Drupal
/
drupal
mirror of https://git.drupalcode.org/project/drupal.git
1
0
Fork 0
Code Issues Projects Releases Wiki Activity

Issue #1919338 by catch, swentel, bblake, EllaTheHarpy, Cottser: Select widget (from the options module) prone to double encoding.

8.0.x
Alex Pott 2014-02-24 09:57:30 +00:00
parent 92c6c84d1e
commit 966c33022f
2 changed files with 3 additions and 2 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

2
core/modules/options/lib/Drupal/options/Plugin/Field/FieldWidget/SelectWidget.php
View File

@ -48,7 +48,7 @@ class SelectWidget extends OptionsWidgetBase {
*/
static protected function sanitizeLabel(&$label) {
// Select form inputs allow unencoded HTML entities, but no HTML tags.
$label = strip_tags($label);
$label = decode_entities(strip_tags($label));
}
/**

3
core/modules/options/lib/Drupal/options/Tests/OptionsWidgetsTest.php
View File

@ -69,7 +69,7 @@ class OptionsWidgetsTest extends FieldTestBase {
'cardinality' => 1,
'settings' => array(
// Make sure that 0 works as an option.
'allowed_values' => array(0 => 'Zero', 1 => 'One', 2 => 'Some <script>dangerous</script> & unescaped <strong>markup</strong>'),
'allowed_values' => array(0 => 'Zero', 1 => 'One', 2 => 'Some <script>dangerous</script> & unescaped <strong>markup</strong>', 3 => 'Some HTML encoded markup with &lt; &amp; &gt;'),
),
));
$this->card_1->save();
@ -135,6 +135,7 @@ class OptionsWidgetsTest extends FieldTestBase {
$this->assertNoFieldChecked('edit-card-1-1');
$this->assertNoFieldChecked('edit-card-1-2');
$this->assertRaw('Some dangerous &amp; unescaped <strong>markup</strong>', 'Option text was properly filtered.');
$this->assertRaw('Some HTML encoded markup with &lt; &amp; &gt;');
// Select first option.
$edit = array('card_1' => 0);