' . $string . ''; diff --git a/core/includes/file.inc b/core/includes/file.inc index 0740c82..142bd20 100644 --- a/core/includes/file.inc +++ b/core/includes/file.inc @@ -5,11 +5,11 @@ * API for handling file uploads and server file management. */ +use Drupal\Component\Utility\Html; use Drupal\Component\Utility\Unicode; use Drupal\Component\Utility\UrlHelper; use Drupal\Component\PhpStorage\FileStorage; use Drupal\Component\Utility\Bytes; -use Drupal\Component\Utility\SafeMarkup; use Drupal\Core\File\FileSystem; use Drupal\Core\StreamWrapper\PublicStream; use Drupal\Core\StreamWrapper\StreamWrapperInterface; @@ -371,7 +371,7 @@ function file_save_htaccess($directory, $private = TRUE, $force_overwrite = FALS return drupal_chmod($htaccess_path, 0444); } else { - $variables = array('%directory' => $directory, '!htaccess' => '
!htaccess", $variables);
return FALSE;
}
diff --git a/core/includes/form.inc b/core/includes/form.inc
index efbac99..4b15cf0 100644
--- a/core/includes/form.inc
+++ b/core/includes/form.inc
@@ -566,12 +566,13 @@ function template_preprocess_form_element_label(&$variables) {
* @endcode
*
* Note: if the batch 'title', 'init_message', 'progress_message', or
- * 'error_message' could contain any user input, it is the responsibility of
- * the code calling batch_set() to sanitize them first with a function like
- * \Drupal\Component\Utility\SafeMarkup::checkPlain() or
- * \Drupal\Component\Utility\Xss::filter(). Furthermore, if the batch operation
- * returns any user input in the 'results' or 'message' keys of $context, it
- * must also sanitize them first.
+ * 'error_message' could contain any HTML that you want to display then, it is
+ * the responsibility of the code calling batch_set() to mark them safe using a
+ * function like \Drupal\Component\Utility\SafeMarkup::format() or
+ * \Drupal\Core\StringTranslation\TranslationManager::translate. If they are not
+ * marked safe then Twig will auto-escape them. Furthermore, if the batch
+ * operation returns any HTML in the 'results' or 'message' keys of $context,
+ * it must also consider sanitization.
*
* Sample callback_batch_operation():
* @code
@@ -595,8 +596,9 @@ function template_preprocess_form_element_label(&$variables) {
*
* $nodes = entity_load_multiple_by_properties('node', array('uid' => $uid, 'type' => $type));
* $node = reset($nodes);
- * $context['results'][] = $node->id() . ' : ' . SafeMarkup::checkPlain($node->label());
- * $context['message'] = SafeMarkup::checkPlain($node->label());
+ * // Twig will auto-escape these variables.
+ * $context['results'][] = $node->id() . ' : ' .$node->label();
+ * $context['message'] = $node->label();
* }
*
* // A more advanced example is a multi-step operation that loads all rows,
@@ -615,10 +617,10 @@ function template_preprocess_form_element_label(&$variables) {
* ->range(0, $limit)
* ->execute();
* foreach ($result as $row) {
- * $context['results'][] = $row->id . ' : ' . SafeMarkup::checkPlain($row->title);
+ * $context['results'][] = $row->id . ' : ' . $row->title;
* $context['sandbox']['progress']++;
* $context['sandbox']['current_id'] = $row->id;
- * $context['message'] = SafeMarkup::checkPlain($row->title);
+ * $context['message'] = $row->title;
* }
* if ($context['sandbox']['progress'] != $context['sandbox']['max']) {
* $context['finished'] = $context['sandbox']['progress'] / $context['sandbox']['max'];
diff --git a/core/includes/schema.inc b/core/includes/schema.inc
index b74c270..bba4eab 100644
--- a/core/includes/schema.inc
+++ b/core/includes/schema.inc
@@ -130,12 +130,6 @@ function drupal_install_schema($module) {
*
* @param string $module
* The module for which the tables will be removed.
- *
- * @return array
- * An array of arrays with the following key/value pairs:
- * - success: a boolean indicating whether the query succeeded.
- * - query: the SQL query(s) executed, passed through
- * \Drupal\Component\Utility\SafeMarkup::checkPlain().
*/
function drupal_uninstall_schema($module) {
$schema = drupal_get_module_schema($module);
diff --git a/core/includes/update.inc b/core/includes/update.inc
index 8e9a24c..04ac350 100644
--- a/core/includes/update.inc
+++ b/core/includes/update.inc
@@ -9,7 +9,6 @@
*/
use Drupal\Component\Graph\Graph;
-use Drupal\Component\Utility\SafeMarkup;
use Drupal\Core\Entity\EntityStorageException;
use Drupal\Core\Utility\Error;
@@ -215,7 +214,7 @@ function update_do_one($module, $number, $dependency_map, &$context) {
drupal_set_installed_schema_version($module, $number);
}
- $context['message'] = 'Updating ' . SafeMarkup::checkPlain($module) . ' module';
+ $context['message'] = 'Updating ' . $module . ' module';
}
/**
diff --git a/core/lib/Drupal/Component/Utility/SafeMarkup.php b/core/lib/Drupal/Component/Utility/SafeMarkup.php
index ee25f86..62ffd46 100644
--- a/core/lib/Drupal/Component/Utility/SafeMarkup.php
+++ b/core/lib/Drupal/Component/Utility/SafeMarkup.php
@@ -15,9 +15,9 @@
* provides a store for known safe strings and methods to manage them
* throughout the page request.
*
- * Strings sanitized by self::checkPlain() and self::escape() are automatically
- * marked safe, as are markup strings created from @link theme_render render
- * arrays @endlink via drupal_render().
+ * Strings sanitized by self::escape() are automatically marked safe. The output
+ * of the render system is automatically filtered or escaped as necessary and
+ * then marked as safe.
*
* This class should be limited to internal use only. Module developers should
* instead use the appropriate
@@ -135,7 +135,11 @@ public static function setMultiple(array $safe_strings) {
* self::set(), it won't be escaped again.
*/
public static function escape($string) {
- return static::isSafe($string) ? $string : static::checkPlain($string);
+ if (!static::isSafe($string)) {
+ $string = Html::escape($string);
+ static::$safeStrings[$string]['html'] = TRUE;
+ }
+ return $string;
}
/**
@@ -152,29 +156,6 @@ public static function getAll() {
}
/**
- * Encodes special characters in a plain-text string for display as HTML.
- *
- * Also validates strings as UTF-8. All processed strings are also
- * automatically flagged as safe markup strings for rendering.
- *
- * @param string $text
- * The text to be checked or processed.
- *
- * @return string
- * An HTML safe version of $text, or an empty string if $text is not valid
- * UTF-8.
- *
- * @ingroup sanitization
- *
- * @see drupal_validate_utf8()
- */
- public static function checkPlain($text) {
- $string = Html::escape($text);
- static::$safeStrings[$string]['html'] = TRUE;
- return $string;
- }
-
- /**
* Formats a string for HTML display by replacing variable placeholders.
*
* This function replaces variable placeholders in a string with the requested
@@ -206,8 +187,8 @@ public static function checkPlain($text) {
* use this when the resulting string is being generated for one of:
* - Non-HTML usage, such as a plain-text email.
* - Non-direct HTML output, such as a plain-text variable that will be
- * printed as an HTML attribute value and therefore formatted with
- * self::checkPlain() as part of that.
+ * printed as an HTML attribute value and therefore escaped as part of
+ * that.
* - Some other special reason for suppressing sanitization.
*
* @return string
diff --git a/core/lib/Drupal/Component/Utility/UrlHelper.php b/core/lib/Drupal/Component/Utility/UrlHelper.php
index 608a5da..df20c23 100644
--- a/core/lib/Drupal/Component/Utility/UrlHelper.php
+++ b/core/lib/Drupal/Component/Utility/UrlHelper.php
@@ -303,7 +303,7 @@ public static function setAllowedProtocols(array $protocols = array()) {
* check_url() or Drupal\Component\Utility\Xss::filter(), but those functions
* return an HTML-encoded string, so this function can be called independently
* when the output needs to be a plain-text string for passing to functions
- * that will call \Drupal\Component\Utility\SafeMarkup::checkPlain() separately.
+ * that will call \Drupal\Component\Utility\Html::escape() separately.
*
* @param string $uri
* A plain-text URI that might contain dangerous protocols.
diff --git a/core/lib/Drupal/Component/Utility/Xss.php b/core/lib/Drupal/Component/Utility/Xss.php
index 6fdeb68..a547e41 100644
--- a/core/lib/Drupal/Component/Utility/Xss.php
+++ b/core/lib/Drupal/Component/Utility/Xss.php
@@ -107,10 +107,9 @@ public static function filter($string, array $html_tags = NULL) {
/**
* Applies a very permissive XSS/HTML filter for admin-only use.
*
- * Use only for fields where it is impractical to use the
- * whole filter system, but where some (mainly inline) mark-up
- * is desired (so \Drupal\Component\Utility\SafeMarkup::checkPlain() is
- * not acceptable).
+ * Use only for fields where it is impractical to use the whole filter system,
+ * but where some (mainly inline) mark-up is desired (so
+ * \Drupal\Component\Utility\Html::escape() is not acceptable).
*
* Allows all tags that can be used inside an HTML body, save
* for scripts and styles.
diff --git a/core/lib/Drupal/Core/Asset/CssCollectionRenderer.php b/core/lib/Drupal/Core/Asset/CssCollectionRenderer.php
index 6ef6be3..63a2452 100644
--- a/core/lib/Drupal/Core/Asset/CssCollectionRenderer.php
+++ b/core/lib/Drupal/Core/Asset/CssCollectionRenderer.php
@@ -7,7 +7,7 @@
namespace Drupal\Core\Asset;
-use Drupal\Component\Utility\SafeMarkup;
+use Drupal\Component\Utility\Html;
use Drupal\Core\State\StateInterface;
/**
@@ -168,7 +168,7 @@ public function render(array $css_assets) {
// control browser-caching. IE7 does not support a media type on
// the @import statement, so we instead specify the media for
// the group on the STYLE tag.
- $import[] = '@import url("' . SafeMarkup::checkPlain(file_create_url($next_css_asset['data']) . '?' . $query_string) . '");';
+ $import[] = '@import url("' . Html::escape(file_create_url($next_css_asset['data']) . '?' . $query_string) . '");';
// Move the outer for loop skip the next item, since we
// processed it here.
$i = $j;
diff --git a/core/lib/Drupal/Core/Block/BlockBase.php b/core/lib/Drupal/Core/Block/BlockBase.php
index ef127e9..d196999 100644
--- a/core/lib/Drupal/Core/Block/BlockBase.php
+++ b/core/lib/Drupal/Core/Block/BlockBase.php
@@ -8,7 +8,6 @@
namespace Drupal\Core\Block;
use Drupal\block\BlockInterface;
-use Drupal\Component\Utility\SafeMarkup;
use Drupal\Core\Access\AccessResult;
use Drupal\Core\Cache\CacheableDependencyInterface;
use Drupal\Core\Form\FormStateInterface;
@@ -17,6 +16,7 @@
use Drupal\Component\Utility\NestedArray;
use Drupal\Core\Language\LanguageInterface;
use Drupal\Core\Cache\Cache;
+use Drupal\Core\Render\Element\Markup;
use Drupal\Core\Session\AccountInterface;
use Drupal\Component\Transliteration\TransliterationInterface;
@@ -166,7 +166,8 @@ public function buildConfigurationForm(array $form, FormStateInterface $form_sta
$form['admin_label'] = array(
'#type' => 'item',
'#title' => $this->t('Block description'),
- '#markup' => SafeMarkup::checkPlain($definition['admin_label']),
+ '#markup' => $definition['admin_label'],
+ '#safe_strategy' => Markup::SAFE_STRATEGY_ESCAPE,
);
$form['label'] = array(
'#type' => 'textfield',
diff --git a/core/lib/Drupal/Core/Controller/TitleResolverInterface.php b/core/lib/Drupal/Core/Controller/TitleResolverInterface.php
index bedfd17..fa72e11 100644
--- a/core/lib/Drupal/Core/Controller/TitleResolverInterface.php
+++ b/core/lib/Drupal/Core/Controller/TitleResolverInterface.php
@@ -17,18 +17,20 @@
/**
* Returns a static or dynamic title for the route.
