reference to find the relevant entry, but I am not sure wether this is post_id or feed_id in the Alfresco alf_activity_feed table…
Otherwise, after 30 days, you should no longer have any problems because entries are deleted after that time by default.

Regards
Axel

[almoehi]

Hello Axel,

thank you for your helpful answer. I'll try to find the entry in the table that you mentioned. Otherwise I'll wait patiently as you say.
The bug will be reported asap.

With best regards,
Alex