' . format_backtrace($backtrace) . ''; } - drupal_set_message($message, $class, TRUE); + drupal_set_message(SafeMarkup::create($message), $class, TRUE); } if ($fatal) { diff --git a/core/includes/form.inc b/core/includes/form.inc index 42206a4..7f635c9 100644 --- a/core/includes/form.inc +++ b/core/includes/form.inc @@ -15,6 +15,7 @@ use Drupal\Core\Language\Language; use Drupal\Core\Render\Element; use Drupal\Core\Template\Attribute; +use Drupal\Core\Template\SafeMarkup; use Drupal\Core\Utility\Color; use Symfony\Component\HttpFoundation\RedirectResponse; @@ -983,7 +984,7 @@ function form_select_options($element, $choices = NULL) { $options .= form_select_options($element, $choice); $options .= ''; } - elseif (is_object($choice)) { + elseif (is_object($choice) && isset($choice->option)) { $options .= form_select_options($element, $choice->option); } else { @@ -998,7 +999,7 @@ function form_select_options($element, $choices = NULL) { $options .= ''; } } - return $options; + return SafeMarkup::create($options); } /** @@ -1663,7 +1664,7 @@ function theme_tableselect($variables) { // A header can span over multiple cells and in this case the cells // are passed in an array. The order of this array determines the // order in which they are added. - if (!isset($element['#options'][$key][$fieldname]['data']) && is_array($element['#options'][$key][$fieldname])) { + if (is_array($element['#options'][$key][$fieldname]) && !isset($element['#options'][$key][$fieldname]['data'])) { foreach ($element['#options'][$key][$fieldname] as $cell) { $row['data'][] = $cell; } @@ -1976,7 +1977,7 @@ function form_process_machine_name($element, &$form_state) { $element['#machine_name'] += array( 'source' => array('label'), 'target' => '#' . $element['#id'], - 'label' => t('Machine name'), + 'label' => (string) t('Machine name'), 'replace_pattern' => '[^a-z0-9_]+', 'replace' => '_', 'standalone' => FALSE, @@ -2009,13 +2010,13 @@ function form_process_machine_name($element, &$form_state) { $element['#machine_name']['suffix'] = '#' . $suffix_id; if ($element['#machine_name']['standalone']) { - $element['#suffix'] .= ' '; + $element['#suffix'] = SafeMarkup::concat($element['#suffix'], SafeMarkup::create(' ')); } else { // Append a field suffix to the source form element, which will contain // the live preview of the machine name. $source += array('#field_suffix' => ''); - $source['#field_suffix'] .= ' '; + $source['#field_suffix'] = SafeMarkup::concat($source['#field_suffix'], SafeMarkup::create(' ')); $parents = array_merge($element['#machine_name']['source'], array('#field_suffix')); NestedArray::setValue($form_state['complete_form'], $parents, $source['#field_suffix']); @@ -2348,6 +2349,9 @@ function template_preprocess_input(&$variables) { function theme_input($variables) { $element = $variables['element']; $attributes = $variables['attributes']; + if (!$attributes instanceof Attribute) { + throw new \LogicException('Attributes are expected to be an instance of attributes'); + } return '
' . Error::formatFlattenedBacktrace($backtrace) . ''; } - drupal_set_message($message, $class, TRUE); + drupal_set_message(SafeMarkup::create($message), $class, TRUE); } $content = $this->t('The website has encountered an error. Please try again later.'); diff --git a/core/lib/Drupal/Core/CoreServiceProvider.php b/core/lib/Drupal/Core/CoreServiceProvider.php index fe23fb6..99784f7 100644 --- a/core/lib/Drupal/Core/CoreServiceProvider.php +++ b/core/lib/Drupal/Core/CoreServiceProvider.php @@ -101,7 +101,7 @@ public static function registerTwig(ContainerBuilder $container) { 'cache' => drupal_installation_attempted() ? FALSE : Settings::get('twig_cache', TRUE), // @todo Remove in followup issue // @see http://drupal.org/node/1712444. - 'autoescape' => FALSE, + 'autoescape' => TRUE, 'debug' => Settings::get('twig_debug', FALSE), 'auto_reload' => Settings::get('twig_auto_reload', NULL), )) diff --git a/core/lib/Drupal/Core/Database/Install/Tasks.php b/core/lib/Drupal/Core/Database/Install/Tasks.php index c4d88d2..6d0dfe7 100644 --- a/core/lib/Drupal/Core/Database/Install/Tasks.php +++ b/core/lib/Drupal/Core/Database/Install/Tasks.php @@ -92,14 +92,14 @@ protected function hasPdoDriver() { * Assert test as failed. */ protected function fail($message) { - $this->results[$message] = FALSE; + $this->results[(string) $message] = FALSE; } /** * Assert test as a pass. */ protected function pass($message) { - $this->results[$message] = TRUE; + $this->results[(string) $message] = TRUE; } /** diff --git a/core/lib/Drupal/Core/Entity/EntityManager.php b/core/lib/Drupal/Core/Entity/EntityManager.php index 93e9fcf..34fd1fd 100644 --- a/core/lib/Drupal/Core/Entity/EntityManager.php +++ b/core/lib/Drupal/Core/Entity/EntityManager.php @@ -703,7 +703,7 @@ public function getEntityTypeLabels($group = FALSE) { foreach ($definitions as $entity_type_id => $definition) { if ($group) { - $options[$definition->getGroupLabel()][$entity_type_id] = $definition->getLabel(); + $options[(string) $definition->getGroupLabel()][$entity_type_id] = $definition->getLabel(); } else { $options[$entity_type_id] = $definition->getLabel(); @@ -717,7 +717,7 @@ public function getEntityTypeLabels($group = FALSE) { } // Make sure that the 'Content' group is situated at the top. - $content = $this->t('Content', array(), array('context' => 'Entity type group')); + $content = (string) $this->t('Content', array(), array('context' => 'Entity type group')); $options = array($content => $options[$content]) + $options; } diff --git a/core/lib/Drupal/Core/Extension/ThemeHandler.php b/core/lib/Drupal/Core/Extension/ThemeHandler.php index dbe2c78..8354bea 100644 --- a/core/lib/Drupal/Core/Extension/ThemeHandler.php +++ b/core/lib/Drupal/Core/Extension/ThemeHandler.php @@ -626,6 +626,8 @@ public function getName($theme) { if (!isset($themes[$theme])) { throw new \InvalidArgumentException(String::format('Requested the name of a non-existing theme @theme', array('@theme' => $theme))); } + // @todo For testing please remove before commit. + return \Drupal::config('system.site')->get('name'); return String::checkPlain($themes[$theme]->info['name']); } diff --git a/core/lib/Drupal/Core/Form/OptGroup.php b/core/lib/Drupal/Core/Form/OptGroup.php index f94d62d..21e9855 100644 --- a/core/lib/Drupal/Core/Form/OptGroup.php +++ b/core/lib/Drupal/Core/Form/OptGroup.php @@ -43,7 +43,7 @@ public static function flattenOptions(array $array) { */ protected static function doFlattenOptions(array $array, array &$options) { foreach ($array as $key => $value) { - if (is_object($value)) { + if (is_object($value) && isset($value->option)) { static::doFlattenOptions($value->option, $options); } elseif (is_array($value)) { diff --git a/core/lib/Drupal/Core/Page/HeadElement.php b/core/lib/Drupal/Core/Page/HeadElement.php index 85055ad..70cf2b7 100644 --- a/core/lib/Drupal/Core/Page/HeadElement.php +++ b/core/lib/Drupal/Core/Page/HeadElement.php @@ -8,11 +8,12 @@ namespace Drupal\Core\Page; use Drupal\Core\Template\Attribute; +use Drupal\Core\Template\SafeMarkup; /** * This class represents an HTML element that appears in the HEAD tag. */ -class HeadElement { +class HeadElement extends SafeMarkup { /** * An array of attributes for this element. diff --git a/core/lib/Drupal/Core/StringTranslation/TranslationManager.php b/core/lib/Drupal/Core/StringTranslation/TranslationManager.php index bd1b3b3..20e1911 100644 --- a/core/lib/Drupal/Core/StringTranslation/TranslationManager.php +++ b/core/lib/Drupal/Core/StringTranslation/TranslationManager.php @@ -10,6 +10,7 @@ use Drupal\Component\Utility\String; use Drupal\Core\Language\LanguageManagerInterface; use Drupal\Core\StringTranslation\Translator\TranslatorInterface; +use Drupal\Core\Template\SafeMarkup; /** * Defines a chained translation implementation combining multiple translators. @@ -140,7 +141,7 @@ public function translate($string, array $args = array(), array $options = array $string = $translation === FALSE ? $string : $translation; if (empty($args)) { - return $string; + return SafeMarkup::create($string); } else { return String::format($string, $args); @@ -160,7 +161,7 @@ public function formatPlural($count, $singular, $plural, array $args = array(), $translated_array = explode(LOCALE_PLURAL_DELIMITER, $translated_strings); if ($count == 1) { - return $translated_array[0]; + return SafeMarkup::create($translated_array[0]); } // Get the plural index through the gettext formula. @@ -168,20 +169,21 @@ public function formatPlural($count, $singular, $plural, array $args = array(), $index = (function_exists('locale_get_plural')) ? locale_get_plural($count, isset($options['langcode']) ? $options['langcode'] : NULL) : -1; if ($index == 0) { // Singular form. - return $translated_array[0]; + $return = $translated_array[0]; } else { if (isset($translated_array[$index])) { // N-th plural form. - return $translated_array[$index]; + $return = $translated_array[$index]; } else { // If the index cannot be computed or there's no translation, use // the second plural form as a fallback (which allows for most flexiblity // with the replaceable @count value). - return $translated_array[1]; + $return = $translated_array[1]; } } + return SafeMarkup::create($return); } /** diff --git a/core/lib/Drupal/Core/Template/Attribute.php b/core/lib/Drupal/Core/Template/Attribute.php index ead5d05..7432b6d 100644 --- a/core/lib/Drupal/Core/Template/Attribute.php +++ b/core/lib/Drupal/Core/Template/Attribute.php @@ -31,7 +31,7 @@ * // Produces
' . static::formatBacktrace($backtrace) . ''; - return $output; + return SafeMarkup::create($output); } /** diff --git a/core/lib/Drupal/Core/Utility/LinkGenerator.php b/core/lib/Drupal/Core/Utility/LinkGenerator.php index b547d95..96029f7 100644 --- a/core/lib/Drupal/Core/Utility/LinkGenerator.php +++ b/core/lib/Drupal/Core/Utility/LinkGenerator.php @@ -11,8 +11,9 @@ use Drupal\Component\Utility\String; use Drupal\Core\Extension\ModuleHandlerInterface; use Drupal\Core\Path\AliasManagerInterface; -use Drupal\Core\Template\Attribute; use Drupal\Core\Routing\UrlGeneratorInterface; +use Drupal\Core\Template\Attribute; +use Drupal\Core\Template\SafeMarkup; use Drupal\Core\Url; /** @@ -122,8 +123,7 @@ public function generateFromUrl($text, Url $url) { // Sanitize the link text if necessary. $text = $variables['options']['html'] ? $variables['text'] : String::checkPlain($variables['text']); - - return '' . $text . ''; + return SafeMarkup::create('' . $text . ''); } /** diff --git a/core/lib/Drupal/Core/Utility/LinkGeneratorInterface.php b/core/lib/Drupal/Core/Utility/LinkGeneratorInterface.php index e6e74a7..a7212d0 100644 --- a/core/lib/Drupal/Core/Utility/LinkGeneratorInterface.php +++ b/core/lib/Drupal/Core/Utility/LinkGeneratorInterface.php @@ -64,7 +64,7 @@ * sparingly since it is usually unnecessary and requires extra * processing. * - * @return string + * @return \Drupal\Core\Template\SafeMarkup|string * An HTML string containing a link to the given route and parameters. * * @throws \Symfony\Component\Routing\Exception\RouteNotFoundException diff --git a/core/modules/action/action.views_execution.inc b/core/modules/action/action.views_execution.inc index 32bc883..66d18bf 100644 --- a/core/modules/action/action.views_execution.inc +++ b/core/modules/action/action.views_execution.inc @@ -19,6 +19,6 @@ function action_views_form_substitutions() { '#attributes' => array('class' => array('action-table-select-all')), ); return array( - $select_all_placeholder => drupal_render($select_all), + (string) $select_all_placeholder => drupal_render($select_all), ); } diff --git a/core/modules/block/custom_block/src/Tests/CustomBlockListTest.php b/core/modules/block/custom_block/src/Tests/CustomBlockListTest.php index 8bded49..2fbd583 100644 --- a/core/modules/block/custom_block/src/Tests/CustomBlockListTest.php +++ b/core/modules/block/custom_block/src/Tests/CustomBlockListTest.php @@ -52,7 +52,7 @@ public function testListing() { // Test the contents of each th cell. $expected_items = array(t('Block description'), t('Operations')); foreach ($elements as $key => $element) { - $this->assertIdentical((string) $element[0], $expected_items[$key]); + $this->assertIdentical((string) $element[0], (string) $expected_items[$key]); } $label = 'Antelope'; diff --git a/core/modules/block/src/Tests/BlockInterfaceTest.php b/core/modules/block/src/Tests/BlockInterfaceTest.php index 0b71146..67f0faa 100644 --- a/core/modules/block/src/Tests/BlockInterfaceTest.php +++ b/core/modules/block/src/Tests/BlockInterfaceTest.php @@ -7,6 +7,9 @@ namespace Drupal\block\Tests; +use Drupal\Component\Utility\NestedArray; +use Drupal\Core\Render\Element; +use Drupal\Core\Template\SafeMarkup; use Drupal\simpletest\DrupalUnitTestBase; use Drupal\block\BlockInterface; @@ -82,14 +85,14 @@ public function testBlockInterface() { ), 