WYGWAM Hangs (504 Gateway Time-out) when adding apostrophe

Question

I have a Channel Form on the frontend that contains a WYGWAM field. The field works fine unless I add an apostrophe.

If I do, after hitting submit, it hangs and I get a "504 Gateway Time-out" error.

I can add other symbols like quotes, dashes, question marks, etc. without issue. Clicking the WYGWAM source button, I see it is displaying correctly '. I am using the basic {field:event_description} code, nothing special.

Other fields in the form (not WYGWAM) work fine and I can add apostrophes to those fields without errors. The issue is also only on the front end and not in the control panel where I can add apostrophes there.

I am using EE 2.7.3 and WYGWAM 3.2.2

Answer 1

The problem lies in updating expression engine to the latest version. 2.7.3 here’s the code i changed in /system/codeigniter/system/core/Security.php

Current function in 2.7.3

/*
public function entity_decode($str, $charset = NULL)
{
    if (strpos($str, '&') === FALSE)
    {
            return $str;
    }

    if (empty($charset))
    {
            $charset = config_item('charset');
    }

    do
    {
        $matches = $matches1 = 0;

        $str = preg_replace('~(&#x0*[0-9a-f]{2,5});?~iS', '$1;', $str, -1, $matches);
        $str = preg_replace('~(&#\d{2,4});?~S', '$1;', $str, -1, $matches1);
        $str = html_entity_decode($str, ENT_COMPAT, $charset);
    }
    while ($matches OR $matches1);

    return $str;
}
*/

/*Old function earlier function EE -- This does the trick! -- */

public function entity_decode($str, $charset='UTF-8')
{
    if (stristr($str, '&') === FALSE) return $str;

    // The reason we are not using html_entity_decode() by itself is because
    // while it is not technically correct to leave out the semicolon
    // at the end of an entity most browsers will still interpret the entity
    // correctly.  html_entity_decode() does not convert entities without
    // semicolons, so we are left with our own little solution here. Bummer.

    if (function_exists('html_entity_decode') && 
        (strtolower($charset) != 'utf-8'))
    {
        $str = html_entity_decode($str, ENT_COMPAT, $charset);
        $str = preg_replace('~&#x(0*[0-9a-f]{2,5})~ei', 'chr(hexdec("\\1"))', $str);
        return preg_replace('~&#([0-9]{2,4})~e', 'chr(\\1)', $str);
    }

    // Numeric Entities
    $str = preg_replace('~&#x(0*[0-9a-f]{2,5});{0,1}~ei', 'chr(hexdec("\\1"))', $str);
    $str = preg_replace('~&#([0-9]{2,4});{0,1}~e', 'chr(\\1)', $str);

    // Literal Entities - Slightly slow so we do another check
    if (stristr($str, '&') === FALSE)
    {
        $str = strtr($str, array_flip(get_html_translation_table(HTML_ENTITIES)));
    }

    return $str;
}