Raw citations should be escaped on the front-end

[Vitaliy-1]

OJS master branch and 3.1.2 stable

References form can be populated by an author during submission process in the case when it's enabled. Prior to exposure to the front-end, this data should be escaped.

Relevant for the Default and other themes (article_details.tpl).

[Vitaliy-1]

PR to master: pkp/ojs#2678
PR to OJS 3.1.2 stable: pkp/ojs#2679

[asmecher]

@Vitaliy-1, thanks, this is now merged and correct in OJS and OMP, both stable-3_1_2 and master. I'll leave the theme plugins to you!

[Vitaliy-1]

@asmecher, my initial thought was that publishers may want to use some tags in references, e.g., links (DOIs...) or formatted text (italic/bold). On the other hand, this form doesn't use TinyMCE that should discourage from using tags.

[asmecher]

Yes, for consistency we would need to convert the field to TinyMCE-enabled (and escape prior content) in order to properly support HTML in reference lists.

[NateWr]

Can this be closed now?

[asmecher]

I have @Vitaliy-1's thumbs-up on themes, and I've covered the apps, so yes!