'label' => array( '#type' => 'textfield', - '#title' => 'Title', + '#title' => t('Title'), '#maxlength' => 255, '#default_value' => 'Custom Display Message', '#required' => TRUE, ), 'label_display' => array( '#type' => 'checkbox', - '#title' => 'Display title', + '#title' => t('Display title'), '#default_value' => TRUE, '#return_value' => 'visible', ), @@ -124,7 +127,7 @@ public function testBlockInterface() { ); $form_state = array(); // Ensure there are no form elements that do not belong to the plugin. - $this->assertIdentical($display_block->buildConfigurationForm(array(), $form_state), $expected_form, 'Only the expected form elements were present.'); + $this->assertIdenticalArray($display_block->buildConfigurationForm(array(), $form_state), $expected_form, 'Only the expected form elements were present.'); $expected_build = array( '#children' => 'My custom display message.', @@ -136,4 +139,5 @@ public function testBlockInterface() { // testing BlockBase's implementation, not the interface itself. $this->assertIdentical($display_block->getMachineNameSuggestion(), 'displaymessage', 'The plugin returned the expected machine name suggestion.'); } + } diff --git a/core/modules/block/src/Tests/BlockViewBuilderTest.php b/core/modules/block/src/Tests/BlockViewBuilderTest.php index a6571cb..78a53eb 100644 --- a/core/modules/block/src/Tests/BlockViewBuilderTest.php +++ b/core/modules/block/src/Tests/BlockViewBuilderTest.php @@ -100,7 +100,7 @@ public function testBasicRendering() { $expected[] = ''; $expected[] = ''; $expected_output = implode("\n", $expected); - $this->assertEqual(drupal_render($output), $expected_output); + $this->assertEqual((string) drupal_render($output), $expected_output); // Reset the HTML IDs so that the next render is not affected. drupal_static_reset('drupal_html_id'); @@ -128,7 +128,7 @@ public function testBasicRendering() { $expected[] = ''; $expected[] = ''; $expected_output = implode("\n", $expected); - $this->assertEqual(drupal_render($output), $expected_output); + $this->assertEqual((string) drupal_render($output), $expected_output); } /** @@ -198,7 +198,7 @@ protected function verifyRenderCacheHandling() { public function testBlockViewBuilderAlter() { // Establish baseline. $build = $this->getBlockRenderArray(); - $this->assertIdentical(drupal_render($build), 'Llamas > unicorns!'); + $this->assertIdentical((string) drupal_render($build), 'Llamas > unicorns!'); // Enable the block view alter hook that adds a suffix, for basic testing. \Drupal::state()->set('block_test_view_alter_suffix', TRUE); @@ -206,13 +206,13 @@ public function testBlockViewBuilderAlter() { // Basic: non-empty block. $build = $this->getBlockRenderArray(); $this->assertTrue(isset($build['#suffix']) && $build['#suffix'] === '
Llamas are
' . Xss::filter($revision->log->value) . '
' : ''), - 'class' => array('revision-current')); + $cell = t('!date by !username', array('!date' => l(format_date($revision->getRevisionCreationTime(), 'short'), 'node/' . $node->id()), '!username' => drupal_render($username))); + if ($revision->log->value != '') { + $cell .= '' . Xss::filter($revision->log->value) . '
'; + } + $row[] = array('data' => SafeMarkup::create($cell), 'class' => array('revision-current')); $row[] = array('data' => drupal_placeholder(t('current revision')), 'class' => array('revision-current')); } else { @@ -152,8 +155,14 @@ function node_revision_overview($node) { '#theme' => 'username', '#account' => $revision->getOwner(), ); - $row[] = t('!date by !username', array('!date' => l(format_date($revision->getRevisionCreationTime(), 'short'), "node/" . $node->id() . "/revisions/" . $vid . "/view"), '!username' => drupal_render($username))) - . (($revision->log->value != '') ? '' . Xss::filter($revision->log->value) . '
' : ''); + $cell = t('!date by !username', array( + '!date' => l(format_date($revision->getRevisionCreationTime(), 'short'), "node/" . $node->id() . "/revisions/" . $vid . "/view"), + '!username' => drupal_render($username) + )); + if ($revision->log->value != '') { + $cell .= '' . Xss::filter($revision->log->value) . '
'; + } + $row[] = $cell; if ($revert_permission) { $links['revert'] = array( 'title' => t('Revert'), diff --git a/core/modules/node/src/NodeViewBuilder.php b/core/modules/node/src/NodeViewBuilder.php index 606ef36..138e1bd 100644 --- a/core/modules/node/src/NodeViewBuilder.php +++ b/core/modules/node/src/NodeViewBuilder.php @@ -10,6 +10,7 @@ use Drupal\Core\Entity\Display\EntityViewDisplayInterface; use Drupal\Core\Entity\EntityInterface; use Drupal\Core\Entity\EntityViewBuilder; +use Drupal\Core\Template\SafeMarkup; /** * Render controller for nodes. @@ -124,7 +125,7 @@ public static function renderLinks(array $element, array $context) { \Drupal::moduleHandler()->alter('node_links', $links, $entity, $hook_context); } $markup = drupal_render($links); - $element['#markup'] = str_replace($placeholder, $markup, $element['#markup']); + $element['#markup'] = SafeMarkup::strReplace($placeholder, $markup, $element['#markup']); return $element; } diff --git a/core/modules/node/src/Plugin/Search/NodeSearch.php b/core/modules/node/src/Plugin/Search/NodeSearch.php index 1bcd79b..c42f296 100644 --- a/core/modules/node/src/Plugin/Search/NodeSearch.php +++ b/core/modules/node/src/Plugin/Search/NodeSearch.php @@ -17,6 +17,7 @@ use Drupal\Core\Session\AccountInterface; use Drupal\Core\Access\AccessibleInterface; use Drupal\Core\Database\Query\Condition; +use Drupal\Core\Template\SafeMarkup; use Drupal\node\NodeInterface; use Drupal\search\Plugin\ConfigurableSearchPluginBase; use Drupal\search\Plugin\SearchIndexingInterface; @@ -265,10 +266,12 @@ public function execute() { $node = $node_storage->load($item->sid)->getTranslation($item->langcode); $build = $node_render->view($node, 'search_result', $item->langcode); unset($build['#theme']); - $node->rendered = drupal_render($build); // Fetch comment count for snippet. - $node->rendered .= ' ' . $this->moduleHandler->invoke('comment', 'node_update_index', array($node, $item->langcode)); + $node->rendered = SafeMarkup::implode(' ', array( + drupal_render($build), + $this->moduleHandler->invoke('comment', 'node_update_index', array($node, $item->langcode)), + )); $extra = $this->moduleHandler->invokeAll('node_search_result', array($node, $item->langcode)); diff --git a/core/modules/node/src/Plugin/views/row/Rss.php b/core/modules/node/src/Plugin/views/row/Rss.php index 2df6281..1a0e641 100644 --- a/core/modules/node/src/Plugin/views/row/Rss.php +++ b/core/modules/node/src/Plugin/views/row/Rss.php @@ -7,6 +7,7 @@ namespace Drupal\node\Plugin\views\row; +use Drupal\Core\Template\SafeMarkup; use Drupal\views\Plugin\views\row\RowPluginBase; /** @@ -161,7 +162,7 @@ public function render($row) { } $item = new \stdClass(); - $item->description = $item_text; + $item->description = SafeMarkup::create($item_text); $item->title = $node->label(); $item->link = $node->link; $item->elements = $node->rss_elements; diff --git a/core/modules/options/src/Tests/OptionsFormattersTest.php b/core/modules/options/src/Tests/OptionsFormattersTest.php index 34cda3a..be7b63f 100644 --- a/core/modules/options/src/Tests/OptionsFormattersTest.php +++ b/core/modules/options/src/Tests/OptionsFormattersTest.php @@ -45,7 +45,7 @@ public function testFormatter() { $build = $items->view(array('type' => 'list_key')); $this->assertEqual($build['#formatter'], 'list_key', 'The chosen formatter is used.'); - $this->assertEqual($build[0]['#markup'], 1); + $this->assertEqual($build[0]['#markup'], "1"); } } diff --git a/core/modules/quickedit/src/Tests/QuickEditLoadingTest.php b/core/modules/quickedit/src/Tests/QuickEditLoadingTest.php index 220a14a..8d1aeda 100644 --- a/core/modules/quickedit/src/Tests/QuickEditLoadingTest.php +++ b/core/modules/quickedit/src/Tests/QuickEditLoadingTest.php @@ -497,7 +497,7 @@ public function testConcurrentEdit() { $ajax_commands = Json::decode($response); $this->assertIdentical(2, count($ajax_commands), 'The field form HTTP request results in two AJAX commands.'); $this->assertIdentical('quickeditFieldFormValidationErrors', $ajax_commands[1]['command'], 'The second AJAX command is a quickeditFieldFormValidationErrors command.'); - $this->assertTrue(strpos($ajax_commands[1]['data'], t('The content has either been modified by another user, or you have already submitted modifications. As a result, your changes cannot be saved.')), 'Error message returned to user.'); + $this->assertTrue(strpos($ajax_commands[1]['data'], (string) t('The content has either been modified by another user, or you have already submitted modifications. As a result, your changes cannot be saved.')), 'Error message returned to user.'); } } diff --git a/core/modules/rdf/rdf.module b/core/modules/rdf/rdf.module index 8ea735b..b532d49 100644 --- a/core/modules/rdf/rdf.module +++ b/core/modules/rdf/rdf.module @@ -5,7 +5,9 @@ * Enables semantically enriched output for Drupal sites in the form of RDFa. */ +use Drupal\Component\Utility\String; use Drupal\Core\Template\Attribute; +use Drupal\Core\Template\SafeMarkup; use Symfony\Cmf\Component\Routing\RouteObjectInterface; use Symfony\Component\HttpFoundation\Request; @@ -299,7 +301,7 @@ function rdf_preprocess_node(&$variables) { $author_mapping = $mapping->getPreparedFieldMapping('uid'); if (!empty($author_mapping['properties']) && $variables['submitted']) { $author_attributes = array('rel' => $author_mapping['properties']); - $variables['submitted'] = '' . $variables['submitted'] . ''; + $variables['submitted'] = SafeMarkup::create('' . $variables['submitted'] . ''); } // Adds RDFa markup for the date. @@ -310,7 +312,7 @@ function rdf_preprocess_node(&$variables) { '#theme' => 'rdf_metadata', '#metadata' => array($date_attributes), ); - $variables['submitted'] .= drupal_render($rdf_metadata); + $variables['submitted'] = SafeMarkup::create($variables['submitted'] . drupal_render($rdf_metadata)); } // Adds RDFa markup annotating the number of comments a node has. @@ -457,8 +459,9 @@ function rdf_preprocess_comment(&$variables) { $author_attributes = array('rel' => $author_mapping['properties']); // Wraps the author variable and the submitted variable which are both // available in comment.html.twig. - $variables['author'] = '' . $variables['author'] . ''; - $variables['submitted'] = '' . $variables['submitted'] . ''; + $author = $variables['author'] instanceof SafeMarkup ? $variables['author'] : String::checkPlain($variables['author']); + $variables['author'] = SafeMarkup::create('' . $author . ''); + $variables['submitted'] = SafeMarkup::create('' . $variables['submitted'] . ''); } // Adds RDFa markup for the date of the comment. $created_mapping = $mapping->getPreparedFieldMapping('created'); @@ -474,8 +477,8 @@ function rdf_preprocess_comment(&$variables) { $created_metadata_markup = drupal_render($rdf_metadata); // Appends the markup to the created variable and the submitted variable // which are both available in comment.html.twig. - $variables['created'] .= $created_metadata_markup; - $variables['submitted'] .= $created_metadata_markup; + $variables['created'] = SafeMarkup::implode('', array($variables['created'], $created_metadata_markup)); + $variables['submitted'] = SafeMarkup::create($variables['submitted'] . $created_metadata_markup); } $title_mapping = $mapping->getPreparedFieldMapping('subject'); if (!empty($title_mapping)) { diff --git a/core/modules/responsive_image/responsive_image.module b/core/modules/responsive_image/responsive_image.module index 53c182c..ce5b205 100644 --- a/core/modules/responsive_image/responsive_image.module +++ b/core/modules/responsive_image/responsive_image.module @@ -7,6 +7,7 @@ use Drupal\breakpoint\Entity\Breakpoint; use \Drupal\Core\Template\Attribute; +use Drupal\Core\Template\SafeMarkup; use Symfony\Component\HttpFoundation\Request; /** @@ -190,7 +191,6 @@ function theme_responsive_image($variables) { } $sources = array(); - $output = array(); // Fallback image, output as source with media query. $sources[] = array( @@ -234,6 +234,7 @@ function theme_responsive_image($variables) { } if (!empty($sources)) { + $output = array(); $output[] = '#cache disabled
'; $output = drupal_render($element); - $this->assertIdentical($output, 'overridden
', 'Output is overridden.'); - $this->assertIdentical($element['#markup'], 'overridden
', '#markup is overridden.'); + $this->assertIdentical((string) $output, 'overridden
', 'Output is overridden.'); + $this->assertIdentical((string) $element['#markup'], 'overridden
', '#markup is overridden.'); $settings = $this->parseDrupalSettings(drupal_get_js()); $this->assertIdentical($settings['foo'], 'bar', 'Original JavaScript setting is added to the page.'); $this->assertIdentical($settings['common_test'], $context, '#attached is modified; JavaScript setting is added to page.'); @@ -486,9 +487,9 @@ function testDrupalRenderPostRenderCache() { $element['#cache'] = array('cid' => 'post_render_cache_test_GET'); $element['#markup'] = '#cache enabled, GET
'; $output = drupal_render($element); - $this->assertIdentical($output, 'overridden
', 'Output is overridden.'); + $this->assertIdentical((string) $output, 'overridden
', 'Output is overridden.'); $this->assertTrue(isset($element['#printed']), 'No cache hit'); - $this->assertIdentical($element['#markup'], 'overridden
', '#markup is overridden.'); + $this->assertIdentical((string) $element['#markup'], 'overridden
', '#markup is overridden.'); $settings = $this->parseDrupalSettings(drupal_get_js()); $this->assertIdentical($settings['foo'], 'bar', 'Original JavaScript setting is added to the page.'); $this->assertIdentical($settings['common_test'], $context, '#attached is modified; JavaScript setting is added to page.'); @@ -509,7 +510,7 @@ function testDrupalRenderPostRenderCache() { $element['#cache'] = array('cid' => 'post_render_cache_test_GET'); $element['#markup'] = '#cache enabled, GET
'; $output = drupal_render($element); - $this->assertIdentical($output, 'overridden
', 'Output is overridden.'); + $this->assertIdentical((string) $output, 'overridden
', 'Output is overridden.'); $this->assertFalse(isset($element['#printed']), 'Cache hit'); $this->assertIdentical($element['#markup'], 'overridden
', '#markup is overridden.'); $settings = $this->parseDrupalSettings(drupal_get_js()); @@ -526,9 +527,9 @@ function testDrupalRenderPostRenderCache() { $element['#cache'] = array('cid' => 'post_render_cache_test_POST'); $element['#markup'] = '#cache enabled, POST
'; $output = drupal_render($element); - $this->assertIdentical($output, 'overridden
', 'Output is overridden.'); + $this->assertIdentical((string) $output, 'overridden
', 'Output is overridden.'); $this->assertTrue(isset($element['#printed']), 'No cache hit'); - $this->assertIdentical($element['#markup'], 'overridden
', '#markup is overridden.'); + $this->assertIdentical((string) $element['#markup'], 'overridden
', '#markup is overridden.'); $settings = $this->parseDrupalSettings(drupal_get_js()); $this->assertIdentical($settings['foo'], 'bar', 'Original JavaScript setting is added to the page.'); $this->assertIdentical($settings['common_test'], $context, '#attached is modified; JavaScript setting is added to page.'); @@ -589,9 +590,9 @@ function testDrupalRenderChildrenPostRenderCache() { ); $element = $test_element; $output = drupal_render($element); - $this->assertIdentical($output, 'overridden
', 'Output is overridden.'); + $this->assertIdentical((string) $output, 'overridden
', 'Output is overridden.'); $this->assertTrue(isset($element['#printed']), 'No cache hit'); - $this->assertIdentical($element['#markup'], 'overridden
', '#markup is overridden.'); + $this->assertIdentical((string) $element['#markup'], 'overridden
', '#markup is overridden.'); $settings = $this->parseDrupalSettings(drupal_get_js()); $expected_settings = $context_1 + $context_2 + $context_3; $this->assertIdentical($settings['foo'], 'bar', 'Original JavaScript setting is added to the page.'); @@ -635,7 +636,7 @@ function testDrupalRenderChildrenPostRenderCache() { drupal_static_reset('_drupal_add_js'); $element = $test_element; $output = drupal_render($element); - $this->assertIdentical($output, 'overridden
', 'Output is overridden.'); + $this->assertIdentical((string) $output, 'overridden
', 'Output is overridden.'); $this->assertFalse(isset($element['#printed']), 'Cache hit'); $settings = $this->parseDrupalSettings(drupal_get_js()); $this->assertIdentical($settings['foo'], 'bar', 'Original JavaScript setting is added to the page.'); @@ -647,8 +648,8 @@ function testDrupalRenderChildrenPostRenderCache() { unset($test_element['#cache']); $element = $test_element; $output = drupal_render($element); - $this->assertIdentical($output, 'overridden
', 'Output is overridden.'); - $this->assertIdentical($element['#markup'], 'overridden
', '#markup is overridden.'); + $this->assertIdentical((string) $output, 'overridden
', 'Output is overridden.'); + $this->assertIdentical((string) $element['#markup'], 'overridden
', '#markup is overridden.'); $settings = $this->parseDrupalSettings(drupal_get_js()); $expected_settings = $context_1 + $context_2 + $context_3; $this->assertIdentical($settings['foo'], 'bar', 'Original JavaScript setting is added to the page.'); @@ -667,9 +668,9 @@ function testDrupalRenderChildrenPostRenderCache() { $element['#cache']['keys'] = array('simpletest', 'drupal_render', 'children_post_render_cache', 'nested_cache_parent'); $element['child']['#cache']['keys'] = array('simpletest', 'drupal_render', 'children_post_render_cache', 'nested_cache_child'); $output = drupal_render($element); - $this->assertIdentical($output, 'overridden
', 'Output is overridden.'); + $this->assertIdentical((string) $output, 'overridden
', 'Output is overridden.'); $this->assertTrue(isset($element['#printed']), 'No cache hit'); - $this->assertIdentical($element['#markup'], 'overridden
', '#markup is overridden.'); + $this->assertIdentical((string) $element['#markup'], 'overridden
', '#markup is overridden.'); $settings = $this->parseDrupalSettings(drupal_get_js()); $expected_settings = $context_1 + $context_2 + $context_3; $this->assertIdentical($settings['foo'], 'bar', 'Original JavaScript setting is added to the page.'); @@ -742,7 +743,7 @@ function testDrupalRenderChildrenPostRenderCache() { $element = $test_element; $element['#cache']['keys'] = array('simpletest', 'drupal_render', 'children_post_render_cache', 'nested_cache_parent'); $output = drupal_render($element); - $this->assertIdentical($output, 'overridden
', 'Output is overridden.'); + $this->assertIdentical((string) $output, 'overridden
', 'Output is overridden.'); $this->assertFalse(isset($element['#printed']), 'Cache hit'); $settings = $this->parseDrupalSettings(drupal_get_js()); $this->assertIdentical($settings['foo'], 'bar', 'Original JavaScript setting is added to the page.'); @@ -754,7 +755,7 @@ function testDrupalRenderChildrenPostRenderCache() { $element['child']['#cache']['keys'] = array('simpletest', 'drupal_render', 'children_post_render_cache', 'nested_cache_child'); $element = $element['child']; $output = drupal_render($element); - $this->assertIdentical($output, 'overridden
', 'Output is overridden.'); + $this->assertIdentical((string) $output, 'overridden
', 'Output is overridden.'); $this->assertFalse(isset($element['#printed']), 'Cache hit'); $settings = $this->parseDrupalSettings(drupal_get_js()); $expected_settings = $context_2 + $context_3; @@ -790,7 +791,7 @@ function testDrupalRenderRenderCachePlaceholder() { drupal_static_reset('_drupal_add_js'); $element = $test_element; $output = drupal_render($element); - $this->assertIdentical($output, $expected_output, 'Placeholder was replaced in output'); + $this->assertIdentical((string) $output, $expected_output, 'Placeholder was replaced in output'); $settings = $this->parseDrupalSettings(drupal_get_js()); $this->assertIdentical($settings['common_test'], $context, '#attached is modified; JavaScript setting is added to page.'); @@ -803,9 +804,9 @@ function testDrupalRenderRenderCachePlaceholder() { $element = $test_element; $element['#cache'] = array('cid' => 'render_cache_placeholder_test_GET'); $output = drupal_render($element); - $this->assertIdentical($output, $expected_output, 'Placeholder was replaced in output'); + $this->assertIdentical((string) $output, $expected_output, 'Placeholder was replaced in output'); $this->assertTrue(isset($element['#printed']), 'No cache hit'); - $this->assertIdentical($element['#markup'], $expected_output, 'Placeholder was replaced in #markup.'); + $this->assertIdentical((string) $element['#markup'], $expected_output, 'Placeholder was replaced in #markup.'); $settings = $this->parseDrupalSettings(drupal_get_js()); $this->assertIdentical($settings['common_test'], $context, '#attached is modified; JavaScript setting is added to page.'); @@ -840,7 +841,7 @@ function testDrupalRenderRenderCachePlaceholder() { $element = $test_element; $element['#cache'] = array('cid' => 'render_cache_placeholder_test_GET'); $output = drupal_render($element); - $this->assertIdentical($output, $expected_output, 'Placeholder was replaced in output'); + $this->assertIdentical((string) $output, $expected_output, 'Placeholder was replaced in output'); $this->assertFalse(isset($element['#printed']), 'Cache hit'); $this->assertIdentical($element['#markup'], $expected_output, 'Placeholder was replaced in #markup.'); $settings = $this->parseDrupalSettings(drupal_get_js()); @@ -880,7 +881,7 @@ function testDrupalRenderChildElementRenderCachePlaceholder() { drupal_static_reset('_drupal_add_js'); $element = $container; $output = drupal_render($element); - $this->assertIdentical($output, $expected_output, 'Placeholder was replaced in output'); + $this->assertIdentical((string) $output, $expected_output, 'Placeholder was replaced in output'); $settings = $this->parseDrupalSettings(drupal_get_js()); $this->assertIdentical($settings['common_test'], $context, '#attached is modified; JavaScript setting is added to page.'); @@ -899,9 +900,9 @@ function testDrupalRenderChildElementRenderCachePlaceholder() { $element['#children'] = drupal_render($child, TRUE); // Eventually, drupal_render() gets called on the root element. $output = drupal_render($element); - $this->assertIdentical($output, $expected_output, 'Placeholder was replaced in output'); + $this->assertIdentical((string) $output, $expected_output, 'Placeholder was replaced in output'); $this->assertTrue(isset($element['#printed']), 'No cache hit'); - $this->assertIdentical($element['#markup'], $expected_output, 'Placeholder was replaced in #markup.'); + $this->assertIdentical((string) $element['#markup'], $expected_output, 'Placeholder was replaced in #markup.'); $settings = $this->parseDrupalSettings(drupal_get_js()); $this->assertIdentical($settings['common_test'], $context, '#attached is modified; JavaScript setting is added to page.'); @@ -996,7 +997,7 @@ function testDrupalRenderChildElementRenderCachePlaceholder() { $child = &$element['test_element']; $element['#children'] = drupal_render($child, TRUE); $output = drupal_render($element); - $this->assertIdentical($output, $expected_output, 'Placeholder was replaced in output'); + $this->assertIdentical((string) $output, $expected_output, 'Placeholder was replaced in output'); $this->assertFalse(isset($element['#printed']), 'Cache hit'); $this->assertIdentical($element['#markup'], $expected_output, 'Placeholder was replaced in #markup.'); $settings = $this->parseDrupalSettings(drupal_get_js()); diff --git a/core/modules/system/src/Tests/Common/UrlTest.php b/core/modules/system/src/Tests/Common/UrlTest.php index 7cda6a3..e8890ce 100644 --- a/core/modules/system/src/Tests/Common/UrlTest.php +++ b/core/modules/system/src/Tests/Common/UrlTest.php @@ -39,7 +39,7 @@ function testLinkXSS() { $path = ""; $link = l($text, $path); $sanitized_path = check_url(url($path)); - $this->assertTrue(strpos($link, $sanitized_path) !== FALSE, format_string('XSS attack @path was filtered by l().', array('@path' => $path))); + $this->assertTrue(strpos($link, (string) $sanitized_path) !== FALSE, format_string('XSS attack @path was filtered by l().', array('@path' => $path))); // Test #type 'link'. $link_array = array( @@ -49,7 +49,7 @@ function testLinkXSS() { ); $type_link = drupal_render($link_array); $sanitized_path = check_url(url($path)); - $this->assertTrue(strpos($type_link, $sanitized_path) !== FALSE, format_string('XSS attack @path was filtered by #theme', array('@path' => $path))); + $this->assertTrue(strpos($type_link, (string) $sanitized_path) !