What is meta? ×
Meta Stack Exchange is where users like you discuss bugs, features, and support issues that affect the software powering all 134 Stack Exchange communities.

When a post has a flag on it, moderators see this semi-transparent bar with details of the flag on it. One of the things the bar lists is "viewed by", listing all the mods who have seen the flag.

Now, the list of mods is a list of gravatars. In these, the URLs have HTML-encoded &s in the query string.

So, we get gravatars like http://www.gravatar.com/avatar/86f4f64980b4736b1f6e5e3056d08e15?s=24&d=identicon&r=PG, when we expect http://www.gravatar.com/avatar/86f4f64980b4736b1f6e5e3056d08e15?s=24d=identicon&r=PG. (Copt them to the address bar, I can't link them mere because the SE markdown editor automagically converts the entities to ampersands in the links).

Could this be fixed?

(Btw, for some reason, an HTML-encoded URL works with half the gravatars, like mine http://www.gravatar.com/avatar/0a3069491bfded90cdf623341cadc1d1?s=24&d=identicon&r=PG. But that's a quirk on Gravatar's side. )

share|improve this question
1  
@Matt: Double-encoded. And I'm sure this is a duplicate... –  BoltClock's a Unicorn Dec 12 '12 at 11:35

1 Answer 1

up vote 8 down vote accepted

ASP.NET 4 added the (good) idea that when dynamically creating HTML, strings should be HTML-encoded by default (for security reasons), unless the developer explicitly says "I know what I'm doing; I have taken care of necessary encoding myself". The developer does this by passing an IHtmlString instead of a regular string.

With the change to ASP.NET 4.5 / MVC 4, the answer to "I know what I'm doing" is now "No you don't", at least in attributes.

There is an open issue on Codeplex for this, so this may be unintentional after all. I wouldn't count on it though, since it fits right in with other "improvements".

Anyway, we've added a workaround in the next build.

Regarding your "works with half the gravatars": If you look at your example, you have

http://www.gravatar.com/avatar/0a3069491bfded90cdf623341cadc1d1
    ?
    s = 24
    &
    amp;d = identicon
    &
    amp;r = PG

So the size parameter still works. The default parameter is broken, so you'd get the default instead of an identicon for users without an explicit gravatar. And the rating parameter is broken, thus falling back to the default G.

In other words, for users who have an actual gravatar that is not rated PG, this bug didn't make a difference (and this is probably true for most moderators).

share|improve this answer
1  
Sweet, looks like Andrew Nurse is on the ASP.NET Razor team and has said it will be fixed (I can't deep link to the comment, but it's at the bottom). –  Jarrod Dixon Dec 12 '12 at 16:27

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .