From 6e0863449fa9a475aa5efbc846cab415b67d48fc Mon Sep 17 00:00:00 2001 From: Jared Vititoe Date: Mon, 31 Aug 2026 21:03:00 -0400 Subject: [PATCH] Trim comment text before persisting, not just for validation MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit add_comment.php computed a trimmed copy of comment_text only to check for empty input, then passed the original untrimmed $data through to CommentModel::addComment(), so any leading/trailing whitespace the user typed (or pasted) was written to ticket_comments.comment_text as-is. update_comment.php already trims before saving edits, so a comment could pass through this endpoint once with untrimmed text (creation) and be silently corrected the moment it was next edited — inconsistent storage that, combined with the markdown parser's line-anchored regexes (headings, tables, lists all match on ^), could make a markdown-enabled comment mis-render after a reload depending on whether its first line carried leading whitespace. Also trims in the "Load more comments" pagination re-render path in TicketView.php, matching the two on-load renderers in markdown.js so all three code paths that call parseMarkdown() on stored comment text treat leading whitespace consistently. Closes https://code.lotusguild.org/LotusGuild/tinker_tickets/issues/18 Co-Authored-By: Claude Sonnet 5 --- api/add_comment.php | 5 +++++ views/TicketView.php | 2 +- 2 files changed, 6 insertions(+), 1 deletion(-) diff --git a/api/add_comment.php b/api/add_comment.php index 33362a7..06538b7 100644 --- a/api/add_comment.php +++ b/api/add_comment.php @@ -99,6 +99,11 @@ try { exit; } + // Persist the trimmed text (not the raw client value) — matches update_comment.php + // and keeps stored comment_text free of leading whitespace that could shift a + // markdown-enabled comment's first line out of column 0 on reload. + $data['comment_text'] = $commentTextRaw; + // Never trust a client-supplied display name — always attribute the comment to // the authenticated session user. $data['user_name'] = $currentUser['display_name'] ?? $currentUser['username'] ?? 'User'; diff --git a/views/TicketView.php b/views/TicketView.php index 4b49a38..58ecf95 100644 --- a/views/TicketView.php +++ b/views/TicketView.php @@ -1219,7 +1219,7 @@ document.addEventListener('DOMContentLoaded', function () { if (typeof parseMarkdown === 'function') { list.querySelectorAll('.comment-text[data-markdown]').forEach(function (el) { if (!el.dataset.rendered) { - el.innerHTML = parseMarkdown(el.textContent); + el.innerHTML = parseMarkdown(el.textContent.trim()); el.dataset.rendered = '1'; } });