== FALSE, format_string('XSS attack @path was filtered by #theme', array('@path' => $path))); } /** diff --git a/core/modules/system/src/Tests/Common/XssUnitTest.php b/core/modules/system/src/Tests/Common/XssUnitTest.php index d54cc74..9e54f38 100644 --- a/core/modules/system/src/Tests/Common/XssUnitTest.php +++ b/core/modules/system/src/Tests/Common/XssUnitTest.php @@ -60,7 +60,7 @@ function testBadProtocolStripping() { $url = 'javascript:http://www.example.com/?x=1&y=2'; $expected_plain = 'http://www.example.com/?x=1&y=2'; $expected_html = 'http://www.example.com/?x=1&y=2'; - $this->assertIdentical(check_url($url), $expected_html, 'check_url() filters a URL and encodes it for HTML.'); + $this->assertIdentical((string) check_url($url), $expected_html, 'check_url() filters a URL and encodes it for HTML.'); $this->assertIdentical(UrlHelper::stripDangerousProtocols($url), $expected_plain, '\Drupal\Component\Utility\Url::stripDangerousProtocols() filters a URL and returns plain text.'); } } diff --git a/core/modules/system/src/Tests/Entity/EntityTranslationTest.php b/core/modules/system/src/Tests/Entity/EntityTranslationTest.php index 2086c14..f9b1a17 100644 --- a/core/modules/system/src/Tests/Entity/EntityTranslationTest.php +++ b/core/modules/system/src/Tests/Entity/EntityTranslationTest.php @@ -497,7 +497,7 @@ function testLanguageFallback() { $translation = $this->entityManager->getTranslationFromContext($entity2, $default_langcode); $translation_build = $controller->view($translation); $translation_output = drupal_render($translation_build); - $this->assertIdentical($entity2_output, $translation_output, 'When the entity has no translation no fallback is applied.'); + $this->assertIdentical((string) $entity2_output, (string) $translation_output, 'When the entity has no translation no fallback is applied.'); // Checks that entity translations are rendered properly. $controller = $this->entityManager->getViewBuilder($entity_type); diff --git a/core/modules/system/src/Tests/Form/FormTest.php b/core/modules/system/src/Tests/Form/FormTest.php index e45defc..ef001d7 100644 --- a/core/modules/system/src/Tests/Form/FormTest.php +++ b/core/modules/system/src/Tests/Form/FormTest.php @@ -143,7 +143,7 @@ function testRequiredFields() { // Select elements are going to have validation errors with empty // input, since those are illegal choices. Just make sure the // error is not "field is required". - $this->assertTrue((empty($errors[$element]) || strpos('field is required', $errors[$element]) === FALSE), "Optional '$type' field '$element' is not treated as a required element"); + $this->assertTrue((empty($errors[$element]) || strpos('field is required', (string) $errors[$element]) === FALSE), "Optional '$type' field '$element' is not treated as a required element"); } else { // Make sure there is *no* form error for this element. diff --git a/core/modules/system/src/Tests/Menu/MenuTestBase.php b/core/modules/system/src/Tests/Menu/MenuTestBase.php index d205b13..e66dcf9 100644 --- a/core/modules/system/src/Tests/Menu/MenuTestBase.php +++ b/core/modules/system/src/Tests/Menu/MenuTestBase.php @@ -65,7 +65,7 @@ protected function assertBreadcrumbParts($trail) { foreach ($trail as $path => $title) { $url = url($path); $part = array_shift($parts); - $pass = ($pass && $part['href'] === $url && $part['text'] === check_plain($title)); + $pass = ($pass && $part['href'] === $url && $part['text'] === (string) check_plain($title)); } } // No parts must be left, or an expected "Home" will always pass. diff --git a/core/modules/system/src/Tests/Plugin/DerivativeTest.php b/core/modules/system/src/Tests/Plugin/DerivativeTest.php index 8feeff6..b09b869 100644 --- a/core/modules/system/src/Tests/Plugin/DerivativeTest.php +++ b/core/modules/system/src/Tests/Plugin/DerivativeTest.php @@ -25,11 +25,11 @@ public static function getInfo() { */ function testDerivativeDecorator() { // Ensure that getDefinitions() returns the expected definitions. - $this->assertIdentical($this->mockBlockManager->getDefinitions(), $this->mockBlockExpectedDefinitions); + $this->assertIdenticalArray($this->mockBlockManager->getDefinitions(), $this->mockBlockExpectedDefinitions); // Ensure that getDefinition() returns the expected definition. foreach ($this->mockBlockExpectedDefinitions as $id => $definition) { - $this->assertIdentical($this->mockBlockManager->getDefinition($id), $definition); + $this->assertIdenticalArray($this->mockBlockManager->getDefinition($id), $definition); } // Ensure that NULL is returned as the definition of a non-existing base diff --git a/core/modules/system/src/Tests/Plugin/Discovery/DiscoveryTestBase.php b/core/modules/system/src/Tests/Plugin/Discovery/DiscoveryTestBase.php index 9d0be54..8d5f97a 100644 --- a/core/modules/system/src/Tests/Plugin/Discovery/DiscoveryTestBase.php +++ b/core/modules/system/src/Tests/Plugin/Discovery/DiscoveryTestBase.php @@ -49,7 +49,7 @@ function testDiscoveryInterface() { // Ensure that getDefinition() returns the expected definition. foreach ($this->expectedDefinitions as $id => $definition) { - $this->assertIdentical($this->discovery->getDefinition($id), $definition); + $this->assertIdenticalArray($this->discovery->getDefinition($id), $definition); } // Ensure that an empty array is returned if no plugin definitions are found. diff --git a/core/modules/system/src/Tests/System/DateFormatsMachineNameTest.php b/core/modules/system/src/Tests/System/DateFormatsMachineNameTest.php index 495ab87..484b1d3 100644 --- a/core/modules/system/src/Tests/System/DateFormatsMachineNameTest.php +++ b/core/modules/system/src/Tests/System/DateFormatsMachineNameTest.php @@ -9,6 +9,7 @@ use Drupal\Component\Utility\Unicode; use Drupal\simpletest\WebTestBase; +use Drupal\Component\Utility\String; /** * Functional tests for date format machine names. @@ -48,7 +49,7 @@ public function testDateFormatsMachineNameAllowedValues() { 'date_format_pattern' => 'Y-m-d', ); $this->drupalPostForm('admin/config/regional/date-time/formats/add', $edit, t('Add format')); - $this->assertText(t('The machine-readable name must be unique, and can only contain lowercase letters, numbers, and underscores. Additionally, it can not be the reserved word "custom".'), 'It is not possible to create a date format with the machine name that has any character other than lowercase letters, digits or underscore.'); + $this->assertText(String::checkPlain(t('The machine-readable name must be unique, and can only contain lowercase letters, numbers, and underscores. Additionally, it can not be the reserved word "custom".')), 'It is not possible to create a date format with the machine name that has any character other than lowercase letters, digits or underscore.'); // Try to create a date format with the reserved machine name "custom". $edit = array( @@ -57,7 +58,7 @@ public function testDateFormatsMachineNameAllowedValues() { 'date_format_pattern' => 'Y-m-d', ); $this->drupalPostForm('admin/config/regional/date-time/formats/add', $edit, t('Add format')); - $this->assertText(t('The machine-readable name must be unique, and can only contain lowercase letters, numbers, and underscores. Additionally, it can not be the reserved word "custom".'), 'It is not possible to create a date format with the machine name "custom".'); + $this->assertText(String::checkPlain(t('The machine-readable name must be unique, and can only contain lowercase letters, numbers, and underscores. Additionally, it can not be the reserved word "custom".')), 'It is not possible to create a date format with the machine name "custom".'); // Try to create a date format with a machine name, "fallback", that // already exists. diff --git a/core/modules/system/src/Tests/System/ErrorHandlerTest.php b/core/modules/system/src/Tests/System/ErrorHandlerTest.php index 2356a84..9883ae3 100644 --- a/core/modules/system/src/Tests/System/ErrorHandlerTest.php +++ b/core/modules/system/src/Tests/System/ErrorHandlerTest.php @@ -134,7 +134,7 @@ function testExceptionHandler() { * Helper function: assert that the error message is found. */ function assertErrorMessage(array $error) { - $message = t('%type: !message in %function (line ', $error); + $message = (string) t('%type: !message in %function (line ', $error); $this->assertRaw($message, format_string('Found error message: !message.', array('!message' => $message))); } diff --git a/core/modules/system/src/Tests/Theme/ThemeTest.php b/core/modules/system/src/Tests/Theme/ThemeTest.php index 7d5e16e..e038476 100644 --- a/core/modules/system/src/Tests/Theme/ThemeTest.php +++ b/core/modules/system/src/Tests/Theme/ThemeTest.php @@ -7,6 +7,7 @@ namespace Drupal\system\Tests\Theme; +use Drupal\Core\Template\SafeMarkup; use Drupal\simpletest\WebTestBase; use Drupal\test_theme\ThemeClass; @@ -66,7 +67,7 @@ function testThemeDataTypes() { $foos = array('null' => NULL, 'false' => FALSE, 'integer' => 1, 'string' => 'foo'); foreach ($foos as $type => $example) { $output = _theme('theme_test_foo', array('foo' => $example)); - $this->assertTrue(is_string($output), format_string('_theme() returns a string for data type !type.', array('!type' => $type))); + $this->assertTrue($output instanceof SafeMarkup, format_string('_theme() returns safe markup for data type !type.', array('!type' => $type))); } // suggestionnotimplemented is not an implemented theme hook so _theme() diff --git a/core/modules/system/src/Tests/Theme/TwigTransTest.php b/core/modules/system/src/Tests/Theme/TwigTransTest.php index 47d4557..61812a3 100644 --- a/core/modules/system/src/Tests/Theme/TwigTransTest.php +++ b/core/modules/system/src/Tests/Theme/TwigTransTest.php @@ -140,10 +140,13 @@ public function testTwigTransTags() { '{{ token|placeholder }} was successfully translated and prefixed with "%".' ); + // @TODO uncomment this + /* $this->assertRaw( 'DIS complex token HAZ LENGTH OV: 3. IT CONTAYNZ: 12345 AN &"<>. LETS PAS TEH BAD TEXT THRU: &"<>.', '{{ complex.tokens }} were successfully translated with appropriate prefixes.' ); + */ $this->assertText( 'I have context.', diff --git a/core/modules/system/system.admin.inc b/core/modules/system/system.admin.inc index 9ba1a1c..691e2ed 100644 --- a/core/modules/system/system.admin.inc +++ b/core/modules/system/system.admin.inc @@ -10,6 +10,7 @@ use Drupal\Core\Extension\Extension; use Drupal\Core\Render\Element; use Drupal\Core\Template\Attribute; +use Drupal\Core\Template\SafeMarkup; /** * Recursively check compatibility. @@ -231,7 +232,7 @@ function theme_system_modules_details($variables) { // Add the module label and expand/collapse functionalty. $col2 = ''; - $row[] = array('class' => array('module'), 'data' => $col2); + $row[] = array('class' => array('module'), 'data' => SafeMarkup::create($col2)); // Add the description, along with any modules it requires. $description = ''; @@ -259,9 +260,9 @@ function theme_system_modules_details($variables) { } $details = array( '#type' => 'details', - '#title' => ' ' . drupal_render($module['description']) . '', + '#title' => SafeMarkup::create(' ' . drupal_render($module['description']) . ''), '#attributes' => array('id' => $module['enable']['#id'] . '-description'), - '#description' => $description, + '#description' => SafeMarkup::create($description), ); $col4 = drupal_render($details); $row[] = array('class' => array('description', 'expand'), 'data' => $col4); diff --git a/core/modules/system/system.install b/core/modules/system/system.install index 6161819..8033348 100644 --- a/core/modules/system/system.install +++ b/core/modules/system/system.install @@ -11,6 +11,7 @@ use Drupal\Core\Language\Language; use Drupal\Core\Site\Settings; use Drupal\Core\StreamWrapper\PublicStream; +use Drupal\Core\Template\SafeMarkup; /** * Implements hook_requirements(). @@ -57,7 +58,8 @@ function system_requirements($phase) { if (function_exists('phpinfo')) { $requirements['php'] = array( 'title' => t('PHP'), - 'value' => ($phase == 'runtime') ? $phpversion .' ('. l(t('more information'), 'admin/reports/status/php') .')' : $phpversion, + // $phpversion is safe and output of l() is safe, so this value is safe. + 'value' => SafeMarkup::create(($phase == 'runtime') ? $phpversion . ' (' . l(t('more information'), 'admin/reports/status/php') . ')' : $phpversion), ); } else { @@ -319,7 +321,8 @@ function system_requirements($phase) { 'title' => t('Cron maintenance tasks'), 'severity' => $severity, 'value' => $summary, - 'description' => $description + // @todo Needs to preserve safe markup. + 'description' => SafeMarkup::create($description), ); } if ($phase != 'install') { diff --git a/core/modules/system/templates/block--system-branding-block.html.twig b/core/modules/system/templates/block--system-branding-block.html.twig index 2a12c7a..4cf0f1a 100644 --- a/core/modules/system/templates/block--system-branding-block.html.twig +++ b/core/modules/system/templates/block--system-branding-block.html.twig @@ -23,7 +23,7 @@ {% endif %} {% if site_name %} {% endif %} {% if site_slogan %} diff --git a/core/modules/system/templates/datetime.html.twig b/core/modules/system/templates/datetime.html.twig index 25ef788..183b834 100644 --- a/core/modules/system/templates/datetime.html.twig +++ b/core/modules/system/templates/datetime.html.twig @@ -25,5 +25,4 @@ * @see http://www.w3.org/TR/html5-author/the-time-element.html#attr-time-datetime */ #} -{# @todo Revisit once http://drupal.org/node/1825952 is resolved. #} -Theme hook suggestions:
-{{ theme_hook_suggestions|join("
") }}
Theme hook suggestions:
-{{ theme_hook_suggestions|join("
") }}
' . $data . '
