diff --git a/core/includes/theme.inc b/core/includes/theme.inc index 340ac77..2791d53 100644 --- a/core/includes/theme.inc +++ b/core/includes/theme.inc @@ -1372,7 +1372,7 @@ function template_preprocess_page(&$variables) { $variables['language'] = $language_interface; $variables['logo'] = theme_get_setting('logo.url'); $variables['site_name'] = (theme_get_setting('features.name') ? SafeMarkup::checkPlain($site_config->get('name')) : ''); - $variables['site_slogan'] = (theme_get_setting('features.slogan') ? SafeMarkup::checkAdminXss($site_config->get('slogan')) : ''); + $variables['site_slogan'] = (theme_get_setting('features.slogan') ? SafeMarkup::filterAdminXss($site_config->get('slogan')) : ''); // An exception might be thrown. try { diff --git a/core/lib/Drupal/Component/Utility/SafeMarkup.php b/core/lib/Drupal/Component/Utility/SafeMarkup.php index 9182716..e8e42ea 100644 --- a/core/lib/Drupal/Component/Utility/SafeMarkup.php +++ b/core/lib/Drupal/Component/Utility/SafeMarkup.php @@ -139,6 +139,9 @@ public static function escape($string) { /** * Applies a very permissive XSS/HTML filter for admin-only use. * + * This method is preferred to \Drupal\Component\Utility\Xss::filterAdmin() + * when the result is being used directly in the rendering system. + * * @param string $string * A string. * @@ -148,7 +151,7 @@ public static function escape($string) { * * @see \Drupal\Component\Utility\Xss::filterAdmin() */ - public static function checkAdminXss($string) { + public static function filterAdminXss($string) { if (!static::isSafe($string)) { $string = Xss::filterAdmin($string); static::set($string); @@ -157,6 +160,18 @@ public static function checkAdminXss($string) { } /** + * Applies a very permissive XSS/HTML filter for admin-only use. + * + * @deprecated as of Drupal 8.0.x, will be removed before Drupal 9.0.0. Use + * \Drupal\Component\Utility\SafeMarkup::filterAdminXss() instead. + * + * @see \Drupal\Component\Utility\SafeMarkup::filterAdminXss() + */ + public static function checkAdminXss($string) { + return static::filterAdminXss($string); + } + + /** * Filters HTML to prevent cross-site-scripting (XSS) vulnerabilities. * * This method is preferred to \Drupal\Component\Utility\Xss::filter() when diff --git a/core/lib/Drupal/Component/Utility/Xss.php b/core/lib/Drupal/Component/Utility/Xss.php index 54269e3..dcdfece 100644 --- a/core/lib/Drupal/Component/Utility/Xss.php +++ b/core/lib/Drupal/Component/Utility/Xss.php @@ -47,7 +47,7 @@ class Xss { * valid UTF-8. * * @see \Drupal\Component\Utility\Unicode::validateUtf8() - * @see \Drupal\Component\Utility\SafeMarkup::filterXss + * @see \Drupal\Component\Utility\SafeMarkup::filterXss() * * @ingroup sanitization */ diff --git a/core/modules/filter/filter.module b/core/modules/filter/filter.module index 96d6aa3..ec687fa 100644 --- a/core/modules/filter/filter.module +++ b/core/modules/filter/filter.module @@ -430,7 +430,7 @@ function template_preprocess_filter_tips(&$variables) { foreach ($variables['tips'] as $name => $tiplist) { foreach ($tiplist as $tip_key => $tip) { $tiplist[$tip_key]['attributes'] = new Attribute(); - $tiplist[$tip_key]['tip'] = SafeMarkup::checkAdminXss($tiplist[$tip_key]['tip']); + $tiplist[$tip_key]['tip'] = SafeMarkup::filterAdminXss($tiplist[$tip_key]['tip']); } $variables['tips'][$name] = array( diff --git a/core/modules/system/src/Plugin/Block/SystemBrandingBlock.php b/core/modules/system/src/Plugin/Block/SystemBrandingBlock.php index f619bd1..c32fe51 100644 --- a/core/modules/system/src/Plugin/Block/SystemBrandingBlock.php +++ b/core/modules/system/src/Plugin/Block/SystemBrandingBlock.php @@ -174,7 +174,7 @@ public function build() { ); $build['site_slogan'] = array( - '#markup' => SafeMarkup::checkAdminXss($site_config->get('slogan')), + '#markup' => SafeMarkup::filterAdminXss($site_config->get('slogan')), '#access' => $this->configuration['use_site_slogan'], );