*
- * The returned title string must be safe to output in HTML. For example, an
- * implementation should call \Drupal\Component\Utility\SafeMarkup::checkPlain()
- * or \Drupal\Component\Utility\Xss::filterAdmin() on the string, or use
- * appropriate placeholders to sanitize dynamic content inside a localized
- * string before returning it. The title may contain HTML such as EM tags.
+ * If the returned title can contain HTML that should not be escaped it should
+ * return a render array, for example:
+ * @code
+ * ['#markup' => 'title', '#allowed_tags' => ['em']]
+ * @endcode
+ * If the method returns a string and it is not marked safe then it will be
+ * auto-escaped.
*
* @param \Symfony\Component\HttpFoundation\Request $request
* The request object passed to the title callback.
* @param \Symfony\Component\Routing\Route $route
* The route information of the route to fetch the title.
*
- * @return string|null
+ * @return array|string|null
* The title for the route.
*/
public function getTitle(Request $request, Route $route);
diff --git a/core/lib/Drupal/Core/Diff/DiffFormatter.php b/core/lib/Drupal/Core/Diff/DiffFormatter.php
index cfd6bb8..cd46fab 100644
--- a/core/lib/Drupal/Core/Diff/DiffFormatter.php
+++ b/core/lib/Drupal/Core/Diff/DiffFormatter.php
@@ -9,7 +9,7 @@
use Drupal\Component\Diff\DiffFormatter as DiffFormatterBase;
use Drupal\Component\Diff\WordLevelDiff;
-use Drupal\Component\Utility\SafeMarkup;
+use Drupal\Component\Utility\Html;
use Drupal\Core\Config\ConfigFactoryInterface;
/**
@@ -172,7 +172,7 @@ protected function emptyLine() {
*/
protected function _added($lines) {
foreach ($lines as $line) {
- $this->rows[] = array_merge($this->emptyLine(), $this->addedLine(SafeMarkup::checkPlain($line)));
+ $this->rows[] = array_merge($this->emptyLine(), $this->addedLine(Html::escape($line)));
}
}
@@ -181,7 +181,7 @@ protected function _added($lines) {
*/
protected function _deleted($lines) {
foreach ($lines as $line) {
- $this->rows[] = array_merge($this->deletedLine(SafeMarkup::checkPlain($line)), $this->emptyLine());
+ $this->rows[] = array_merge($this->deletedLine(Html::escape($line)), $this->emptyLine());
}
}
@@ -190,7 +190,7 @@ protected function _deleted($lines) {
*/
protected function _context($lines) {
foreach ($lines as $line) {
- $this->rows[] = array_merge($this->contextLine(SafeMarkup::checkPlain($line)), $this->contextLine(SafeMarkup::checkPlain($line)));
+ $this->rows[] = array_merge($this->contextLine(Html::escape($line)), $this->contextLine(Html::escape($line)));
}
}
diff --git a/core/lib/Drupal/Core/Entity/EntityListBuilder.php b/core/lib/Drupal/Core/Entity/EntityListBuilder.php
index 6fbdeda..b4e54b1 100644
--- a/core/lib/Drupal/Core/Entity/EntityListBuilder.php
+++ b/core/lib/Drupal/Core/Entity/EntityListBuilder.php
@@ -9,7 +9,6 @@
use Drupal\Core\Extension\ModuleHandlerInterface;
use Symfony\Component\DependencyInjection\ContainerInterface;
-use Drupal\Component\Utility\SafeMarkup;
/**
* Defines a generic implementation to build a listing of entities.
@@ -112,10 +111,10 @@ protected function getEntityIds() {
* The entity being listed.
*
* @return string
- * The escaped entity label.
+ * The entity label.
*/
protected function getLabel(EntityInterface $entity) {
- return SafeMarkup::checkPlain($entity->label());
+ return $entity->label();
}
/**
diff --git a/core/lib/Drupal/Core/Entity/Plugin/EntityReferenceSelection/SelectionBase.php b/core/lib/Drupal/Core/Entity/Plugin/EntityReferenceSelection/SelectionBase.php
index cb8c7d6..f05844a 100644
--- a/core/lib/Drupal/Core/Entity/Plugin/EntityReferenceSelection/SelectionBase.php
+++ b/core/lib/Drupal/Core/Entity/Plugin/EntityReferenceSelection/SelectionBase.php
@@ -7,7 +7,6 @@
namespace Drupal\Core\Entity\Plugin\EntityReferenceSelection;
-use Drupal\Component\Utility\SafeMarkup;
use Drupal\Core\Database\Query\AlterableInterface;
use Drupal\Core\Database\Query\SelectInterface;
use Drupal\Core\Entity\EntityManagerInterface;
@@ -235,7 +234,7 @@ public function getReferenceableEntities($match = NULL, $match_operator = 'CONTA
$entities = entity_load_multiple($target_type, $result);
foreach ($entities as $entity_id => $entity) {
$bundle = $entity->bundle();
- $options[$bundle][$entity_id] = SafeMarkup::checkPlain($entity->label());
+ $options[$bundle][$entity_id] = $entity->label();
}
return $options;
diff --git a/core/lib/Drupal/Core/EventSubscriber/ExceptionLoggingSubscriber.php b/core/lib/Drupal/Core/EventSubscriber/ExceptionLoggingSubscriber.php
index 6a2bd6c..a6f5e84 100644
--- a/core/lib/Drupal/Core/EventSubscriber/ExceptionLoggingSubscriber.php
+++ b/core/lib/Drupal/Core/EventSubscriber/ExceptionLoggingSubscriber.php
@@ -7,7 +7,6 @@
namespace Drupal\Core\EventSubscriber;
-use Drupal\Component\Utility\SafeMarkup;
use Drupal\Core\Logger\LoggerChannelFactoryInterface;
use Drupal\Core\Utility\Error;
use Symfony\Component\EventDispatcher\EventSubscriberInterface;
@@ -45,7 +44,7 @@ public function __construct(LoggerChannelFactoryInterface $logger) {
*/
public function on403(GetResponseForExceptionEvent $event) {
$request = $event->getRequest();
- $this->logger->get('access denied')->warning(SafeMarkup::checkPlain($request->getRequestUri()));
+ $this->logger->get('access denied')->warning('%uri', ['%uri' => $request->getRequestUri()]);
}
/**
@@ -56,7 +55,7 @@ public function on403(GetResponseForExceptionEvent $event) {
*/
public function on404(GetResponseForExceptionEvent $event) {
$request = $event->getRequest();
- $this->logger->get('page not found')->warning(SafeMarkup::checkPlain($request->getRequestUri()));
+ $this->logger->get('page not found')->warning('%uri', ['%uri' => $request->getRequestUri()]);
}
/**
diff --git a/core/lib/Drupal/Core/EventSubscriber/Fast404ExceptionHtmlSubscriber.php b/core/lib/Drupal/Core/EventSubscriber/Fast404ExceptionHtmlSubscriber.php
index 94a13b5..3f095b0 100644
--- a/core/lib/Drupal/Core/EventSubscriber/Fast404ExceptionHtmlSubscriber.php
+++ b/core/lib/Drupal/Core/EventSubscriber/Fast404ExceptionHtmlSubscriber.php
@@ -8,7 +8,7 @@
namespace Drupal\Core\EventSubscriber;
use Drupal\Core\Config\ConfigFactoryInterface;
-use Drupal\Component\Utility\SafeMarkup;
+use Drupal\Component\Utility\Html;
use Symfony\Component\HttpFoundation\Response;
use Symfony\Component\HttpKernel\Event\GetResponseForExceptionEvent;
use Symfony\Component\HttpKernel\HttpKernelInterface;
@@ -79,7 +79,7 @@ public function on404(GetResponseForExceptionEvent $event) {
if ($config->get('fast_404.enabled') && $exclude_paths && !preg_match($exclude_paths, $request->getPathInfo())) {
$fast_paths = $config->get('fast_404.paths');
if ($fast_paths && preg_match($fast_paths, $request->getPathInfo())) {
- $fast_404_html = strtr($config->get('fast_404.html'), ['@path' => SafeMarkup::checkPlain($request->getUri())]);
+ $fast_404_html = strtr($config->get('fast_404.html'), ['@path' => Html::escape($request->getUri())]);
$response = new Response($fast_404_html, Response::HTTP_NOT_FOUND);
$event->setResponse($response);
}
diff --git a/core/lib/Drupal/Core/Extension/ThemeHandler.php b/core/lib/Drupal/Core/Extension/ThemeHandler.php
index 2eb56bc..83465bf 100644
--- a/core/lib/Drupal/Core/Extension/ThemeHandler.php
+++ b/core/lib/Drupal/Core/Extension/ThemeHandler.php
@@ -7,7 +7,6 @@
namespace Drupal\Core\Extension;
-use Drupal\Component\Utility\SafeMarkup;
use Drupal\Core\Config\ConfigFactoryInterface;
use Drupal\Core\State\StateInterface;
@@ -431,7 +430,7 @@ public function getName($theme) {
if (!isset($themes[$theme])) {
throw new \InvalidArgumentException("Requested the name of a non-existing theme $theme");
}
- return SafeMarkup::checkPlain($themes[$theme]->info['name']);
+ return $themes[$theme]->info['name'];
}
/**
diff --git a/core/lib/Drupal/Core/Field/AllowedTagsXssTrait.php b/core/lib/Drupal/Core/Field/AllowedTagsXssTrait.php
index 6125c5c..850bfce 100644
--- a/core/lib/Drupal/Core/Field/AllowedTagsXssTrait.php
+++ b/core/lib/Drupal/Core/Field/AllowedTagsXssTrait.php
@@ -23,7 +23,7 @@
*
* Used for items entered by administrators, like field descriptions, allowed
* values, where some (mainly inline) mark-up may be desired (so
- * \Drupal\Component\Utility\SafeMarkup::checkPlain() is not acceptable).
+ * \Drupal\Component\Utility\Html::escape() is not acceptable).
*
* @param string $string
* The string with raw HTML in it.
diff --git a/core/lib/Drupal/Core/Field/Plugin/Field/FieldFormatter/BasicStringFormatter.php b/core/lib/Drupal/Core/Field/Plugin/Field/FieldFormatter/BasicStringFormatter.php
index c03b96d..9d2b730 100644
--- a/core/lib/Drupal/Core/Field/Plugin/Field/FieldFormatter/BasicStringFormatter.php
+++ b/core/lib/Drupal/Core/Field/Plugin/Field/FieldFormatter/BasicStringFormatter.php
@@ -7,7 +7,7 @@
namespace Drupal\Core\Field\Plugin\Field\FieldFormatter;
-use Drupal\Component\Utility\SafeMarkup;
+use Drupal\Component\Utility\Html;
use Drupal\Core\Field\FormatterBase;
use Drupal\Core\Field\FieldItemListInterface;
@@ -37,7 +37,7 @@ public function viewElements(FieldItemListInterface $items) {
foreach ($items as $delta => $item) {
// The text value has no text format assigned to it, so the user input
// should equal the output, including newlines.
- $elements[$delta] = array('#markup' => nl2br(SafeMarkup::checkPlain($item->value)));
+ $elements[$delta] = array('#markup' => nl2br(Html::escape($item->value)));
}
return $elements;
diff --git a/core/lib/Drupal/Core/Field/Plugin/Field/FieldFormatter/EntityReferenceIdFormatter.php b/core/lib/Drupal/Core/Field/Plugin/Field/FieldFormatter/EntityReferenceIdFormatter.php
index 69b5b9f..249b3a0 100644
--- a/core/lib/Drupal/Core/Field/Plugin/Field/FieldFormatter/EntityReferenceIdFormatter.php
+++ b/core/lib/Drupal/Core/Field/Plugin/Field/FieldFormatter/EntityReferenceIdFormatter.php
@@ -8,7 +8,7 @@
namespace Drupal\Core\Field\Plugin\Field\FieldFormatter;
use Drupal\Core\Field\FieldItemListInterface;
-use Drupal\Component\Utility\SafeMarkup;
+use Drupal\Core\Render\Element\Markup;
/**
* Plugin implementation of the 'entity reference ID' formatter.
@@ -33,7 +33,8 @@ public function viewElements(FieldItemListInterface $items) {
foreach ($this->getEntitiesToView($items) as $delta => $entity) {
if ($entity->id()) {
$elements[$delta] = array(
- '#markup' => SafeMarkup::checkPlain($entity->id()),
+ '#markup' => $entity->id(),
+ '#safe_strategy' => Markup::SAFE_STRATEGY_ESCAPE,
// Create a cache tag entry for the referenced entity. In the case
// that the referenced entity is deleted, the cache for referring
// entities must be cleared.
diff --git a/core/lib/Drupal/Core/Field/Plugin/Field/FieldFormatter/EntityReferenceLabelFormatter.php b/core/lib/Drupal/Core/Field/Plugin/Field/FieldFormatter/EntityReferenceLabelFormatter.php
index c362a80..04b0172 100644
--- a/core/lib/Drupal/Core/Field/Plugin/Field/FieldFormatter/EntityReferenceLabelFormatter.php
+++ b/core/lib/Drupal/Core/Field/Plugin/Field/FieldFormatter/EntityReferenceLabelFormatter.php
@@ -7,10 +7,10 @@
namespace Drupal\Core\Field\Plugin\Field\FieldFormatter;
-use Drupal\Component\Utility\SafeMarkup;
use Drupal\Core\Entity\Exception\UndefinedLinkTemplateException;
use Drupal\Core\Field\FieldItemListInterface;
use Drupal\Core\Form\FormStateInterface;
+use Drupal\Core\Render\Element\Markup;
/**
* Plugin implementation of the 'entity reference label' formatter.
@@ -98,7 +98,10 @@ public function viewElements(FieldItemListInterface $items) {
}
}
else {
- $elements[$delta] = array('#markup' => SafeMarkup::checkPlain($label));
+ $elements[$delta] = array(
+ '#markup' => $label,
+ '#safe_strategy' => Markup::SAFE_STRATEGY_ESCAPE,
+ );
}
$elements[$delta]['#cache']['tags'] = $entity->getCacheTags();
}
diff --git a/core/lib/Drupal/Core/Field/Plugin/Field/FieldFormatter/LanguageFormatter.php b/core/lib/Drupal/Core/Field/Plugin/Field/FieldFormatter/LanguageFormatter.php
index dea2989..c8185aa 100644
--- a/core/lib/Drupal/Core/Field/Plugin/Field/FieldFormatter/LanguageFormatter.php
+++ b/core/lib/Drupal/Core/Field/Plugin/Field/FieldFormatter/LanguageFormatter.php
@@ -7,7 +7,6 @@
namespace Drupal\Core\Field\Plugin\Field\FieldFormatter;
-use Drupal\Component\Utility\SafeMarkup;
use Drupal\Core\Entity\EntityManagerInterface;
use Drupal\Core\Field\FieldDefinitionInterface;
use Drupal\Core\Field\FieldItemInterface;
@@ -123,7 +122,7 @@ protected function viewValue(FieldItemInterface $item) {
// storage by LanguageManager::getLanguages()) or in its native language
// name. That only depends on formatter settings and no language condition.
$languages = $this->getSetting('native_language') ? $this->languageManager->getNativeLanguages(LanguageInterface::STATE_ALL) : $this->languageManager->getLanguages(LanguageInterface::STATE_ALL);
- return $item->language && isset($languages[$item->language->getId()]) ? SafeMarkup::checkPlain($languages[$item->language->getId()]->getName()) : '';
+ return $item->language && isset($languages[$item->language->getId()]) ? $languages[$item->language->getId()]->getName() : '';
}
}
diff --git a/core/lib/Drupal/Core/Field/Plugin/Field/FieldFormatter/StringFormatter.php b/core/lib/Drupal/Core/Field/Plugin/Field/FieldFormatter/StringFormatter.php
index 6276f95..1379282 100644
--- a/core/lib/Drupal/Core/Field/Plugin/Field/FieldFormatter/StringFormatter.php
+++ b/core/lib/Drupal/Core/Field/Plugin/Field/FieldFormatter/StringFormatter.php
@@ -7,7 +7,7 @@
namespace Drupal\Core\Field\Plugin\Field\FieldFormatter;
-use Drupal\Component\Utility\SafeMarkup;
+use Drupal\Component\Utility\Html;
use Drupal\Core\Entity\EntityManagerInterface;
use Drupal\Core\Entity\RevisionableInterface;
use Drupal\Core\Field\FieldDefinitionInterface;
@@ -128,17 +128,16 @@ public function viewElements(FieldItemListInterface $items) {
}
foreach ($items as $delta => $item) {
- $string = $this->viewValue($item);
+ $elements[$delta] = ['#markup' => $this->viewValue($item)];
+
+ // Wrap in a link if configured to.
if ($url) {
$elements[$delta] = [
'#type' => 'link',
- '#title' => $string,
+ '#title' => $elements[$delta],
'#url' => $url,
];
}
- else {
- $elements[$delta] = ['#markup' => $string];
- }
}
return $elements;
}
@@ -155,7 +154,7 @@ public function viewElements(FieldItemListInterface $items) {
protected function viewValue(FieldItemInterface $item) {
// The text value has no text format assigned to it, so the user input
// should equal the output, including newlines.
- return nl2br(SafeMarkup::checkPlain($item->value));
+ return nl2br(Html::escape($item->value));
}
}
diff --git a/core/lib/Drupal/Core/Field/WidgetBase.php b/core/lib/Drupal/Core/Field/WidgetBase.php
index 356eece..0764c51 100644
--- a/core/lib/Drupal/Core/Field/WidgetBase.php
+++ b/core/lib/Drupal/Core/Field/WidgetBase.php
@@ -10,7 +10,6 @@
use Drupal\Component\Utility\Html;
use Drupal\Component\Utility\NestedArray;
use Drupal\Component\Utility\SortArray;
-use Drupal\Component\Utility\SafeMarkup;
use Drupal\Core\Form\FormStateInterface;
use Drupal\Core\Render\Element;
use Symfony\Component\Validator\ConstraintViolationInterface;
@@ -85,7 +84,7 @@ public function form(FieldItemListInterface $items, array &$form, FormStateInter
if ($this->handlesMultipleValues() || isset($get_delta)) {
$delta = isset($get_delta) ? $get_delta : 0;
$element = array(
- '#title' => SafeMarkup::checkPlain($this->fieldDefinition->getLabel()),
+ '#title' => $this->fieldDefinition->getLabel(),
'#description' => $this->fieldFilterXss(\Drupal::token()->replace($this->fieldDefinition->getDescription())),
);
$element = $this->formSingleElement($items, $delta, $element, $form, $form_state);
@@ -164,7 +163,7 @@ protected function formMultipleElements(FieldItemListInterface $items, array &$f
break;
}
- $title = SafeMarkup::checkPlain($this->fieldDefinition->getLabel());
+ $title = $this->fieldDefinition->getLabel();
$description = $this->fieldFilterXss(\Drupal::token()->replace($this->fieldDefinition->getDescription()));
$elements = array();
diff --git a/core/lib/Drupal/Core/Form/FormErrorHandler.php b/core/lib/Drupal/Core/Form/FormErrorHandler.php
index df736b0..03c86c9 100644
--- a/core/lib/Drupal/Core/Form/FormErrorHandler.php
+++ b/core/lib/Drupal/Core/Form/FormErrorHandler.php
@@ -82,9 +82,7 @@ protected function displayErrorMessages(array $form, FormStateInterface $form_st
unset($errors[$name]);
}
elseif ($is_visible_element && $has_title && $has_id) {
- // We need to pass this through SafeMarkup::escape() so
- // drupal_set_message() does not encode the links.
- $error_links[] = SafeMarkup::escape($this->l($title, Url::fromRoute('',
- '#markup' => Html::escape($tips[$tag][1]),
+ '#markup' => $tips[$tag][1],
+ '#safe_strategy' => Markup::SAFE_STRATEGY_ESCAPE,
'#suffix' => ''
),
'class' => array('type')),
@@ -193,7 +195,8 @@ public function tips($long = FALSE) {
array(
'data' => array(
'#prefix' => '',
- '#markup' => Html::escape($entity[1]),
+ '#markup' => $entity[1],
+ '#safe_strategy' => Markup::SAFE_STRATEGY_ESCAPE,
'#suffix' => '',
),
'class' => array('type'),
diff --git a/core/modules/filter/src/Tests/FilterUnitTest.php b/core/modules/filter/src/Tests/FilterUnitTest.php
index fe7664c..003e4d0 100644
--- a/core/modules/filter/src/Tests/FilterUnitTest.php
+++ b/core/modules/filter/src/Tests/FilterUnitTest.php
@@ -8,7 +8,6 @@
namespace Drupal\filter\Tests;
use Drupal\Component\Utility\Html;
-use Drupal\Component\Utility\SafeMarkup;
use Drupal\Core\Render\RenderContext;
use Drupal\editor\EditorXssFilter\Standard;
use Drupal\filter\Entity\FilterFormat;
@@ -480,7 +479,7 @@ function testNoFollowFilter() {
/**
* Tests the HTML escaping filter.
*
- * \Drupal\Component\Utility\SafeMarkup::checkPlain() is not tested here.
+ * \Drupal\Component\Utility\Html::escape() is not tested here.
*/
function testHtmlEscapeFilter() {
// Get FilterHtmlEscape object.