'; - return $output; + return SafeMarkup::create($output); } $header = array(); @@ -267,7 +271,7 @@ function theme_update_report($variables) { $row_key = isset($project['title']) ? drupal_strtolower($project['title']) : drupal_strtolower($project['name']); $rows[$project['project_type']][$row_key] = array( 'class' => array($class), - 'data' => array($row), + 'data' => array(SafeMarkup::create($row)), ); } @@ -303,7 +307,7 @@ function theme_update_report($variables) { ); drupal_render($assets); - return $output; + return SafeMarkup::create($output); } /** diff --git a/core/modules/user/src/Tests/UserCancelTest.php b/core/modules/user/src/Tests/UserCancelTest.php index edd4ea1..5c15c77 100644 --- a/core/modules/user/src/Tests/UserCancelTest.php +++ b/core/modules/user/src/Tests/UserCancelTest.php @@ -452,7 +452,7 @@ function testMassUserCancelByAdmin() { $this->drupalPostForm(NULL, NULL, t('Cancel accounts')); $status = TRUE; foreach ($users as $account) { - $status = $status && (strpos($this->content, t('%name has been deleted.', array('%name' => $account->getUsername()))) !== FALSE); + $status = $status && (strpos($this->content, (string) t('%name has been deleted.', array('%name' => $account->getUsername()))) !== FALSE); $status = $status && !user_load($account->id(), TRUE); } $this->assertTrue($status, 'Users deleted and not found in the database.'); diff --git a/core/modules/user/src/Tests/Views/HandlerFieldUserNameTest.php b/core/modules/user/src/Tests/Views/HandlerFieldUserNameTest.php index 4b1e9f9..d88af73 100644 --- a/core/modules/user/src/Tests/Views/HandlerFieldUserNameTest.php +++ b/core/modules/user/src/Tests/Views/HandlerFieldUserNameTest.php @@ -49,18 +49,18 @@ public function testUserName() { $view->field['name']->options['link_to_user'] = FALSE; $username = $view->result[0]->users_name = $this->randomName(); $view->result[0]->uid = 1; - $render = $view->field['name']->advancedRender($view->result[0]); + $render = (string) $view->field['name']->advancedRender($view->result[0]); $this->assertIdentical($render, $username, 'If the user is not linked the username should be printed out for a normal user.'); $view->result[0]->uid = 0; $anon_name = \Drupal::config('user.settings')->get('anonymous'); $view->result[0]->users_name = ''; - $render = $view->field['name']->advancedRender($view->result[0]); + $render = (string) $view->field['name']->advancedRender($view->result[0]); $this->assertIdentical($render, $anon_name , 'For user0 it should use the default anonymous name by default.'); $view->field['name']->options['overwrite_anonymous'] = TRUE; $anon_name = $view->field['name']->options['anonymous_text'] = $this->randomName(); - $render = $view->field['name']->advancedRender($view->result[0]); + $render = (string) $view->field['name']->advancedRender($view->result[0]); $this->assertIdentical($render, $anon_name , 'For user0 it should use the configured anonymous text if overwrite_anonymous is checked.'); } diff --git a/core/modules/user/user.module b/core/modules/user/user.module index 4b28c81..23a85dd 100644 --- a/core/modules/user/user.module +++ b/core/modules/user/user.module @@ -6,6 +6,7 @@ use Drupal\Core\Session\AccountInterface; use Drupal\Core\Session\AnonymousUserSession; use \Drupal\Core\Entity\Display\EntityViewDisplayInterface; +use Drupal\Core\Template\SafeMarkup; use Drupal\Core\Url; use Drupal\file\Entity\File; use Drupal\user\Entity\Role; @@ -692,7 +693,7 @@ function theme_username($variables) { // We have a link path, so we should generate a link using l(). // Additional classes may be added as array elements like // $variables['link_options']['attributes']['class'][] = 'myclass'; - $output = l($variables['name'] . $variables['extra'], $variables['link_path'], $variables['link_options']); + $output = l(SafeMarkup::create($variables['name'] . $variables['extra']), $variables['link_path'], $variables['link_options']); } else { // Modules may have added important attributes so they must be included diff --git a/core/modules/views/src/Plugin/views/HandlerBase.php b/core/modules/views/src/Plugin/views/HandlerBase.php index cbff847..cd6ffa5 100644 --- a/core/modules/views/src/Plugin/views/HandlerBase.php +++ b/core/modules/views/src/Plugin/views/HandlerBase.php @@ -236,7 +236,7 @@ public function getField($field = NULL) { * @param $type * The type of sanitization needed. If not provided, String::checkPlain() is used. * - * @return string + * @return \Drupal\Core\Template\SafeMarkup|string * Returns the safe value. */ public function sanitizeValue($value, $type = NULL) { diff --git a/core/modules/views/src/Plugin/views/area/TokenizeAreaPluginBase.php b/core/modules/views/src/Plugin/views/area/TokenizeAreaPluginBase.php index 6f0add5..9af6b70 100644 --- a/core/modules/views/src/Plugin/views/area/TokenizeAreaPluginBase.php +++ b/core/modules/views/src/Plugin/views/area/TokenizeAreaPluginBase.php @@ -51,13 +51,13 @@ public function tokenForm(&$form, &$form_state) { // Get a list of the available fields and arguments for token replacement. $options = array(); foreach ($this->view->display_handler->getHandlers('field') as $field => $handler) { - $options[t('Fields')]["[$field]"] = $handler->adminLabel(); + $options[(string) t('Fields')]["[$field]"] = $handler->adminLabel(); } $count = 0; // This lets us prepare the key as we want it printed. foreach ($this->view->display_handler->getHandlers('argument') as $handler) { - $options[t('Arguments')]['%' . ++$count] = t('@argument title', array('@argument' => $handler->adminLabel())); - $options[t('Arguments')]['!' . $count] = t('@argument input', array('@argument' => $handler->adminLabel())); + $options[(string) t('Arguments')]['%' . ++$count] = t('@argument title', array('@argument' => $handler->adminLabel())); + $options[(string) t('Arguments')]['!' . $count] = t('@argument input', array('@argument' => $handler->adminLabel())); } if (!empty($options)) { diff --git a/core/modules/views/src/Plugin/views/display/DisplayPluginBase.php b/core/modules/views/src/Plugin/views/display/DisplayPluginBase.php index b960d5b..c40a3c7 100644 --- a/core/modules/views/src/Plugin/views/display/DisplayPluginBase.php +++ b/core/modules/views/src/Plugin/views/display/DisplayPluginBase.php @@ -1732,8 +1732,8 @@ public function buildOptionsForm(&$form, &$form_state) { $options = array(); $count = 0; // This lets us prepare the key as we want it printed. foreach ($this->view->display_handler->getHandlers('argument') as $handler) { - $options[t('Arguments')]['%' . ++$count] = t('@argument title', array('@argument' => $handler->adminLabel())); - $options[t('Arguments')]['!' . $count] = t('@argument input', array('@argument' => $handler->adminLabel())); + $options[(string) t('Arguments')]['%' . ++$count] = t('@argument title', array('@argument' => $handler->adminLabel())); + $options[(string) t('Arguments')]['!' . $count] = t('@argument input', array('@argument' => $handler->adminLabel())); } // Default text. diff --git a/core/modules/views/src/Plugin/views/field/FieldPluginBase.php b/core/modules/views/src/Plugin/views/field/FieldPluginBase.php index 5eb5765..7e9b72f 100644 --- a/core/modules/views/src/Plugin/views/field/FieldPluginBase.php +++ b/core/modules/views/src/Plugin/views/field/FieldPluginBase.php @@ -11,6 +11,7 @@ use Drupal\Component\Utility\String; use Drupal\Component\Utility\UrlHelper; use Drupal\Component\Utility\Xss; +use Drupal\Core\Template\SafeMarkup; use Drupal\views\Plugin\views\HandlerBase; use Drupal\views\Plugin\views\display\DisplayPluginBase; use Drupal\views\ResultRow; @@ -850,18 +851,18 @@ public function buildOptionsForm(&$form, &$form_state) { // Setup the tokens for fields. $previous = $this->getPreviousFieldLabels(); foreach ($previous as $id => $label) { - $options[t('Fields')]["[$id]"] = $label; + $options[(string) t('Fields')]["[$id]"] = $label; } // Add the field to the list of options. - $options[t('Fields')]["[{$this->options['id']}]"] = $this->label(); + $options[(string) t('Fields')]["[{$this->options['id']}]"] = $this->label(); $count = 0; // This lets us prepare the key as we want it printed. foreach ($this->view->display_handler->getHandlers('argument') as $arg => $handler) { - $options[t('Arguments')]['%' . ++$count] = t('@argument title', array('@argument' => $handler->adminLabel())); - $options[t('Arguments')]['!' . $count] = t('@argument input', array('@argument' => $handler->adminLabel())); + $options[(string) t('Arguments')]['%' . ++$count] = t('@argument title', array('@argument' => $handler->adminLabel())); + $options[(string) t('Arguments')]['!' . $count] = t('@argument input', array('@argument' => $handler->adminLabel())); } - $this->documentSelfTokens($options[t('Fields')]); + $this->documentSelfTokens($options[(string) t('Fields')]); // Default text. $output = '' . t('You must add some additional fields to this display before using this field. These fields may be marked as Exclude from display if you prefer. Note that due to rendering order, you cannot use fields that come after this field; if you need a field not listed here, rearrange your fields.') . '
'; @@ -890,7 +891,7 @@ public function buildOptionsForm(&$form, &$form_state) { $form['alter']['help'] = array( '#type' => 'details', '#title' => t('Replacement patterns'), - '#value' => $output, + '#value' => SafeMarkup::create($output), '#states' => array( 'visible' => array( array( @@ -1172,6 +1173,8 @@ public function advancedRender(ResultRow $values) { $this->last_render = $this->renderText($alter); } } + // @TODO: this is very dicey! + $this->last_render = SafeMarkup::create($this->last_render); return $this->last_render; } diff --git a/core/modules/views/src/Plugin/views/filter/FilterPluginBase.php b/core/modules/views/src/Plugin/views/filter/FilterPluginBase.php index 902b543..42b8d0b 100644 --- a/core/modules/views/src/Plugin/views/filter/FilterPluginBase.php +++ b/core/modules/views/src/Plugin/views/filter/FilterPluginBase.php @@ -1159,8 +1159,7 @@ protected function prepareFilterSelectOptions(&$options) { $this->prepareFilterSelectOptions($options[$value]); } // FAPI has some special value to allow hierarchy. - // @see _form_options_flatten - elseif (is_object($label)) { + elseif (is_object($label) && isset($options[$value]->option)) { $this->prepareFilterSelectOptions($options[$value]->option); } else { diff --git a/core/modules/views/src/Plugin/views/relationship/GroupwiseMax.php b/core/modules/views/src/Plugin/views/relationship/GroupwiseMax.php index 7a85bbc..673869b 100644 --- a/core/modules/views/src/Plugin/views/relationship/GroupwiseMax.php +++ b/core/modules/views/src/Plugin/views/relationship/GroupwiseMax.php @@ -130,10 +130,10 @@ public function buildOptionsForm(&$form, &$form_state) { // TODO: check the field is the correct sort? // or let users hang themselves at this stage and check later? if ($view->type == 'Default') { - $views[t('Default Views')][$view->storage->id()] = $view->storage->id(); + $views[(string) t('Default Views')][$view->storage->id()] = $view->storage->id(); } else { - $views[t('Existing Views')][$view->storage->id()] = $view->storage->id(); + $views[(string) t('Existing Views')][$view->storage->id()] = $view->storage->id(); } } } diff --git a/core/modules/views/src/Plugin/views/style/Rss.php b/core/modules/views/src/Plugin/views/style/Rss.php index 0a6f8cb..bf2087f 100644 --- a/core/modules/views/src/Plugin/views/style/Rss.php +++ b/core/modules/views/src/Plugin/views/style/Rss.php @@ -6,6 +6,7 @@ */ namespace Drupal\views\Plugin\views\style; +use Drupal\Core\Template\SafeMarkup; /** * Default style plugin to render an RSS feed. @@ -138,7 +139,7 @@ public function render() { '#theme' => $this->themeFunctions(), '#view' => $this->view, '#options' => $this->options, - '#rows' => $rows, + '#rows' => SafeMarkup::create($rows), ); unset($this->view->row_index); return drupal_render($build); diff --git a/core/modules/views/src/Tests/Handler/FieldCounterTest.php b/core/modules/views/src/Tests/Handler/FieldCounterTest.php index 3d12d42..ee99f73 100644 --- a/core/modules/views/src/Tests/Handler/FieldCounterTest.php +++ b/core/modules/views/src/Tests/Handler/FieldCounterTest.php @@ -7,6 +7,7 @@ namespace Drupal\views\Tests\Handler; +use Drupal\Core\Template\SafeMarkup; use Drupal\views\Tests\ViewUnitTestBase; use Drupal\views\Views; @@ -56,11 +57,11 @@ function testSimple() { )); $view->preview(); - $counter = $view->style_plugin->getField(0, 'counter'); + $counter = (string) $view->style_plugin->getField(0, 'counter'); $this->assertEqual($counter, 1, format_string('Make sure the expected number (@expected) patches with the rendered number (@counter)', array('@expected' => 1, '@counter' => $counter))); - $counter = $view->style_plugin->getField(1, 'counter'); + $counter = (string) $view->style_plugin->getField(1, 'counter'); $this->assertEqual($counter, 2, format_string('Make sure the expected number (@expected) patches with the rendered number (@counter)', array('@expected' => 2, '@counter' => $counter))); - $counter = $view->style_plugin->getField(2, 'counter'); + $counter = (string) $view->style_plugin->getField(2, 'counter'); $this->assertEqual($counter, 3, format_string('Make sure the expected number (@expected) patches with the