diff --git a/core/modules/rest/src/Plugin/views/display/RestExport.php b/core/modules/rest/src/Plugin/views/display/RestExport.php index 74a27624db..fd36a59eca 100644 --- a/core/modules/rest/src/Plugin/views/display/RestExport.php +++ b/core/modules/rest/src/Plugin/views/display/RestExport.php @@ -140,20 +140,8 @@ public function initDisplay(ViewExecutable $view, array &$display, array &$optio parent::initDisplay($view, $display, $options); $request_content_type = $this->view->getRequest()->getRequestFormat(); - // Only use the requested content type if it's not 'html'. If it is then - // default to 'json' to aid debugging. - // @todo Remove the need for this when we have better content negotiation. - if ($request_content_type != 'html') { - $this->setContentType($request_content_type); - } - // If the requested content type is 'html' and the default 'json' is not - // selected as a format option in the view display, fallback to the first - // format in the array. - elseif (!empty($options['style']['options']['formats']) && !isset($options['style']['options']['formats'][$this->getContentType()])) { - $this->setContentType(reset($options['style']['options']['formats'])); - } - - $this->setMimeType($this->view->getRequest()->getMimeType($this->contentType)); + $this->setContentType($request_content_type); + $this->setMimeType($this->view->getRequest()->getMimeType($request_content_type)); } /** @@ -327,16 +315,12 @@ public function collectRoutes(RouteCollection $collection) { if ($route = $collection->get("view.$view_id.$display_id")) { $style_plugin = $this->getPlugin('style'); - // REST exports should only respond to get methods. + // REST exports should only respond to GET methods. $route->setMethods(['GET']); // Format as a string using pipes as a delimiter. if ($formats = $style_plugin->getFormats()) { - // Allow a REST Export View to be returned with an HTML-only accept - // format. That allows browsers or other non-compliant systems to access - // the view, as it is unlikely to have a conflicting HTML representation - // anyway. - $route->setRequirement('_format', implode('|', $formats + ['html'])); + $route->setRequirement('_format', implode('|', $formats)); } // Add authentication to the route if it was set. If no authentication was // set, the default authentication will be used, which is cookie based by @@ -421,15 +405,15 @@ public function render() { $build['#suffix'] = ''; unset($build['#markup']); } - elseif ($this->view->getRequest()->getFormat($this->view->element['#content_type']) !== 'html') { - // This display plugin is primarily for returning non-HTML formats. - // However, we still invoke the renderer to collect cacheability metadata. - // Because the renderer is designed for HTML rendering, it filters - // #markup for XSS unless it is already known to be safe, but that filter - // only works for HTML. Therefore, we mark the contents as safe to bypass - // the filter. So long as we are returning this in a non-HTML response - // (checked above), this is safe, because an XSS attack only works when - // executed by an HTML agent. + else { + // This display plugin is for returning non-HTML formats. However, we + // still invoke the renderer to collect cacheability metadata. Because the + // renderer is designed for HTML rendering, it filters #markup for XSS + // unless it is already known to be safe, but that filter only works for + // HTML. Therefore, we mark the contents as safe to bypass the filter. So + // long as we are returning this in a non-HTML response, + // this is safe, because an XSS attack only works when executed by an HTML + // agent. // @todo Decide how to support non-HTML in the render API in // https://www.drupal.org/node/2501313. $build['#markup'] = ViewsRenderPipelineMarkup::create($build['#markup']); diff --git a/core/modules/views/src/Plugin/views/display/Page.php b/core/modules/views/src/Plugin/views/display/Page.php index d79b75b833..6d1f460a66 100644 --- a/core/modules/views/src/Plugin/views/display/Page.php +++ b/core/modules/views/src/Plugin/views/display/Page.php @@ -84,6 +84,18 @@ public static function create(ContainerInterface $container, array $configuratio ); } + /** + * {@inheritdoc} + */ + protected function getRoute($view_id, $display_id) { + $route = parent::getRoute($view_id, $display_id); + + // Explicitly set HTML as the format for Page displays. + $route->setRequirement('_format', 'html'); + + return $route; + } + /** * Sets the current page views render array. *