@@ -849,10 +848,10 @@ function assertFilteredString($filter, $tests) {
)));
}
if (!$success) {
- $this->verbose('Source:' . SafeMarkup::checkPlain(var_export($source, TRUE)) . '' - . '
' . SafeMarkup::checkPlain(var_export($result, TRUE)) . '' + $this->verbose('Source:
' . Html::escape(var_export($source, TRUE)) . '' + . '
' . Html::escape(var_export($result, TRUE)) . '' . '
' . SafeMarkup::checkPlain(var_export($value, TRUE)) . '' + . '
' . Html::escape(var_export($value, TRUE)) . '' ); } } diff --git a/core/modules/forum/forum.module b/core/modules/forum/forum.module index 90086a6..30fbb45 100644 --- a/core/modules/forum/forum.module +++ b/core/modules/forum/forum.module @@ -10,7 +10,6 @@ use Drupal\Component\Utility\Xss; use Drupal\Core\Entity\EntityInterface; use Drupal\Core\Url; -use Drupal\Component\Utility\SafeMarkup; use Drupal\Core\Form\FormStateInterface; use Drupal\Core\Routing\RouteMatchInterface; use Drupal\user\Entity\User; @@ -447,7 +446,7 @@ function template_preprocess_forums(&$variables) { // them is a shadow copy. if ($variables['tid'] != $topic->forum_tid) { $variables['topics'][$id]->moved = TRUE; - $variables['topics'][$id]->title = SafeMarkup::checkPlain($topic->getTitle()); + $variables['topics'][$id]->title = $topic->getTitle(); $variables['topics'][$id]->message = \Drupal::l(t('This topic has been moved'), new Url('forum.page', ['taxonomy_term' => $topic->forum_tid])); } else { @@ -542,7 +541,7 @@ function template_preprocess_forum_list(&$variables) { foreach ($variables['forums'] as $id => $forum) { $variables['forums'][$id]->description = array('#markup' => $forum->description->value); $variables['forums'][$id]->link = forum_uri($forum); - $variables['forums'][$id]->name = SafeMarkup::checkPlain($forum->label()); + $variables['forums'][$id]->name = $forum->label(); $variables['forums'][$id]->is_container = !empty($forum->forum_container->value); $variables['forums'][$id]->zebra = $row % 2 == 0 ? 'odd' : 'even'; $row++; diff --git a/core/modules/help/src/Controller/HelpController.php b/core/modules/help/src/Controller/HelpController.php index 802f9d9..4ebd4c8 100644 --- a/core/modules/help/src/Controller/HelpController.php +++ b/core/modules/help/src/Controller/HelpController.php @@ -12,7 +12,6 @@ use Drupal\Core\Url; use Symfony\Component\DependencyInjection\ContainerInterface; use Symfony\Component\HttpKernel\Exception\NotFoundHttpException; -use Drupal\Component\Utility\SafeMarkup; /** * Controller routines for help routes. @@ -115,7 +114,7 @@ public function helpPage($name) { $build = array(); if ($this->moduleHandler()->implementsHook($name, 'help')) { $module_name = $this->moduleHandler()->getName($name); - $build['#title'] = SafeMarkup::checkPlain($module_name); + $build['#title'] = $module_name; $temp = $this->moduleHandler()->invoke($name, 'help', array("help.page.$name", $this->routeMatch)); if (empty($temp)) { diff --git a/core/modules/image/image.admin.inc b/core/modules/image/image.admin.inc index 0c98603..b3d4a6e 100644 --- a/core/modules/image/image.admin.inc +++ b/core/modules/image/image.admin.inc @@ -5,7 +5,6 @@ * Administration pages for image settings. */ -use Drupal\Component\Utility\SafeMarkup; use Drupal\Core\Render\Element; /** @@ -20,8 +19,8 @@ function template_preprocess_image_style_preview(&$variables) { // Style information. $style = $variables['style']; - $variables['style_id'] = SafeMarkup::checkPlain($style->id()); - $variables['style_name'] = SafeMarkup::checkPlain($style->label()); + $variables['style_id'] = $style->id(); + $variables['style_name'] = $style->label(); // Cache bypass token. $variables['cache_bypass'] = REQUEST_TIME; diff --git a/core/modules/image/src/Form/ImageStyleEditForm.php b/core/modules/image/src/Form/ImageStyleEditForm.php index b07090b..dc94099 100644 --- a/core/modules/image/src/Form/ImageStyleEditForm.php +++ b/core/modules/image/src/Form/ImageStyleEditForm.php @@ -9,10 +9,10 @@ use Drupal\Core\Entity\EntityStorageInterface; use Drupal\Core\Form\FormStateInterface; +use Drupal\Core\Render\Element\Markup; use Drupal\Core\Url; use Drupal\image\ConfigurableImageEffectInterface; use Drupal\image\ImageEffectManager; -use Drupal\Component\Utility\SafeMarkup; use Symfony\Component\DependencyInjection\ContainerInterface; /** @@ -99,7 +99,8 @@ public function form(array $form, FormStateInterface $form_state) { '#tree' => FALSE, 'data' => array( 'label' => array( - '#markup' => SafeMarkup::checkPlain($effect->label()), + '#markup' => $effect->label(), + '#safe_strategy' => Markup::SAFE_STRATEGY_ESCAPE, ), ), ); diff --git a/core/modules/language/language.admin.inc b/core/modules/language/language.admin.inc index 8c35c6b..7617414 100644 --- a/core/modules/language/language.admin.inc +++ b/core/modules/language/language.admin.inc @@ -5,8 +5,8 @@ * Administration functions for language.module. */ -use Drupal\Component\Utility\SafeMarkup; use Drupal\Core\Render\Element; +use Drupal\Core\Render\Element\Markup; use Drupal\Core\Template\Attribute; use Drupal\Core\Url; @@ -170,7 +170,8 @@ function template_preprocess_language_content_settings_table(&$variables) { 'data' => array( '#prefix' => '', - '#markup' => SafeMarkup::checkPlain($element[$bundle]['settings']['#label']), + '#markup' => $element[$bundle]['settings']['#label'], + '#safe_strategy' => Markup::SAFE_STRATEGY_ESCAPE, ), 'class' => array('bundle'), ), diff --git a/core/modules/language/src/Form/LanguageFormBase.php b/core/modules/language/src/Form/LanguageFormBase.php index e3711ed..bbafe0e 100644 --- a/core/modules/language/src/Form/LanguageFormBase.php +++ b/core/modules/language/src/Form/LanguageFormBase.php @@ -7,7 +7,7 @@ namespace Drupal\language\Form; -use Drupal\Component\Utility\SafeMarkup; +use Drupal\Component\Utility\Html; use Drupal\Core\Entity\EntityForm; use Drupal\Core\Form\FormStateInterface; use Drupal\Core\Language\LanguageInterface; @@ -106,7 +106,7 @@ public function validateCommon(array $form, FormStateInterface $form_state) { '@url' => 'http://www.w3.org/International/articles/language-tags/', ))); } - if ($form_state->getValue('label') != SafeMarkup::checkPlain($form_state->getValue('label'))) { + if ($form_state->getValue('label') != Html::escape($form_state->getValue('label'))) { $form_state->setErrorByName('label', $this->t('%field cannot contain any markup.', array('%field' => $form['label']['#title']))); } } diff --git a/core/modules/language/src/Form/NegotiationConfigureForm.php b/core/modules/language/src/Form/NegotiationConfigureForm.php index 938564e..f1ebc15 100644 --- a/core/modules/language/src/Form/NegotiationConfigureForm.php +++ b/core/modules/language/src/Form/NegotiationConfigureForm.php @@ -8,7 +8,6 @@ namespace Drupal\language\Form; use Drupal\Core\Block\BlockManagerInterface; -use Drupal\Component\Utility\SafeMarkup; use Drupal\Component\Utility\Unicode; use Drupal\Component\Utility\Xss; use Drupal\Core\Config\ConfigFactoryInterface; @@ -277,11 +276,11 @@ protected function configureFormTable(array &$form, $type) { if (isset($types[$type])) { $table_form['#language_negotiation_info'][$method_id] = $method; - $method_name = SafeMarkup::checkPlain($method['name']); + $method_name = $method['name']; $table_form['weight'][$method_id] = array( '#type' => 'weight', - '#title' => $this->t('Weight for !title language detection method', array('!title' => Unicode::strtolower($method_name))), + '#title' => $this->t('Weight for @title language detection method', array('@title' => Unicode::strtolower($method_name))), '#title_display' => 'invisible', '#default_value' => $weight, '#attributes' => array('class' => array("language-method-weight-$type")), @@ -292,7 +291,7 @@ protected function configureFormTable(array &$form, $type) { $table_form['enabled'][$method_id] = array( '#type' => 'checkbox', - '#title' => $this->t('Enable !title language detection method', array('!title' => Unicode::strtolower($method_name))), + '#title' => $this->t('Enable @title language detection method', array('@title' => Unicode::strtolower($method_name))), '#title_display' => 'invisible', '#default_value' => $enabled, ); diff --git a/core/modules/link/link.module b/core/modules/link/link.module index 8ce087f..e8d53f8 100644 --- a/core/modules/link/link.module +++ b/core/modules/link/link.module @@ -5,7 +5,6 @@ * Defines simple link field types. */ -use Drupal\Component\Utility\SafeMarkup; use Drupal\Core\Routing\RouteMatchInterface; /** @@ -62,9 +61,5 @@ function link_theme() { * - url: A \Drupal\Core\Url object. */ function template_preprocess_link_formatter_link_separate(&$variables) { - if (!empty($variables['title'])) { - $variables['title'] = SafeMarkup::checkPlain($variables['title']); - } - $variables['link'] = \Drupal::l($variables['url_title'], $variables['url']); } diff --git a/core/modules/link/src/Plugin/Field/FieldFormatter/LinkFormatter.php b/core/modules/link/src/Plugin/Field/FieldFormatter/LinkFormatter.php index eb3804a..02f06ed 100644 --- a/core/modules/link/src/Plugin/Field/FieldFormatter/LinkFormatter.php +++ b/core/modules/link/src/Plugin/Field/FieldFormatter/LinkFormatter.php @@ -7,7 +7,6 @@ namespace Drupal\link\Plugin\Field\FieldFormatter; -use Drupal\Component\Utility\SafeMarkup; use Drupal\Component\Utility\Unicode; use Drupal\Component\Utility\UrlHelper; use Drupal\Core\Field\FieldDefinitionInterface; @@ -16,6 +15,7 @@ use Drupal\Core\Form\FormStateInterface; use Drupal\Core\Path\PathValidatorInterface; use Drupal\Core\Plugin\ContainerFactoryPluginInterface; +use Drupal\Core\Render\Element\Markup; use Drupal\Core\Url; use Drupal\link\LinkItemInterface; use Symfony\Component\DependencyInjection\ContainerInterface; @@ -201,7 +201,8 @@ public function viewElements(FieldItemListInterface $items) { if (!empty($settings['url_only']) && !empty($settings['url_plain'])) { $element[$delta] = array( - '#markup' => SafeMarkup::checkPlain($link_title), + '#markup' => $link_title, + '#safe_strategy' => Markup::SAFE_STRATEGY_ESCAPE, ); if (!empty($item->_attributes)) { diff --git a/core/modules/link/src/Tests/LinkFieldTest.php b/core/modules/link/src/Tests/LinkFieldTest.php index 558e78f..b39a2f5 100644 --- a/core/modules/link/src/Tests/LinkFieldTest.php +++ b/core/modules/link/src/Tests/LinkFieldTest.php @@ -7,7 +7,7 @@ namespace Drupal\link\Tests; -use Drupal\Component\Utility\SafeMarkup; +use Drupal\Component\Utility\Html; use Drupal\Component\Utility\Unicode; use Drupal\Core\Url; use Drupal\link\LinkItemInterface; @@ -420,39 +420,39 @@ function testLinkFormatter() { case 'trim_length': $url = $url1; $title = isset($new_value) ? Unicode::truncate($title1, $new_value, FALSE, TRUE) : $title1; - $this->assertRaw('' . SafeMarkup::checkPlain($title) . ''); + $this->assertRaw('' . Html::escape($title) . ''); $url = $url2; $title = isset($new_value) ? Unicode::truncate($title2, $new_value, FALSE, TRUE) : $title2; - $this->assertRaw('' . SafeMarkup::checkPlain($title) . ''); + $this->assertRaw('' . Html::escape($title) . ''); break; case 'rel': $rel = isset($new_value) ? ' rel="' . $new_value . '"' : ''; - $this->assertRaw('' . SafeMarkup::checkPlain($title1) . ''); - $this->assertRaw('' . SafeMarkup::checkPlain($title2) . ''); + $this->assertRaw('' . Html::escape($title1) . ''); + $this->assertRaw('' . Html::escape($title2) . ''); break; case 'target': $target = isset($new_value) ? ' target="' . $new_value . '"' : ''; - $this->assertRaw('' . SafeMarkup::checkPlain($title1) . ''); - $this->assertRaw('' . SafeMarkup::checkPlain($title2) . ''); + $this->assertRaw('' . Html::escape($title1) . ''); + $this->assertRaw('' . Html::escape($title2) . ''); break; case 'url_only': // In this case, $new_value is an array. if (!