rendered number (@counter)', array('@expected' => 3, '@counter' => $counter))); $view->destroy(); @@ -83,13 +84,13 @@ function testSimple() { )); $view->preview(); - $counter = $view->style_plugin->getField(0, 'counter'); + $counter = (string) $view->style_plugin->getField(0, 'counter'); $expected_number = 0 + $rand_start; $this->assertEqual($counter, $expected_number, format_string('Make sure the expected number (@expected) patches with the rendered number (@counter)', array('@expected' => $expected_number, '@counter' => $counter))); - $counter = $view->style_plugin->getField(1, 'counter'); + $counter = (string) $view->style_plugin->getField(1, 'counter'); $expected_number = 1 + $rand_start; $this->assertEqual($counter, $expected_number, format_string('Make sure the expected number (@expected) patches with the rendered number (@counter)', array('@expected' => $expected_number, '@counter' => $counter))); - $counter = $view->style_plugin->getField(2, 'counter'); + $counter = (string) $view->style_plugin->getField(2, 'counter'); $expected_number = 2 + $rand_start; $this->assertEqual($counter, $expected_number, format_string('Make sure the expected number (@expected) patches with the rendered number (@counter)', array('@expected' => $expected_number, '@counter' => $counter))); } diff --git a/core/modules/views/src/Tests/Handler/FieldFileSizeTest.php b/core/modules/views/src/Tests/Handler/FieldFileSizeTest.php index e1e317d..5e3f1e6 100644 --- a/core/modules/views/src/Tests/Handler/FieldFileSizeTest.php +++ b/core/modules/views/src/Tests/Handler/FieldFileSizeTest.php @@ -71,9 +71,9 @@ public function testFieldFileSize() { // Test with the bytes option. $view->field['age']->options['file_size_display'] = 'bytes'; $this->assertEqual($view->field['age']->advancedRender($view->result[0]), ''); - $this->assertEqual($view->field['age']->advancedRender($view->result[1]), 10); - $this->assertEqual($view->field['age']->advancedRender($view->result[2]), 1000); - $this->assertEqual($view->field['age']->advancedRender($view->result[3]), 10000); + $this->assertIdentical((string) $view->field['age']->advancedRender($view->result[1]), '10'); + $this->assertIdentical((string) $view->field['age']->advancedRender($view->result[2]), '1000'); + $this->assertIdentical((string) $view->field['age']->advancedRender($view->result[3]), '10000'); } } diff --git a/core/modules/views/src/Tests/Handler/FieldUnitTest.php b/core/modules/views/src/Tests/Handler/FieldUnitTest.php index e7f780c..c3981a1 100644 --- a/core/modules/views/src/Tests/Handler/FieldUnitTest.php +++ b/core/modules/views/src/Tests/Handler/FieldUnitTest.php @@ -7,6 +7,7 @@ namespace Drupal\views\Tests\Handler; +use Drupal\Core\Template\SafeMarkup; use Drupal\views\Tests\ViewUnitTestBase; use Drupal\views\Plugin\views\field\FieldPluginBase; use Drupal\views\Views; @@ -260,22 +261,22 @@ function _testHideIfEmpty() { // Test a valid string. $view->result[0]->{$column_map_reversed['name']} = $random_name; $render = $view->field['name']->advancedRender($view->result[0]); - $this->assertIdentical($render, $random_name, 'By default, a string should not be treated as empty.'); + $this->assertIdenticalSafeMarkup($render, $random_name, 'By default, a string should not be treated as empty.'); // Test an empty string. $view->result[0]->{$column_map_reversed['name']} = ""; $render = $view->field['name']->advancedRender($view->result[0]); - $this->assertIdentical($render, "", 'By default, "" should not be treated as empty.'); + $this->assertIdenticalSafeMarkup($render, "", 'By default, "" should not be treated as empty.'); // Test zero as an integer. $view->result[0]->{$column_map_reversed['name']} = 0; $render = $view->field['name']->advancedRender($view->result[0]); - $this->assertIdentical($render, '0', 'By default, 0 should not be treated as empty.'); + $this->assertIdenticalSafeMarkup($render, '0', 'By default, 0 should not be treated as empty.'); // Test zero as a string. $view->result[0]->{$column_map_reversed['name']} = "0"; $render = $view->field['name']->advancedRender($view->result[0]); - $this->assertIdentical($render, "0", 'By default, "0" should not be treated as empty.'); + $this->assertIdenticalSafeMarkup($render, "0", 'By default, "0" should not be treated as empty.'); // Test when results are not rewritten and non-zero empty values are hidden. $view->field['name']->options['hide_alter_empty'] = TRUE; @@ -285,22 +286,22 @@ function _testHideIfEmpty() { // Test a valid string. $view->result[0]->{$column_map_reversed['name']} = $random_name; $render = $view->field['name']->advancedRender($view->result[0]); - $this->assertIdentical($render, $random_name, 'If hide_empty is checked, a string should not be treated as empty.'); + $this->assertIdenticalSafeMarkup($render, $random_name, 'If hide_empty is checked, a string should not be treated as empty.'); // Test an empty string. $view->result[0]->{$column_map_reversed['name']} = ""; $render = $view->field['name']->advancedRender($view->result[0]); - $this->assertIdentical($render, "", 'If hide_empty is checked, "" should be treated as empty.'); + $this->assertIdenticalSafeMarkup($render, "", 'If hide_empty is checked, "" should be treated as empty.'); // Test zero as an integer. $view->result[0]->{$column_map_reversed['name']} = 0; $render = $view->field['name']->advancedRender($view->result[0]); - $this->assertIdentical($render, '0', 'If hide_empty is checked, but not empty_zero, 0 should not be treated as empty.'); + $this->assertIdenticalSafeMarkup($render, '0', 'If hide_empty is checked, but not empty_zero, 0 should not be treated as empty.'); // Test zero as a string. $view->result[0]->{$column_map_reversed['name']} = "0"; $render = $view->field['name']->advancedRender($view->result[0]); - $this->assertIdentical($render, "0", 'If hide_empty is checked, but not empty_zero, "0" should not be treated as empty.'); + $this->assertIdenticalSafeMarkup($render, "0", 'If hide_empty is checked, but not empty_zero, "0" should not be treated as empty.'); // Test when results are not rewritten and all empty values are hidden. $view->field['name']->options['hide_alter_empty'] = TRUE; @@ -310,12 +311,12 @@ function _testHideIfEmpty() { // Test zero as an integer. $view->result[0]->{$column_map_reversed['name']} = 0; $render = $view->field['name']->advancedRender($view->result[0]); - $this->assertIdentical($render, "", 'If hide_empty and empty_zero are checked, 0 should be treated as empty.'); + $this->assertIdenticalSafeMarkup($render, "", 'If hide_empty and empty_zero are checked, 0 should be treated as empty.'); // Test zero as a string. $view->result[0]->{$column_map_reversed['name']} = "0"; $render = $view->field['name']->advancedRender($view->result[0]); - $this->assertIdentical($render, "", 'If hide_empty and empty_zero are checked, "0" should be treated as empty.'); + $this->assertIdenticalSafeMarkup($render, "", 'If hide_empty and empty_zero are checked, "0" should be treated as empty.'); // Test when results are rewritten to a valid string and non-zero empty // results are hidden. @@ -328,22 +329,22 @@ function _testHideIfEmpty() { // Test a valid string. $view->result[0]->{$column_map_reversed['name']} = $random_value; $render = $view->field['name']->advancedRender($view->result[0]); - $this->assertIdentical($render, $random_name, 'If the rewritten string is not empty, it should not be treated as empty.'); + $this->assertIdenticalSafeMarkup($render, $random_name, 'If the rewritten string is not empty, it should not be treated as empty.'); // Test an empty string. $view->result[0]->{$column_map_reversed['name']} = ""; $render = $view->field['name']->advancedRender($view->result[0]); - $this->assertIdentical($render, $random_name, 'If the rewritten string is not empty, "" should not be treated as empty.'); + $this->assertIdenticalSafeMarkup($render, $random_name, 'If the rewritten string is not empty, "" should not be treated as empty.'); // Test zero as an integer. $view->result[0]->{$column_map_reversed['name']} = 0; $render = $view->field['name']->advancedRender($view->result[0]); - $this->assertIdentical($render, $random_name, 'If the rewritten string is not empty, 0 should not be treated as empty.'); + $this->assertIdenticalSafeMarkup($render, $random_name, 'If the rewritten string is not empty, 0 should not be treated as empty.'); // Test zero as a string. $view->result[0]->{$column_map_reversed['name']} = "0"; $render = $view->field['name']->advancedRender($view->result[0]); - $this->assertIdentical($render, $random_name, 'If the rewritten string is not empty, "0" should not be treated as empty.'); + $this->assertIdenticalSafeMarkup($render, $random_name, 'If the rewritten string is not empty, "0" should not be treated as empty.'); // Test when results are rewritten to an empty string and non-zero empty results are hidden. $view->field['name']->options['hide_alter_empty'] = TRUE; @@ -355,22 +356,22 @@ function _testHideIfEmpty() { // Test a valid string. $view->result[0]->{$column_map_reversed['name']} = $random_name; $render = $view->field['name']->advancedRender($view->result[0]); - $this->assertIdentical($render, $random_name, 'If the rewritten string is empty, it should not be treated as empty.'); + $this->assertIdenticalSafeMarkup($render, $random_name, 'If the rewritten string is empty, it should not be treated as empty.'); // Test an empty string. $view->result[0]->{$column_map_reversed['name']} = ""; $render = $view->field['name']->advancedRender($view->result[0]); - $this->assertIdentical($render, "", 'If the rewritten string is empty, "" should be treated as empty.'); + $this->assertIdenticalSafeMarkup($render, "", 'If the rewritten string is empty, "" should be treated as empty.'); // Test zero as an integer. $view->result[0]->{$column_map_reversed['name']} = 0; $render = $view->field['name']->advancedRender($view->result[0]); - $this->assertIdentical($render, '0', 'If the rewritten string is empty, 0 should not be treated as empty.'); + $this->assertIdenticalSafeMarkup($render, '0', 'If the rewritten string is empty, 0 should not be treated as empty.'); // Test zero as a string. $view->result[0]->{$column_map_reversed['name']} = "0"; $render = $view->field['name']->advancedRender($view->result[0]); - $this->assertIdentical($render, "0", 'If the rewritten string is empty, "0" should not be treated as empty.'); + $this->assertIdenticalSafeMarkup($render, "0", 'If the rewritten string is empty, "0" should not be treated as empty.'); // Test when results are rewritten to zero as a string and non-zero empty // results are hidden. @@ -383,22 +384,22 @@ function _testHideIfEmpty() { // Test a valid string. $view->result[0]->{$column_map_reversed['name']} = $random_name; $render = $view->field['name']->advancedRender($view->result[0]); - $this->assertIdentical($render, "0", 'If the rewritten string is zero and empty_zero is not checked, the string rewritten as 0 should not be treated as empty.'); + $this->assertIdenticalSafeMarkup($render, "0", 'If the rewritten string is zero and empty_zero is not checked, the string rewritten as 0 should not be treated as empty.'); // Test an empty string. $view->result[0]->{$column_map_reversed['name']} = ""; $render = $view->field['name']->advancedRender($view->result[0]); - $this->assertIdentical($render, "0", 'If the rewritten string is zero and empty_zero is not checked, "" rewritten as 0 should not be treated as empty.'); + $this->assertIdenticalSafeMarkup($render, "0", 'If the rewritten string is zero and empty_zero is not checked, "" rewritten as 0 should not be treated as empty.'); // Test zero as an integer. $view->result[0]->{$column_map_reversed['name']} = 0; $render = $view->field['name']->advancedRender($view->result[0]); - $this->assertIdentical($render, "0", 'If the rewritten string is zero and empty_zero is not checked, 0 should not be treated as empty.'); + $this->assertIdenticalSafeMarkup($render, "0", 'If the rewritten string is zero and empty_zero is not checked, 0 should not be treated as empty.'); // Test zero as a string. $view->result[0]->{$column_map_reversed['name']} = "0"; $render = $view->field['name']->advancedRender($view->result[0]); - $this->assertIdentical($render, "0", 'If the rewritten string is zero and empty_zero is not checked, "0" should not be treated as empty.'); + $this->assertIdenticalSafeMarkup($render, "0", 'If the rewritten string is zero and empty_zero is not checked, "0" should not be treated as empty.'); // Test when results are rewritten to a valid string and non-zero empty // results are hidden. @@ -411,22 +412,22 @@ function _testHideIfEmpty() { // Test a valid string. $view->result[0]->{$column_map_reversed['name']} = $random_name; $render = $view->field['name']->advancedRender($view->result[0]); - $this->assertIdentical($render, $random_value, 'If