$new_value['url_only']) { - $this->assertRaw('' . SafeMarkup::checkPlain($title1) . ''); - $this->assertRaw('' . SafeMarkup::checkPlain($title2) . ''); + $this->assertRaw('' . Html::escape($title1) . ''); + $this->assertRaw('' . Html::escape($title2) . ''); } else { if (empty($new_value['url_plain'])) { - $this->assertRaw('' . SafeMarkup::checkPlain($url1) . ''); - $this->assertRaw('' . SafeMarkup::checkPlain($url2) . ''); + $this->assertRaw('' . Html::escape($url1) . ''); + $this->assertRaw('' . Html::escape($url2) . ''); } else { - $this->assertNoRaw('' . SafeMarkup::checkPlain($url1) . ''); - $this->assertNoRaw('' . SafeMarkup::checkPlain($url2) . ''); + $this->assertNoRaw('' . Html::escape($url1) . ''); + $this->assertNoRaw('' . Html::escape($url2) . ''); $this->assertEscaped($url1); $this->assertEscaped($url2); } @@ -540,7 +540,7 @@ function testLinkSeparateFormatter() { $url = $url1; $url_title = isset($new_value) ? Unicode::truncate($url, $new_value, FALSE, TRUE) : $url; $expected = '
' . Xss::filterAdmin($this->token->replace($this->getBody())) . '
'; return array('#markup' => $output); } diff --git a/core/modules/tour/tests/tour_test/src/Plugin/tour/tip/TipPluginImage.php b/core/modules/tour/tests/tour_test/src/Plugin/tour/tip/TipPluginImage.php index 5c683b9..503a909 100644 --- a/core/modules/tour/tests/tour_test/src/Plugin/tour/tip/TipPluginImage.php +++ b/core/modules/tour/tests/tour_test/src/Plugin/tour/tip/TipPluginImage.php @@ -7,7 +7,7 @@ namespace Drupal\tour_test\Plugin\tour\tip; -use Drupal\Component\Utility\SafeMarkup; +use Drupal\Component\Utility\Html; use Drupal\tour\TipPluginBase; /** @@ -40,7 +40,7 @@ class TipPluginImage extends TipPluginBase { * {@inheritdoc} */ public function getOutput() { - $prefix = ''; return [ '#prefix' => $prefix, diff --git a/core/modules/tracker/src/Controller/TrackerUserTab.php b/core/modules/tracker/src/Controller/TrackerUserTab.php index ae21548..3aca4c0 100644 --- a/core/modules/tracker/src/Controller/TrackerUserTab.php +++ b/core/modules/tracker/src/Controller/TrackerUserTab.php @@ -9,7 +9,6 @@ use Drupal\Core\Controller\ControllerBase; use Drupal\user\UserInterface; -use Drupal\Component\Utility\SafeMarkup; /** * Controller for tracker.user_tab route. @@ -28,6 +27,6 @@ public function getContent(UserInterface $user) { * Title callback for the tracker.user_tab route. */ public function getTitle(UserInterface $user) { - return SafeMarkup::checkPlain($user->getUsername()); + return $user->getUsername(); } } diff --git a/core/modules/tracker/tracker.pages.inc b/core/modules/tracker/tracker.pages.inc index 3be3966..5ff0e06 100644 --- a/core/modules/tracker/tracker.pages.inc +++ b/core/modules/tracker/tracker.pages.inc @@ -5,7 +5,6 @@ * User page callbacks for tracker.module. */ -use Drupal\Component\Utility\SafeMarkup; use Drupal\Core\Cache\Cache; use Drupal\node\Entity\Node; @@ -85,7 +84,7 @@ function tracker_page($account = NULL) { } $row = array( - 'type' => SafeMarkup::checkPlain(node_get_type_label($node)), + 'type' => node_get_type_label($node), 'title' => array( 'data' => array( '#type' => 'link', diff --git a/core/modules/update/src/Form/UpdateManagerUpdate.php b/core/modules/update/src/Form/UpdateManagerUpdate.php index f0f64ea..cafa4d1 100644 --- a/core/modules/update/src/Form/UpdateManagerUpdate.php +++ b/core/modules/update/src/Form/UpdateManagerUpdate.php @@ -7,7 +7,6 @@ namespace Drupal\update\Form; -use Drupal\Component\Utility\SafeMarkup; use Drupal\Core\Extension\ModuleHandlerInterface; use Drupal\Core\Form\FormBase; use Drupal\Core\Form\FormStateInterface; @@ -115,14 +114,14 @@ public function buildForm(array $form, FormStateInterface $form_state) { $project_name = $this->l($project['title'], Url::fromUri($project['link'])); } else { - $project_name = SafeMarkup::checkPlain($project['title']); + $project_name = $project['title']; } } elseif (!empty($project['info']['name'])) { - $project_name = SafeMarkup::checkPlain($project['info']['name']); + $project_name = $project['info']['name']; } else { - $project_name = SafeMarkup::checkPlain($name); + $project_name = $name; } if ($project['project_type'] == 'theme' || $project['project_type'] == 'theme-disabled') { $project_name .= ' ' . $this->t('(Theme)'); diff --git a/core/modules/user/src/AccountForm.php b/core/modules/user/src/AccountForm.php index 0bcfad9..2fdbcea 100644 --- a/core/modules/user/src/AccountForm.php +++ b/core/modules/user/src/AccountForm.php @@ -205,7 +205,7 @@ public function form(array $form, FormStateInterface $form_state) { '#access' => $admin, ); - $roles = array_map(array('\Drupal\Component\Utility\SafeMarkup', 'checkPlain'), user_role_names(TRUE)); + $roles = user_role_names(TRUE); $form['account']['roles'] = array( '#type' => 'checkboxes', diff --git a/core/modules/user/src/Form/UserPermissionsForm.php b/core/modules/user/src/Form/UserPermissionsForm.php index 0e0a01a..e96efda 100644 --- a/core/modules/user/src/Form/UserPermissionsForm.php +++ b/core/modules/user/src/Form/UserPermissionsForm.php @@ -7,7 +7,6 @@ namespace Drupal\user\Form; -use Drupal\Component\Utility\SafeMarkup; use Drupal\Core\Extension\ModuleHandlerInterface; use Drupal\Core\Form\FormBase; use Drupal\Core\Form\FormStateInterface; @@ -94,7 +93,7 @@ public function buildForm(array $form, FormStateInterface $form_state) { $admin_roles = array(); foreach ($this->getRoles() as $role_name => $role) { // Retrieve role names for columns. - $role_names[$role_name] = SafeMarkup::checkPlain($role->label()); + $role_names[$role_name] = $role->label(); // Fetch permissions for the roles. $role_permissions[$role_name] = $role->getPermissions(); $admin_roles[$role_name] = $role->isAdmin(); diff --git a/core/modules/user/src/Plugin/Condition/UserRole.php b/core/modules/user/src/Plugin/Condition/UserRole.php index 3316cbc..bd98a75 100644 --- a/core/modules/user/src/Plugin/Condition/UserRole.php +++ b/core/modules/user/src/Plugin/Condition/UserRole.php @@ -33,7 +33,7 @@ public function buildConfigurationForm(array $form, FormStateInterface $form_sta '#type' => 'checkboxes', '#title' => $this->t('When the user has the following roles'), '#default_value' => $this->configuration['roles'], - '#options' => array_map('\Drupal\Component\Utility\SafeMarkup::checkPlain', user_role_names()), + '#options' => user_role_names(), '#description' => $this->t('If you select no roles, the condition will evaluate to TRUE for all users.'), ); return parent::buildConfigurationForm($form, $form_state); diff --git a/core/modules/user/src/Plugin/views/access/Permission.php b/core/modules/user/src/Plugin/views/access/Permission.php index 0dc5165..fab8f88 100644 --- a/core/modules/user/src/Plugin/views/access/Permission.php +++ b/core/modules/user/src/Plugin/views/access/Permission.php @@ -7,7 +7,6 @@ namespace Drupal\user\Plugin\views\access; -use Drupal\Component\Utility\SafeMarkup; use Drupal\Core\Extension\ModuleHandlerInterface; use Drupal\Core\Form\FormStateInterface; use Drupal\Core\Session\AccountInterface; @@ -121,7 +120,7 @@ public function buildOptionsForm(&$form, FormStateInterface $form_state) { foreach ($permissions as $perm => $perm_item) { $provider = $perm_item['provider']; $display_name = $this->moduleHandler->getName($provider); - $perms[$display_name][$perm] = SafeMarkup::checkPlain(strip_tags($perm_item['title'])); + $perms[$display_name][$perm] = strip_tags($perm_item['title']); } $form['perm'] = array( diff --git a/core/modules/user/src/Plugin/views/access/Role.php b/core/modules/user/src/Plugin/views/access/Role.php index 4c2b732..360fe08 100644 --- a/core/modules/user/src/Plugin/views/access/Role.php +++ b/core/modules/user/src/Plugin/views/access/Role.php @@ -7,7 +7,6 @@ namespace Drupal\user\Plugin\views\access; -use Drupal\Component\Utility\SafeMarkup; use Drupal\Core\Form\FormStateInterface; use Drupal\user\RoleStorageInterface; use Drupal\views\Plugin\CacheablePluginInterface; @@ -97,7 +96,7 @@ public function summaryTitle() { else { $rids = user_role_names(); $rid = reset($this->options['role']); - return SafeMarkup::checkPlain($rids[$rid]); + return $rids[$rid]; } } @@ -115,7 +114,7 @@ public function buildOptionsForm(&$form, FormStateInterface $form_state) { '#type' => 'checkboxes', '#title' => $this->t('Role'), '#default_value' => $this->options['role'], - '#options' => array_map('\Drupal\Component\Utility\SafeMarkup::checkPlain', user_role_names()), + '#options' => user_role_names(), '#description' => $this->t('Only the checked roles will be able to access this display.'), ); } diff --git a/core/modules/user/src/Plugin/views/argument/RolesRid.php b/core/modules/user/src/Plugin/views/argument/RolesRid.php index 7fd209d..c43989c 100644 --- a/core/modules/user/src/Plugin/views/argument/RolesRid.php +++ b/core/modules/user/src/Plugin/views/argument/RolesRid.php @@ -7,7 +7,6 @@ namespace Drupal\user\Plugin\views\argument; -use Drupal\Component\Utility\SafeMarkup; use Drupal\Core\Entity\EntityManagerInterface; use Drupal\views\Plugin\views\argument\ManyToOne; use Symfony\Component\DependencyInjection\ContainerInterface; @@ -60,7 +59,7 @@ public function title_query() { $entities = $this->roleStorage->loadMultiple($this->value); $titles = array(); foreach ($entities as $entity) { - $titles[] = SafeMarkup::checkPlain($entity->label()); + $titles[] = $entity->label(); } return $titles; } diff --git a/core/modules/user/src/Plugin/views/argument/Uid.php b/core/modules/user/src/Plugin/views/argument/Uid.php index c365009..1cd76e9 100644 --- a/core/modules/user/src/Plugin/views/argument/Uid.php +++ b/core/modules/user/src/Plugin/views/argument/Uid.php @@ -7,7 +7,6 @@ namespace Drupal\user\Plugin\views\argument; -use Drupal\Component\Utility\SafeMarkup; use Drupal\Core\Entity\EntityStorageInterface; use Drupal\views\Plugin\views\argument\NumericArgument; use Symfony\Component\DependencyInjection\ContainerInterface; @@ -61,7 +60,7 @@ public static function create(ContainerInterface $container, array $configuratio */ public function titleQuery() { return array_map(function($account) { - return SafeMarkup::checkPlain($account->label()); + return $account->label(); }, $this->storage->loadMultiple($this->value)); } diff --git a/core/modules/user/src/Plugin/views/argument_validator/User.php b/core/modules/user/src/Plugin/views/argument_validator/User.php index ede8dd5..49277c8 100644 --- a/core/modules/user/src/Plugin/views/argument_validator/User.php +++ b/core/modules/user/src/Plugin/views/argument_validator/User.php @@ -65,7 +65,7 @@ public function buildOptionsForm(&$form, FormStateInterface $form_state) { $form['roles'] = array( '#type' => 'checkboxes', '#title' => $this->t('Restrict to the selected roles'), - '#options' => array_map(array('\Drupal\Component\Utility\SafeMarkup', 'checkPlain'), user_role_names(TRUE)), + '#options' => user_role_names(TRUE), '#default_value' => $this->options['roles'], '#description' => $this->t('If no roles are selected, users from any role will be allowed.'), '#states' => array( diff --git a/core/modules/user/src/Plugin/views/field/Roles.php b/core/modules/user/src/Plugin/views/field/Roles.php index 403e9a4..9f8bfe2 100644 --- a/core/modules/user/src/Plugin/views/field/Roles.php +++ b/core/modules/user/src/Plugin/views/field/Roles.php @@ -7,7 +7,6 @@ namespace Drupal\user\Plugin\views\field; -use Drupal\Component\Utility\SafeMarkup; use Drupal\Core\Database\Connection; use Drupal\views\Plugin\views\display\DisplayPluginBase; use Drupal\views\ViewExecutable; @@ -81,7 +80,7 @@ public function preRender(&$values) { $roles = user_roles(); $result = $this->database->query('SELECT u.entity_id as uid, u.roles_target_id as rid FROM {user__roles} u WHERE u.entity_id IN ( :uids[] ) AND u.roles_target_id IN ( :rids[] )', array(':uids[]' => $uids, ':rids[]' => array_keys($roles))); foreach ($result as $role) { - $this->items[$role->uid][$role->rid]['role'] = SafeMarkup::checkPlain($roles[$role->rid]->label()); + $this->items[$role->uid][$role->rid]['role'] = $roles[$role->rid]->label(); $this->items[$role->uid][$role->rid]['rid'] = $role->rid; } // Sort the roles for each user by role weight. diff --git a/core/modules/user/src/Plugin/views/filter/Permissions.php b/core/modules/user/src/Plugin/views/filter/Permissions.php index a637705..f38344b 100644 --- a/core/modules/user/src/Plugin/views/filter/Permissions.php +++ b/core/modules/user/src/Plugin/views/filter/Permissions.php @@ -7,7 +7,6 @@ namespace Drupal\user\Plugin\views\filter; -use Drupal\Component\Utility\SafeMarkup; use Drupal\Core\Extension\ModuleHandlerInterface; use Drupal\user\PermissionHandlerInterface; use Drupal\views\Plugin\views\filter\ManyToOne; @@ -76,7 +75,7 @@ public function getValueOptions() { foreach ($permissions as $perm => $perm_item) { $provider = $perm_item['provider']; $display_name = $this->moduleHandler->getName($provider); - $this->valueOptions[$display_name][$perm] = SafeMarkup::checkPlain(strip_tags($perm_item['title'])); + $this->valueOptions[$display_name][$perm] = strip_tags($perm_item['title']); } } else { diff --git a/core/modules/user/src/Tests/UserTokenReplaceTest.php b/core/modules/user/src/Tests/UserTokenReplaceTest.php index 508275c..661ce2f 100644 --- a/core/modules/user/src/Tests/UserTokenReplaceTest.php +++ b/core/modules/user/src/Tests/UserTokenReplaceTest.php @@ -7,7 +7,7 @@ namespace Drupal\user\Tests; -use Drupal\Component\Utility\SafeMarkup; +use Drupal\Component\Utility\Html; use Drupal\Core\Render\BubbleableMetadata; use Drupal\language\Entity\ConfigurableLanguage; use Drupal\simpletest\WebTestBase; @@ -57,15 +57,15 @@ function testUserTokenReplacement() { // Generate and test sanitized tokens. $tests = array(); $tests['[user:uid]'] = $account->id(); - $tests['[user:name]'] = SafeMarkup::checkPlain(user_format_name($account)); - $tests['[user:mail]'] = SafeMarkup::checkPlain($account->getEmail()); + $tests['[user:name]'] = Html::escape(user_format_name($account)); + $tests['[user:mail]'] = Html::escape($account->getEmail()); $tests['[user:url]'] = $account->url('canonical', $url_options); $tests['[user:edit-url]'] = $account->url('edit-form', $url_options); $tests['[user:last-login]'] = format_date($account->getLastLoginTime(), 'medium', '', NULL, $language_interface->getId()); $tests['[user:last-login:short]'] = format_date($account->getLastLoginTime(), 'short', '', NULL, $language_interface->getId()); $tests['[user:created]'] = format_date($account->getCreatedTime(), 'medium', '', NULL, $language_interface->getId()); $tests['[user:created:short]'] = format_date($account->getCreatedTime(), 'short', '', NULL, $language_interface->getId()); - $tests['[current-user:name]'] = SafeMarkup::checkPlain(user_format_name($global_account)); + $tests['[current-user:name]'] = Html::escape(user_format_name($global_account)); $base_bubbleable_metadata = BubbleableMetadata::createFromObject($account); $metadata_tests = []; @@ -101,7 +101,7 @@ function testUserTokenReplacement() { $anonymous_user = User::load(0); $tests = []; $tests['[user:uid]'] = t('not yet assigned'); - $tests['[user:name]'] = SafeMarkup::checkPlain(user_format_name($anonymous_user)); + $tests['[user:name]'] = Html::escape(user_format_name($anonymous_user)); $base_bubbleable_metadata = BubbleableMetadata::createFromObject($anonymous_user); $metadata_tests = []; diff --git a/core/modules/user/src/Tests/Views/AccessPermissionTest.php b/core/modules/user/src/Tests/Views/AccessPermissionTest.php index 3e77e2a..8ac018b 100644 --- a/core/modules/user/src/Tests/Views/AccessPermissionTest.php +++ b/core/modules/user/src/Tests/Views/AccessPermissionTest.php @@ -35,7 +35,9 @@ function testAccessPerm() { $access_plugin = $view->display_handler->getPlugin('access'); $this->assertTrue($access_plugin instanceof Permission, 'Make sure the right class got instantiated.'); - $this->assertEqual($access_plugin->pluginTitle(), t('Permission')); + // The plugin title will be a tranlsation wrapper, cast to a string to test + // the value. + $this->assertEqual((string) $access_plugin->pluginTitle(), t('Permission')); $this->assertFalse($view->display_handler->access($this->webUser)); $this->assertTrue($view->display_handler->access($this->normalUser)); diff --git a/core/modules/user/src/Tests/Views/HandlerFilterPermissionTest.php b/core/modules/user/src/Tests/Views/HandlerFilterPermissionTest.php index 5ea1b0f..3521f68 100644 --- a/core/modules/user/src/Tests/Views/HandlerFilterPermissionTest.php +++ b/core/modules/user/src/Tests/Views/HandlerFilterPermissionTest.php @@ -7,7 +7,6 @@ namespace Drupal\user\Tests\Views; -use Drupal\Component\Utility\SafeMarkup; use Drupal\views\Views; /** @@ -86,7 +85,7 @@ public function testFilterPermission() { } foreach (array('system' => 'System', 'user' => 'User') as $module => $title) { $expected = array_map(function ($permission) { - return SafeMarkup::checkPlain(strip_tags($permission['title'])); + return strip_tags($permission['title']); }, $permission_by_module[$module]); $this->assertEqual($expected, $value_options[$title], 'Ensure the all permissions are available'); diff --git a/core/modules/user/src/UserListBuilder.php b/core/modules/user/src/UserListBuilder.php index 7575b86..85b52f2 100644 --- a/core/modules/user/src/UserListBuilder.php +++ b/core/modules/user/src/UserListBuilder.php @@ -138,7 +138,7 @@ public function buildRow(EntityInterface $entity) { ); $row['status'] = $entity->isActive() ? $this->t('active') : $this->t('blocked'); - $roles = array_map('\Drupal\Component\Utility\SafeMarkup::checkPlain', user_role_names(TRUE)); + $roles = user_role_names(TRUE); unset($roles[RoleInterface::AUTHENTICATED_ID]); $users_roles = array(); foreach ($entity->getRoles() as $role) { diff --git a/core/modules/user/tests/src/Unit/Views/Argument/RolesRidTest.php b/core/modules/user/tests/src/Unit/Views/Argument/RolesRidTest.php index 3a4db29..57699fb 100644 --- a/core/modules/user/tests/src/Unit/Views/Argument/RolesRidTest.php +++ b/core/modules/user/tests/src/Unit/Views/Argument/RolesRidTest.php @@ -7,7 +7,6 @@ namespace Drupal\Tests\user\Unit\Views\Argument; -use Drupal\Component\Utility\SafeMarkup; use Drupal\Core\DependencyInjection\ContainerBuilder; use Drupal\Tests\UnitTestCase; use Drupal\user\Entity\Role; @@ -81,7 +80,7 @@ public function testTitleQuery() { $roles_rid_argument->value = array('test_rid_1', 'test_rid_2'); $titles = $roles_rid_argument->title_query(); - $this->assertEquals(array('test rid 1', SafeMarkup::checkPlain('test rid 2')), $titles); + $this->assertEquals(array('test rid 1', 'test rid 2'), $titles); } } diff --git a/core/modules/user/user.module b/core/modules/user/user.module index 5f990ca..2009857 100644 --- a/core/modules/user/user.module +++ b/core/modules/user/user.module @@ -1,7 +1,6 @@ hasPermission('access user profiles'); $external = FALSE; diff --git a/core/modules/user/user.tokens.inc b/core/modules/user/user.tokens.inc index 582c1cd..9cb61f6 100644 --- a/core/modules/user/user.tokens.inc +++ b/core/modules/user/user.tokens.inc @@ -5,7 +5,7 @@ * Builds placeholder replacement tokens for user-related data. */ -use Drupal\Component\Utility\SafeMarkup; +use Drupal\Component\Utility\Html; use Drupal\Core\Datetime\Entity\DateFormat; use Drupal\Core\Render\BubbleableMetadata; use Drupal\user\Entity\User; @@ -97,11 +97,11 @@ function user_tokens($type, $tokens, array $data, array $options, BubbleableMeta if ($account->isAnonymous()) { $bubbleable_metadata->addCacheableDependency(\Drupal::config('user.settings')); } - $replacements[$original] = $sanitize ? SafeMarkup::checkPlain($name) : $name; + $replacements[$original] = $sanitize ? Html::escape($name) : $name; break; case 'mail': - $replacements[$original] = $sanitize ? SafeMarkup::checkPlain($account->getEmail()) : $account->getEmail(); + $replacements[$original] = $sanitize ? Html::escape($account->getEmail()) : $account->getEmail(); break; case 'url': diff --git a/core/modules/views/src/Plugin/views/HandlerBase.php b/core/modules/views/src/Plugin/views/HandlerBase.php index f2e5604..a891fbf 100644 --- a/core/modules/views/src/Plugin/views/HandlerBase.php +++ b/core/modules/views/src/Plugin/views/HandlerBase.php @@ -7,7 +7,7 @@ namespace Drupal\views\Plugin\views; -use Drupal\Component\Utility\SafeMarkup; +use Drupal\Component\Utility\Html; use Drupal\Component\Utility\Unicode; use Drupal\Component\Utility\UrlHelper; use Drupal\Component\Utility\Xss; @@ -181,8 +181,7 @@ protected function defineOptions() { */ public function adminLabel($short = FALSE) { if (!empty($this->options['admin_label'])) { - $title = SafeMarkup::checkPlain($this->options['admin_label']); - return $title; + return $this->options['admin_label']; } $title = ($short && isset($this->definition['title short'])) ? $this->definition['title short'] : $this->definition['title']; return $this->t('!group: !title', array('!group' => $this->definition['group'], '!title' => $title)); @@ -230,10 +229,10 @@ public function sanitizeValue($value, $type = NULL) { $value = Xss::filterAdmin($value); break; case 'url': - $value = SafeMarkup::checkPlain(UrlHelper::stripDangerousProtocols($value)); + $value = Html::escape(UrlHelper::stripDangerousProtocols($value)); break; default: - $value = SafeMarkup::checkPlain($value); + $value = Html::escape($value); break; } return $value; diff --git a/core/modules/views/src/Plugin/views/PluginBase.php b/core/modules/views/src/Plugin/views/PluginBase.php index e56dcae..6811136 100644 --- a/core/modules/views/src/Plugin/views/PluginBase.php +++ b/core/modules/views/src/Plugin/views/PluginBase.php @@ -8,7 +8,7 @@ namespace Drupal\views\Plugin\views; use Drupal\Component\Plugin\DependentPluginInterface; -use Drupal\Component\Utility\SafeMarkup; +use Drupal\Component\Utility\Html; use Drupal\Component\Utility\Xss; use Drupal\Core\Form\FormStateInterface; use Drupal\Core\Language\LanguageInterface; @@ -314,9 +314,9 @@ public function summaryTitle() { public function pluginTitle() { // Short_title is optional so its defaults to an empty string. if (!empty($this->definition['short_title'])) { - return SafeMarkup::checkPlain($this->definition['short_title']); + return $this->definition['short_title']; } - return SafeMarkup::checkPlain($this->definition['title']); + return $this->definition['title']; } /** @@ -365,7 +365,8 @@ protected function viewsTokenReplace($text, $tokens) { if (strpos($token, '{{') !== FALSE) { // Twig wants a token replacement array stripped of curly-brackets. $token = trim(str_replace(array('{', '}'), '', $token)); - $twig_tokens[$token] = $replacement; + // Twig will auto-escape any encoded HTML entities. + $twig_tokens[$token] = Html::decodeEntities($replacement); } else { $other_tokens[$token] = $replacement; diff --git a/core/modules/views/src/Plugin/views/ViewsHandlerInterface.php b/core/modules/views/src/Plugin/views/ViewsHandlerInterface.php index 1775d99..6916fbb 100644 --- a/core/modules/views/src/Plugin/views/ViewsHandlerInterface.php +++ b/core/modules/views/src/Plugin/views/ViewsHandlerInterface.php @@ -72,7 +72,8 @@ public function getJoin(); * @param $value * The value being rendered. * @param $type - * The type of sanitization needed. If not provided, SafeMarkup::checkPlain() is used. + * The type of sanitization needed. If not provided, + * \Drupal\Component\Utility\Html::escape() is used. * * @return string * Returns the safe value. diff --git a/core/modules/views/src/Plugin/views/area/Result.php b/core/modules/views/src/Plugin/views/area/Result.php index 02017e3..3079f0d 100644 --- a/core/modules/views/src/Plugin/views/area/Result.php +++ b/core/modules/views/src/Plugin/views/area/Result.php @@ -7,7 +7,7 @@ namespace Drupal\views\Plugin\views\area; -use Drupal\Component\Utility\SafeMarkup; +use Drupal\Component\Utility\Html; use Drupal\Component\Utility\Xss; use Drupal\Core\Form\FormStateInterface; use Drupal\views\Plugin\views\style\DefaultSummary; @@ -87,7 +87,7 @@ public function render($empty = FALSE) { // @TODO: Maybe use a possible is views empty functionality. // Not every view has total_rows set, use view->result instead. $total = isset($this->view->total_rows) ? $this->view->total_rows : count($this->view->result); - $label = SafeMarkup::checkPlain($this->view->storage->label()); + $label = Html::escape($this->view->storage->label()); if ($per_page === 0) { $page_count = 1; $start = 1; diff --git a/core/modules/views/src/Plugin/views/argument/ArgumentPluginBase.php b/core/modules/views/src/Plugin/views/argument/ArgumentPluginBase.php index a1f1c5e..b95e942 100644 --- a/core/modules/views/src/Plugin/views/argument/ArgumentPluginBase.php +++ b/core/modules/views/src/Plugin/views/argument/ArgumentPluginBase.php @@ -10,7 +10,6 @@ use Drupal\Component\Plugin\DependentPluginInterface; use Drupal\Component\Utility\Html; use Drupal\Component\Utility\NestedArray; -use Drupal\Component\Utility\SafeMarkup; use Drupal\Core\Form\FormStateInterface; use Drupal\Core\Render\Element; use Drupal\views\Plugin\CacheablePluginInterface; @@ -882,7 +881,7 @@ public function summaryName($data) { if (empty($value) && !empty($this->definition['empty field name'])) { $value = $this->definition['empty field name']; } - return SafeMarkup::checkPlain($value); + return $value; } /** @@ -901,7 +900,7 @@ public function query($group_by = FALSE) { * This usually needs to be overridden to provide a proper title. */ function title() { - return SafeMarkup::checkPlain($this->argument); + return $this->argument; } /** diff --git a/core/modules/views/src/Plugin/views/argument/FieldList.php b/core/modules/views/src/Plugin/views/argument/FieldList.php index 9764f0f..b149cd0 100644 --- a/core/modules/views/src/Plugin/views/argument/FieldList.php +++ b/core/modules/views/src/Plugin/views/argument/FieldList.php @@ -7,7 +7,6 @@ namespace Drupal\views\Plugin\views\argument; -use Drupal\Component\Utility\SafeMarkup; use Drupal\Core\Field\AllowedTagsXssTrait; use Drupal\Core\Form\FormStateInterface; use Drupal\views\ViewExecutable; @@ -74,7 +73,7 @@ public function summaryName($data) { } // else fallback to the key. else { - return SafeMarkup::checkPlain($value); + return $value; } } diff --git a/core/modules/views/src/Plugin/views/argument/ListString.php b/core/modules/views/src/Plugin/views/argument/ListString.php index 202d070..6ee549c 100644 --- a/core/modules/views/src/Plugin/views/argument/ListString.php +++ b/core/modules/views/src/Plugin/views/argument/ListString.php @@ -7,7 +7,6 @@ namespace Drupal\views\Plugin\views\argument; -use Drupal\Component\Utility\SafeMarkup; use Drupal\Core\Field\AllowedTagsXssTrait; use Drupal\Core\Form\FormStateInterface; use Drupal\views\ViewExecutable; @@ -76,7 +75,7 @@ public function summaryName($data) { } // else fallback to the key. else { - return $this->caseTransform(SafeMarkup::checkPlain($value), $this->options['case']); + return $this->caseTransform($value, $this->options['case']); } } diff --git a/core/modules/views/src/Plugin/views/argument/StringArgument.php b/core/modules/views/src/Plugin/views/argument/StringArgument.php index d417e81..a9c146d 100644 --- a/core/modules/views/src/Plugin/views/argument/StringArgument.php +++ b/core/modules/views/src/Plugin/views/argument/StringArgument.php @@ -317,7 +317,7 @@ function title() { * Override for specific title lookups. */ public function titleQuery() { - return array_map('\Drupal\Component\Utility\SafeMarkup::checkPlain', array_combine($this->value, $this->value)); + return array_combine($this->value, $this->value); } public function summaryName($data) { diff --git a/core/modules/views/src/Plugin/views/display/Attachment.php b/core/modules/views/src/Plugin/views/display/Attachment.php index dcc4282..8a36066 100644 --- a/core/modules/views/src/Plugin/views/display/Attachment.php +++ b/core/modules/views/src/Plugin/views/display/Attachment.php @@ -7,7 +7,6 @@ namespace Drupal\views\Plugin\views\display; -use Drupal\Component\Utility\SafeMarkup; use Drupal\Core\Form\FormStateInterface; use Drupal\views\ViewExecutable; @@ -92,7 +91,7 @@ public function optionsSummary(&$categories, &$options) { elseif (count($displays) == 1) { $display = array_shift($displays); if ($display = $this->view->storage->getDisplay($display)) { - $attach_to = SafeMarkup::checkPlain($display['display_title']); + $attach_to = $display['display_title']; } } diff --git a/core/modules/views/src/Plugin/views/display/Block.php b/core/modules/views/src/Plugin/views/display/Block.php index 411c50e..08e4467 100644 --- a/core/modules/views/src/Plugin/views/display/Block.php +++ b/core/modules/views/src/Plugin/views/display/Block.php @@ -7,7 +7,6 @@ namespace Drupal\views\Plugin\views\display; -use Drupal\Component\Utility\SafeMarkup; use Drupal\Core\Entity\EntityManagerInterface; use Drupal\Core\Form\FormStateInterface; use Drupal\views\Plugin\Block\ViewsBlock; @@ -149,7 +148,7 @@ public function optionsSummary(&$categories, &$options) { if (empty($block_description)) { $block_description = $this->t('None'); } - $block_category = SafeMarkup::checkPlain($this->getOption('block_category')); + $block_category = $this->getOption('block_category'); $options['block_description'] = array( 'category' => 'block', diff --git a/core/modules/views/src/Plugin/views/display/DisplayPluginBase.php b/core/modules/views/src/Plugin/views/display/DisplayPluginBase.php index f9ae57a..708f67a 100644 --- a/core/modules/views/src/Plugin/views/display/DisplayPluginBase.php +++ b/core/modules/views/src/Plugin/views/display/DisplayPluginBase.php @@ -1062,7 +1062,7 @@ public function getArgumentsTokens() { } // Use strip tags as there should never be HTML in the path. // However, we need to preserve special characters like " that - // were removed by SafeMarkup::checkPlain(). + // were removed by \Drupal\Component\Utility\Html::escape(). $tokens["!$count"] = isset($this->view->args[$count - 1]) ? strip_tags(Html::decodeEntities($this->view->args[$count - 1])) : ''; } @@ -1394,7 +1394,7 @@ public function buildOptionsForm(&$form, FormStateInterface $form_state) { if ($this->defaultableSections($section)) { views_ui_standard_display_dropdown($form, $form_state, $section); } - $form['#title'] = SafeMarkup::checkPlain($this->display['display_title']) . ': '; + $form['#title'] = $this->display['display_title'] . ': '; // Set the 'section' to highlight on the form. // If it's the item we're looking at is pulling from the default display, diff --git a/core/modules/views/src/Plugin/views/display/Feed.php b/core/modules/views/src/Plugin/views/display/Feed.php index e4da10e..f42f892 100644 --- a/core/modules/views/src/Plugin/views/display/Feed.php +++ b/core/modules/views/src/Plugin/views/display/Feed.php @@ -7,10 +7,10 @@ namespace Drupal\views\Plugin\views\display; -use Drupal\Component\Utility\SafeMarkup; use Drupal\Core\Cache\CacheableMetadata; use Drupal\Core\Cache\CacheableResponse; use Drupal\Core\Form\FormStateInterface; +use Drupal\Core\Render\Element\Markup; use Drupal\views\ViewExecutable; use Drupal\views\Views; use Symfony\Component\HttpFoundation\Response; @@ -99,7 +99,12 @@ public function preview() { if (!empty($this->view->live_preview)) { $output = array( '#prefix' => '
',
- '#markup' => SafeMarkup::checkPlain(drupal_render_root($output)),
+ // Cast the result of rendering to a string so it loses its
+ // SafeStringInterface object wrapper. Do this so that the
+ // #safe_strategy takes effect and escapes the markup. Unlike most
+ // things this intends to display the actual markup.