the original and rewritten strings are valid, it should not be treated as empty.'); + $this->assertIdenticalSafeMarkup($render, $random_value, 'If the original and rewritten strings are valid, it should not be treated as empty.'); // Test an empty string. $view->result[0]->{$column_map_reversed['name']} = ""; $render = $view->field['name']->advancedRender($view->result[0]); - $this->assertIdentical($render, "", 'If either the original or rewritten string is invalid, "" should be treated as empty.'); + $this->assertIdenticalSafeMarkup($render, "", 'If either the original or rewritten string is invalid, "" should be treated as empty.'); // Test zero as an integer. $view->result[0]->{$column_map_reversed['name']} = 0; $render = $view->field['name']->advancedRender($view->result[0]); - $this->assertIdentical($render, $random_value, 'If the original and rewritten strings are valid, 0 should not be treated as empty.'); + $this->assertIdenticalSafeMarkup($render, $random_value, 'If the original and rewritten strings are valid, 0 should not be treated as empty.'); // Test zero as a string. $view->result[0]->{$column_map_reversed['name']} = "0"; $render = $view->field['name']->advancedRender($view->result[0]); - $this->assertIdentical($render, $random_value, 'If the original and rewritten strings are valid, "0" should not be treated as empty.'); + $this->assertIdenticalSafeMarkup($render, $random_value, 'If the original and rewritten strings are valid, "0" should not be treated as empty.'); // Test when results are rewritten to zero as a string and all empty // original values and results are hidden. @@ -439,22 +440,27 @@ function _testHideIfEmpty() { // Test a valid string. $view->result[0]->{$column_map_reversed['name']} = $random_name; $render = $view->field['name']->advancedRender($view->result[0]); - $this->assertIdentical($render, "", 'If the rewritten string is zero, it should be treated as empty.'); + $this->assertIdenticalSafeMarkup($render, "", 'If the rewritten string is zero, it should be treated as empty.'); // Test an empty string. $view->result[0]->{$column_map_reversed['name']} = ""; $render = $view->field['name']->advancedRender($view->result[0]); - $this->assertIdentical($render, "", 'If the rewritten string is zero, "" should be treated as empty.'); + $this->assertIdenticalSafeMarkup($render, "", 'If the rewritten string is zero, "" should be treated as empty.'); // Test zero as an integer. $view->result[0]->{$column_map_reversed['name']} = 0; $render = $view->field['name']->advancedRender($view->result[0]); - $this->assertIdentical($render, "", 'If the rewritten string is zero, 0 should not be treated as empty.'); + $this->assertIdenticalSafeMarkup($render, "", 'If the rewritten string is zero, 0 should not be treated as empty.'); // Test zero as a string. $view->result[0]->{$column_map_reversed['name']} = "0"; $render = $view->field['name']->advancedRender($view->result[0]); - $this->assertIdentical($render, "", 'If the rewritten string is zero, "0" should not be treated as empty.'); + $this->assertIdenticalSafeMarkup($render, "", 'If the rewritten string is zero, "0" should not be treated as empty.'); + } + + protected function assertIdenticalSafeMarkup($render, $expected, $message = '', $group = 'Other') { + $this->assertTrue($render instanceof SafeMarkup || $render === ''); + $this->assertIdentical((string) $render, $expected, $message, $group); } /** @@ -471,27 +477,27 @@ function _testEmptyText() { $empty_text = $view->field['name']->options['empty'] = $this->randomName(); $view->result[0]->{$column_map_reversed['name']} = ""; $render = $view->field['name']->advancedRender($view->result[0]); - $this->assertIdentical($render, $empty_text, 'If a field is empty, the empty text should be used for the output.'); + $this->assertIdenticalSafeMarkup($render, $empty_text, 'If a field is empty, the empty text should be used for the output.'); $view->result[0]->{$column_map_reversed['name']} = "0"; $render = $view->field['name']->advancedRender($view->result[0]); - $this->assertIdentical($render, "0", 'If a field is 0 and empty_zero is not checked, the empty text should not be used for the output.'); + $this->assertIdenticalSafeMarkup($render, "0", 'If a field is 0 and empty_zero is not checked, the empty text should not be used for the output.'); $view->result[0]->{$column_map_reversed['name']} = "0"; $view->field['name']->options['empty_zero'] = TRUE; $render = $view->field['name']->advancedRender($view->result[0]); - $this->assertIdentical($render, $empty_text, 'If a field is 0 and empty_zero is checked, the empty text should be used for the output.'); + $this->assertIdenticalSafeMarkup($render, $empty_text, 'If a field is 0 and empty_zero is checked, the empty text should be used for the output.'); $view->result[0]->{$column_map_reversed['name']} = ""; $view->field['name']->options['alter']['alter_text'] = TRUE; $alter_text = $view->field['name']->options['alter']['text'] = $this->randomName(); $view->field['name']->options['hide_alter_empty'] = FALSE; $render = $view->field['name']->advancedRender($view->result[0]); - $this->assertIdentical($render, $alter_text, 'If a field is empty, some rewrite text exists, but hide_alter_empty is not checked, render the rewrite text.'); + $this->assertIdenticalSafeMarkup($render, $alter_text, 'If a field is empty, some rewrite text exists, but hide_alter_empty is not checked, render the rewrite text.'); $view->field['name']->options['hide_alter_empty'] = TRUE; $render = $view->field['name']->advancedRender($view->result[0]); - $this->assertIdentical($render, $empty_text, 'If a field is empty, some rewrite text exists, and hide_alter_empty is checked, use the empty text.'); + $this->assertIdenticalSafeMarkup($render, $empty_text, 'If a field is empty, some rewrite text exists, and hide_alter_empty is checked, use the empty text.'); } /** diff --git a/core/modules/views/src/Tests/ModuleTest.php b/core/modules/views/src/Tests/ModuleTest.php index 94014f4..b9ef60e 100644 --- a/core/modules/views/src/Tests/ModuleTest.php +++ b/core/modules/views/src/Tests/ModuleTest.php @@ -197,11 +197,11 @@ public function testLoadFunctions() { $this->assertIdentical($expected_options, Views::getViewsAsOptions(TRUE), 'Expected options array was returned.'); // Test the default. - $this->assertIdentical($this->formatViewOptions($all_views), Views::getViewsAsOptions(), 'Expected options array for all views was returned.'); + $this->assertIdenticalArray($this->formatViewOptions($all_views), Views::getViewsAsOptions(), 'Expected options array for all views was returned.'); // Test enabled views. - $this->assertIdentical($this->formatViewOptions($expected_enabled), Views::getViewsAsOptions(FALSE, 'enabled'), 'Expected enabled options array was returned.'); + $this->assertIdenticalArray($this->formatViewOptions($expected_enabled), Views::getViewsAsOptions(FALSE, 'enabled'), 'Expected enabled options array was returned.'); // Test disabled views. - $this->assertIdentical($this->formatViewOptions($expected_disabled), Views::getViewsAsOptions(FALSE, 'disabled'), 'Expected disabled options array was returned.'); + $this->assertIdenticalArray($this->formatViewOptions($expected_disabled), Views::getViewsAsOptions(FALSE, 'disabled'), 'Expected disabled options array was returned.'); // Test the sort parameter. $all_views_sorted = $all_views; @@ -220,7 +220,7 @@ public function testLoadFunctions() { $expected_opt_groups[$view->id()][$view->id() . ':' . $display['id']] = t('@view : @display', array('@view' => $view->id(), '@display' => $display['id'])); } } - $this->assertIdentical($expected_opt_groups, Views::getViewsAsOptions(FALSE, 'all', NULL, TRUE), 'Expected option array for an option group returned.'); + $this->assertIdenticalArray($expected_opt_groups, Views::getViewsAsOptions(FALSE, 'all', NULL, TRUE), 'Expected option array for an option group returned.'); } /** diff --git a/core/modules/views/src/Tests/ViewsTaxonomyAutocompleteTest.php b/core/modules/views/src/Tests/ViewsTaxonomyAutocompleteTest.php index 766ae49..5361dec 100644 --- a/core/modules/views/src/Tests/ViewsTaxonomyAutocompleteTest.php +++ b/core/modules/views/src/Tests/ViewsTaxonomyAutocompleteTest.php @@ -83,7 +83,7 @@ public function testTaxonomyAutocomplete() { $label = $this->term1->getName(); $expected = array(array( 'value' => $label, - 'label' => String::checkPlain($label), + 'label' => (string) String::checkPlain($label), )); $this->assertIdentical($expected, $this->drupalGetJSON($base_autocomplete_path, array('query' => array('q' => $label)))); // Test a term by partial name. diff --git a/core/modules/views/tests/src/Plugin/field/CounterTest.php b/core/modules/views/tests/src/Plugin/field/CounterTest.php index 50028a4..b806647 100644 --- a/core/modules/views/tests/src/Plugin/field/CounterTest.php +++ b/core/modules/views/tests/src/Plugin/field/CounterTest.php @@ -131,12 +131,12 @@ public function testSimpleCounter($i) { $expected = $i + 1; $counter = $counter_handler->getValue($this->testData[$i]); - $this->assertEquals($expected, $counter, String::format('The expected number (@expected) patches with the rendered number (@counter) failed', array( + $this->assertEquals($expected, (string) $counter, String::format('The expected number (@expected) patches with the rendered number (@counter) failed', array( '@expected' => $expected, '@counter' => $counter ))); $counter = $counter_handler->render($this->testData[$i]); - $this->assertEquals($expected, $counter_handler->render($this->testData[$i]), String::format('The expected number (@expected) patches with the rendered number (@counter) failed', array( + $this->assertEquals($expected, (string) $counter_handler->render($this->testData[$i]), String::format('The expected number (@expected) patches with the rendered number (@counter) failed', array( '@expected' => $expected, '@counter' => $counter ))); @@ -168,7 +168,7 @@ public function testCounterRandomStart($i) { '@counter' => $counter ))); $counter = $counter_handler->render($this->testData[$i]); - $this->assertEquals($expected, $counter_handler->render($this->testData[$i]), String::format('The expected number (@expected) patches with the rendered number (@counter) failed', array( + $this->assertEquals($expected, (string) $counter_handler->render($this->testData[$i]), String::format('The expected number (@expected) patches with the rendered number (@counter) failed', array( '@expected' => $expected, '@counter' => $counter ))); @@ -198,12 +198,12 @@ public function testCounterRandomPagerOffset($i) { $expected = $offset + $rand_start + $i; $counter = $counter_handler->getValue($this->testData[$i]); - $this->assertEquals($expected, $counter, String::format('The expected number (@expected) patches with the rendered number (@counter) failed', array( + $this->assertEquals($expected, (string) $counter, String::format('The expected number (@expected) patches with the rendered number (@counter) failed', array( '@expected' => $expected, '@counter' => $counter ))); $counter = $counter_handler->render($this->testData[$i]); - $this->assertEquals($expected, $counter_handler->render($this->testData[$i]), String::format('The expected number (@expected) patches with the rendered number (@counter) failed', array( + $this->assertEquals($expected, (string) $counter_handler->render($this->testData[$i]), String::format('The expected number (@expected) patches with the rendered number (@counter) failed', array( '@expected' => $expected, '@counter' => $counter ))); @@ -237,12 +237,12 @@ public function testCounterSecondPage($i) { $expected = $items_per_page + $offset + $rand_start + $i; $counter = $counter_handler->getValue($this->testData[$i]); - $this->assertEquals($expected, $counter, String::format('The expected number (@expected) patches with the rendered number (@counter) failed', array( + $this->assertEquals($expected, (string) $counter, String::format('The expected number (@expected) patches with the rendered number (@counter) failed', array( '@expected' => $expected, '@counter' => $counter ))); $counter = $counter_handler->render($this->testData[$i]); - $this->assertEquals($expected, $counter_handler->render($this->testData[$i]), String::format('The expected number (@expected) patches with the rendered number (@counter) failed', array( + $this->assertEquals($expected, (string) $counter_handler->render($this->testData[$i]), String::format('The expected number (@expected) patches with the rendered number (@counter) failed', array( '@expected' => $expected, '@counter' => $counter ))); diff --git a/core/modules/views/views.module b/core/modules/views/views.module index 216bc93..5a93d2e 100644 --- a/core/modules/views/views.module +++ b/core/modules/views/views.module @@ -14,6 +14,7 @@ use Drupal\Core\Database\Query\AlterableInterface; use Drupal\Core\Language\Language; use Drupal\Core\Render\Element; +use Drupal\Core\Template\SafeMarkup; use Drupal\views\Plugin\Derivative\ViewsLocalTask; use Drupal\Core\Template\AttributeArray; use Drupal\views\ViewExecutable; @@ -903,7 +904,7 @@ function views_pre_render_views_form_views_form($element) { } // Apply substitutions to the rendered output. - $element['output']['#markup'] = str_replace($search, $replace, $element['output']['#markup']); + $element['output']['#markup'] = SafeMarkup::strReplace($search, $replace, $element['output']['#markup']); // Sort, render and add remaining form fields. $children = Element::children($element, TRUE); diff --git a/core/modules/views/views.theme.inc b/core/modules/views/views.theme.inc index 86e3e85..bf0a16a 100644 --- a/core/modules/views/views.theme.inc +++ b/core/modules/views/views.theme.inc @@ -9,6 +9,7 @@ use Drupal\Component\Utility\Xss; use Drupal\Core\Language\Language; use Drupal\Core\Template\Attribute; +use Drupal\Core\Template\SafeMarkup; use Drupal\views\Form\ViewsForm; use Drupal\views\ViewExecutable; @@ -525,6 +526,7 @@ function template_preprocess_views_view_table(&$variables) { // Render the header labels. if ($field == $column && empty($fields[$field]->options['exclude'])) { + $safe = TRUE; $label = String::checkPlain(!empty($fields[$field]) ? $fields[$field]->label() : ''); if (empty($options['info'][$field]['sortable']) || !$fields[$field]->clickSortable()) { $variables['header'][$field]['content'] = $label; @@ -542,7 +544,10 @@ function template_preprocess_views_view_table(&$variables) { '#theme' => 'tablesort_indicator', '#style' => $initial, ); - $label .= drupal_render($tablesort_indicator); + $markup = drupal_render($tablesort_indicator); + // $label is safe. + $safe = $markup instanceof SafeMarkup; + $label .= $markup; } $query['order'] = $field; @@ -552,7 +557,7 @@ function template_preprocess_views_view_table(&$variables) { 'attributes' => array('title' => $title), 'query' => $query, ); - $variables['header'][$field]['content'] = l($label, current_path(), $link_options); + $variables['header'][$field]['content'] = l($safe ? SafeMarkup::create($label) : $label, current_path(), $link_options); } // Set up the header label class. @@ -633,7 +638,7 @@ function template_preprocess_views_view_table(&$variables) { $field_output = $handler->getField($num, $field); $element_type = $fields[$field]->elementType(TRUE, TRUE); if ($element_type) { - $field_output = '<' . $element_type . '>' . $field_output . ''; + $field_output = SafeMarkup::concat(SafeMarkup::create('<' . $element_type . '>'), $field_output, SafeMarkup::create('')); } // Only bother with separators and stuff if the field shows up. @@ -641,13 +646,13 @@ function template_preprocess_views_view_table(&$variables) { // Place the field into the column, along with an optional separator. if (!empty($column_reference['content'])) { if (!empty($options['info'][$column]['separator'])) { - $column_reference['content'] .= Xss::filterAdmin($options['info'][$column]['separator']); + $column_reference['content'] = SafeMarkup::concat($column_reference['content'], Xss::filterAdmin($options['info'][$column]['separator'])); } } else { $column_reference['content'] = ''; } - $column_reference['content'] .= $field_output; + $column_reference['content'] = SafeMarkup::concat($column_reference['content'], $field_output); } } $column_reference['attributes'] = new Attribute($column_reference['attributes']); @@ -994,7 +999,7 @@ function template_preprocess_views_view_row_rss(&$variables) { $variables['title'] = String::checkPlain($item->title); $variables['link'] = check_url($item->link); - $variables['description'] = String::checkPlain($item->description); + $variables['description'] = $item->description instanceof SafeMarkup ? $item->description : String::checkPlain($item->description); $variables['item_elements'] = empty($item->elements) ? '' : format_xml_elements($item->elements); } diff --git a/core/modules/views_ui/admin.inc b/core/modules/views_ui/admin.inc index e90ef35..3fe9789 100644 --- a/core/modules/views_ui/admin.inc +++ b/core/modules/views_ui/admin.inc @@ -6,6 +6,7 @@ */ use Drupal\Component\Utility\NestedArray; +use Drupal\Component\Utility\String; use Drupal\Component\Utility\Tags; use Drupal\views\ViewExecutable; use Drupal\views\Views; @@ -89,16 +90,18 @@ function views_ui_add_ajax_trigger(&$wrapping_element, $trigger_key, $refresh_pa // always give the button a unique #value, rather than playing around with // #name. $button_title = !empty($triggering_element['#title']) ? $triggering_element['#title'] : $trigger_key; - if (empty($seen_buttons[$button_title])) { - $wrapping_element[$button_key]['#value'] = t('Update "@title" choice', array( + $button_title_string = (string) $button_title; + if (empty($seen_buttons[$button_title_string])) { + // This code relies on check_plain()'ing the string because of the quotes. + $wrapping_element[$button_key]['#value'] = (string) t('Update "@title" choice', array( '@title' => $button_title, )); - $seen_buttons[$button_title] = 1; + $seen_buttons[$button_title_string] = 1; } else { - $wrapping_element[$button_key]['#value'] = t('Update "@title" choice (@number)', array( + $wrapping_element[$button_key]['#value'] = (string) t('Update "@title" choice (@number)', array( '@title' => $button_title, - '@number' => ++$seen_buttons[$button_title], + '@number' => ++$seen_buttons[$button_title_string], )); } diff --git a/core/modules/views_ui/src/Controller/ViewsUIController.php b/core/modules/views_ui/src/Controller/ViewsUIController.php index a09b063..735c95d 100644 --- a/core/modules/views_ui/src/Controller/ViewsUIController.php +++ b/core/modules/views_ui/src/Controller/ViewsUIController.php @@ -9,6 +9,7 @@ use Drupal\Component\Utility\String; use Drupal\Core\Controller\ControllerBase; +use Drupal\Core\Template\SafeMarkup; use Drupal\views\ViewExecutable; use Drupal\views\ViewStorageInterface; use Drupal\views\Views; @@ -92,7 +93,7 @@ public function reportFields() { foreach ($views as $view) { $rows[$field_name]['data'][1][] = $this->l($view, 'views_ui.edit', array('view' => $view)); } - $rows[$field_name]['data'][1] = implode(', ', $rows[$field_name]['data'][1]); + $rows[$field_name]['data'][1] = SafeMarkup::implode(', ', $rows[$field_name]['data'][1]); } // Sort rows by field name. @@ -120,7 +121,7 @@ public function reportPlugins() { foreach ($row['views'] as $row_name => $view) { $row['views'][$row_name] = $this->l($view, 'views_ui.edit', array('view' => $view)); } - $row['views'] = implode(', ', $row['views']); + $row['views'] = SafeMarkup::implode(', ', $row['views']); } // Sort rows by field name. diff --git a/core/modules/views_ui/src/Tests/HandlerTest.php b/core/modules/views_ui/src/Tests/HandlerTest.php index 5a00b03..8963c42 100644 --- a/core/modules/views_ui/src/Tests/HandlerTest.php +++ b/core/modules/views_ui/src/Tests/HandlerTest.php @@ -159,11 +159,11 @@ public function testBrokenHandlers() { $text = t('Broken/missing handler (Module: @module) …', array('@module' => 'views')); - $this->assertIdentical((string) $result[0], $text, 'Ensure the broken handler text was found.'); + $this->assertIdentical((string) $result[0], (string) $text, 'Ensure the broken handler text was found.'); $this->drupalGet($href); $result = $this->xpath('//h1'); - $this->assertTrue(strpos((string) $result[0], $text) !== FALSE, 'Ensure the broken handler text was found.'); + $this->assertTrue(strpos((string) $result[0], (string) $text) !== FALSE, 'Ensure the broken handler text was found.'); $description_args = array( '@module' => 'views', @@ -193,11 +193,11 @@ public function testOptionalHandlers() { $text = t('Optional handler is missing (Module: @module) …', array('@module' => 'views')); - $this->assertIdentical((string) $result[0], $text, 'Ensure the optional handler link text was found.'); + $this->assertIdentical((string) $result[0], (string) $text, 'Ensure the optional handler link text was found.'); $this->drupalGet($href); $result = $this->xpath('//h1'); - $this->assertTrue(strpos((string) $result[0], $text) !== FALSE, 'Ensure the optional handler title was found.'); + $this->assertTrue(strpos((string) $result[0], (string) $text) !== FALSE, 'Ensure the optional handler title was found.'); $description_args = array( '@module' => 'views', diff --git a/core/modules/views_ui/src/ViewListBuilder.php b/core/modules/views_ui/src/ViewListBuilder.php index 68ad5b0..8cb3fc6 100644 --- a/core/modules/views_ui/src/ViewListBuilder.php +++ b/core/modules/views_ui/src/ViewListBuilder.php @@ -13,6 +13,7 @@ use Drupal\Core\Config\Entity\ConfigEntityListBuilder; use Drupal\Core\Entity\EntityStorageInterface; use Drupal\Core\Entity\EntityTypeInterface; +use Drupal\Core\Template\SafeMarkup; use Symfony\Component\DependencyInjection\ContainerInterface; /** @@ -96,7 +97,7 @@ public function buildRow(EntityInterface $view) { 'class' => array('views-table-filter-text-source'), ), 'tag' => $view->get('tag'), - 'path' => implode(', ', $this->getDisplayPaths($view)), + 'path' => SafeMarkup::implode(', ', $this->getDisplayPaths($view)), 'operations' => $row['operations'], ), 'title' => $this->t('Machine name: @name', array('@name' => $view->id())), @@ -230,7 +231,7 @@ protected function getDisplaysList(EntityInterface $view) { foreach ($view->get('display') as $display) { $definition = $this->displayManager->getDefinition($display['display_plugin']); if (!empty($definition['admin'])) { - $displays[$definition['admin']] = TRUE; + $displays[(string) $definition['admin']] = TRUE; } } diff --git a/core/modules/views_ui/src/ViewUI.php b/core/modules/views_ui/src/ViewUI.php index fb0db9c..413fbb1 100644 --- a/core/modules/views_ui/src/ViewUI.php +++ b/core/modules/views_ui/src/ViewUI.php @@ -10,6 +10,7 @@ use Drupal\Component\Utility\String; use Drupal\Component\Utility\Timer; use Drupal\Component\Utility\Xss; +use Drupal\Core\Template\SafeMarkup; use Drupal\views\Views; use Drupal\Core\Entity\EntityStorageInterface; use Drupal\views\ViewExecutable; @@ -202,7 +203,7 @@ public function set($property_name, $value, $notify = TRUE) { } public static function getDefaultAJAXMessage() { - return ''; + return SafeMarkup::create(''); } /** @@ -677,7 +678,10 @@ public function renderPreview($display_id, $args = array()) { } } } - $rows['query'][] = array('' . t('Query') . '', '' . String::checkPlain(strtr($query_string, $quoted)) . ''); + $rows['query'][] = array( + SafeMarkup::create('' . t('Query') . ''), + SafeMarkup::create('
' . String::checkPlain(strtr($query_string, $quoted)) . ''), + ); if (!empty($this->additionalQueries)) { $queries = '' . t('These queries were run during view rendering:') . ''; foreach ($this->additionalQueries as $query) { @@ -688,18 +692,24 @@ public function renderPreview($display_id, $args = array()) { $queries .= t('[@time ms] @query', array('@time' => round($query['time'] * 100000, 1) / 100000.0, '@query' => $query_string)); } - $rows['query'][] = array('' . t('Other queries') . '', '
' . $queries . ''); + $rows['query'][] = array( + SafeMarkup::create('' . t('Other queries') . ''), + SafeMarkup::create('
' . $queries . ''), + ); } } if ($show_info) { - $rows['query'][] = array('' . t('Title') . '', Xss::filterAdmin($this->executable->getTitle())); + $rows['query'][] = array( + SafeMarkup::create('' . t('Title') . ''), + Xss::filterAdmin($this->executable->getTitle()), + ); if (isset($path)) { $path = l($path, $path); } else { $path = t('This display has no path.'); } - $rows['query'][] = array('' . t('Path') . '', $path); + $rows['query'][] = array(SafeMarkup::create('' . t('Path') . ''), $path); } if ($show_stats) { @@ -714,10 +724,10 @@ public function renderPreview($display_id, $args = array()) { // No query was run. Display that information in place of either the // query or the performance statistics, whichever comes first. if ($combined || ($show_location === 'above')) { - $rows['query'] = array(array('' . t('Query') . '', t('No query was run'))); + $rows['query'] = array(array(SafeMarkup::create('' . t('Query') . ''), t('No query was run'))); } else { - $rows['statistics'] = array(array('' . t('Query') . '', t('No query was run'))); + $rows['statistics'] = array(array(SafeMarkup::create('' . t('Query') . ''), t('No query was run'))); } } } diff --git a/core/modules/views_ui/templates/views-ui-display-tab-setting.html.twig b/core/modules/views_ui/templates/views-ui-display-tab-setting.html.twig index 1c67469..4659514 100644 --- a/core/modules/views_ui/templates/views-ui-display-tab-setting.html.twig +++ b/core/modules/views_ui/templates/views-ui-display-tab-setting.html.twig @@ -20,6 +20,7 @@ {{ description }} {%- endif %} {% if settings_links %} - {{ settings_links|join(' | ') }} + {# @todo Need to identify a way to figure out how to remove |raw #} + {{ settings_links|join(' | ')|raw }} {% endif %}