+ '#markup' => (string) drupal_render_root($output),
+ '#safe_strategy' => Markup::SAFE_STRATEGY_ESCAPE,
'#suffix' => '',
);
}
@@ -204,7 +209,7 @@ public function optionsSummary(&$categories, &$options) {
$display = array_shift($displays);
$displays = $this->view->storage->get('display');
if (!empty($displays[$display])) {
- $attach_to = SafeMarkup::checkPlain($displays[$display]['display_title']);
+ $attach_to = $displays[$display]['display_title'];
}
}
diff --git a/core/modules/views/src/Plugin/views/exposed_form/ExposedFormPluginBase.php b/core/modules/views/src/Plugin/views/exposed_form/ExposedFormPluginBase.php
index d17f70c..d4eb125 100644
--- a/core/modules/views/src/Plugin/views/exposed_form/ExposedFormPluginBase.php
+++ b/core/modules/views/src/Plugin/views/exposed_form/ExposedFormPluginBase.php
@@ -7,7 +7,6 @@
namespace Drupal\views\Plugin\views\exposed_form;
-use Drupal\Component\Utility\SafeMarkup;
use Drupal\Core\Form\FormState;
use Drupal\Core\Form\FormStateInterface;
use Drupal\views\Form\ViewsExposedForm;
@@ -211,7 +210,7 @@ public function exposedFormAlter(&$form, FormStateInterface $form_state) {
$exposed_sorts = array();
foreach ($this->view->sort as $id => $handler) {
if ($handler->canExpose() && $handler->isExposed()) {
- $exposed_sorts[$id] = SafeMarkup::checkPlain($handler->options['expose']['label']);
+ $exposed_sorts[$id] = $handler->options['expose']['label'];
}
}
diff --git a/core/modules/views/src/Plugin/views/field/FieldPluginBase.php b/core/modules/views/src/Plugin/views/field/FieldPluginBase.php
index 310997c..64e4501 100644
--- a/core/modules/views/src/Plugin/views/field/FieldPluginBase.php
+++ b/core/modules/views/src/Plugin/views/field/FieldPluginBase.php
@@ -1395,7 +1395,7 @@ protected function renderAsLink($alter, $text, $tokens) {
// Use strip tags as there should never be HTML in the path.
// However, we need to preserve special characters like " that
- // were removed by SafeMarkup::checkPlain().
+ // were removed by \Drupal\Component\Utility\Html::escape().
$path = strip_tags(Html::decodeEntities($this->viewsTokenReplace($path, $tokens)));
if (!empty($alter['path_case']) && $alter['path_case'] != 'none' && !$alter['url']->isRouted()) {
@@ -1481,8 +1481,7 @@ protected function renderAsLink($alter, $text, $tokens) {
$options['attributes']['rel'] = $rel;
}
- // Not sure if this SafeMarkup::checkPlain() is needed here?
- $target = SafeMarkup::checkPlain(trim($this->viewsTokenReplace($alter['target'], $tokens)));
+ $target = trim($this->viewsTokenReplace($alter['target'], $tokens));
if (!empty($target)) {
$options['attributes']['target'] = $target;
}
@@ -1564,7 +1563,7 @@ public function getRenderTokens($item) {
// Use strip tags as there should never be HTML in the path.
// However, we need to preserve special characters like " that
- // were removed by SafeMarkup::checkPlain().
+ // were removed by \Drupal\Component\Utility\Html::escape().
$tokens['!' . $count] = isset($this->view->args[$count - 1]) ? strip_tags(Html::decodeEntities($this->view->args[$count - 1])) : '';
}
diff --git a/core/modules/views/src/Plugin/views/field/MachineName.php b/core/modules/views/src/Plugin/views/field/MachineName.php
index 0c289cd..55ab72b 100644
--- a/core/modules/views/src/Plugin/views/field/MachineName.php
+++ b/core/modules/views/src/Plugin/views/field/MachineName.php
@@ -7,7 +7,6 @@
namespace Drupal\views\Plugin\views\field;
-use Drupal\Component\Utility\SafeMarkup;
use Drupal\Core\Form\FormStateInterface;
use Drupal\views\ResultRow;
@@ -83,7 +82,7 @@ public function preRender(&$values) {
public function render(ResultRow $values) {
$value = $values->{$this->field_alias};
if (!empty($this->options['machine_name']) || !isset($this->valueOptions[$value])) {
- $result = SafeMarkup::checkPlain($value);
+ $result = $value;
}
else {
$result = $this->valueOptions[$value];
diff --git a/core/modules/views/src/Plugin/views/field/Serialized.php b/core/modules/views/src/Plugin/views/field/Serialized.php
index f7f5a22..796440b 100644
--- a/core/modules/views/src/Plugin/views/field/Serialized.php
+++ b/core/modules/views/src/Plugin/views/field/Serialized.php
@@ -7,7 +7,6 @@
namespace Drupal\views\Plugin\views\field;
-use Drupal\Component\Utility\SafeMarkup;
use Drupal\Core\Form\FormStateInterface;
use Drupal\views\ResultRow;
@@ -76,11 +75,11 @@ public function render(ResultRow $values) {
$value = $values->{$this->field_alias};
if ($this->options['format'] == 'unserialized') {
- return SafeMarkup::checkPlain(print_r(unserialize($value), TRUE));
+ return print_r(unserialize($value), TRUE);
}
elseif ($this->options['format'] == 'key' && !empty($this->options['key'])) {
$value = (array) unserialize($value);
- return SafeMarkup::checkPlain($value[$this->options['key']]);
+ return $value[$this->options['key']];
}
return $value;
diff --git a/core/modules/views/src/Plugin/views/filter/FilterPluginBase.php b/core/modules/views/src/Plugin/views/filter/FilterPluginBase.php
index d2e9fe8..96121f7 100644
--- a/core/modules/views/src/Plugin/views/filter/FilterPluginBase.php
+++ b/core/modules/views/src/Plugin/views/filter/FilterPluginBase.php
@@ -14,7 +14,6 @@
use Drupal\views\Plugin\CacheablePluginInterface;
use Drupal\views\Plugin\views\HandlerBase;
use Drupal\Component\Utility\Html;
-use Drupal\Component\Utility\SafeMarkup;
use Drupal\views\Plugin\views\display\DisplayPluginBase;
use Drupal\views\ViewExecutable;
@@ -172,7 +171,7 @@ protected function defineOptions() {
* Display the filter on the administrative summary
*/
public function adminSummary() {
- return SafeMarkup::checkPlain((string) $this->operator) . ' ' . SafeMarkup::checkPlain((string) $this->value);
+ return Html::escape((string) $this->operator) . ' ' . Html::escape((string) $this->value);
}
/**
@@ -595,7 +594,7 @@ public function buildExposeForm(&$form, FormStateInterface $form_state) {
'#default_value' => $this->options['expose']['remember'],
);
- $role_options = array_map('\Drupal\Component\Utility\SafeMarkup::checkPlain', user_role_names());
+ $role_options = user_role_names();
$form['expose']['remember_roles'] = array(
'#type' => 'checkboxes',
'#title' => $this->t('User roles'),
@@ -766,7 +765,7 @@ public function groupForm(&$form, FormStateInterface $form_state) {
$value = $this->options['group_info']['identifier'];
$form[$value] = array(
- '#title' => SafeMarkup::checkPlain($this->options['group_info']['label']),
+ '#title' => $this->options['group_info']['label'],
'#type' => $this->options['group_info']['widget'],
'#default_value' => $this->group_info,
'#options' => $groups,
diff --git a/core/modules/views/src/Plugin/views/filter/InOperator.php b/core/modules/views/src/Plugin/views/filter/InOperator.php
index d08aa00..469974c 100644
--- a/core/modules/views/src/Plugin/views/filter/InOperator.php
+++ b/core/modules/views/src/Plugin/views/filter/InOperator.php
@@ -7,7 +7,7 @@
namespace Drupal\views\Plugin\views\filter;
-use Drupal\Component\Utility\SafeMarkup;
+use Drupal\Component\Utility\Html;
use Drupal\Component\Utility\Unicode;
use Drupal\Core\Form\FormStateInterface;
use Drupal\views\Plugin\views\display\DisplayPluginBase;
@@ -335,7 +335,7 @@ public function adminSummary() {
return;
}
- $operator = SafeMarkup::checkPlain($info[$this->operator]['short']);
+ $operator = $info[$this->operator]['short'];
$values = '';
if (in_array($this->operator, $this->operatorValues(1))) {
// Remove every element which is not known.
@@ -351,13 +351,13 @@ public function adminSummary() {
else if (count($this->value) == 1) {
// If any, use the 'single' short name of the operator instead.
if (isset($info[$this->operator]['short_single'])) {
- $operator = SafeMarkup::checkPlain($info[$this->operator]['short_single']);
+ $operator = $info[$this->operator]['short_single'];
}
$keys = $this->value;
$value = array_shift($keys);
if (isset($this->valueOptions[$value])) {
- $values = SafeMarkup::checkPlain($this->valueOptions[$value]);
+ $values = $this->valueOptions[$value];
}
else {
$values = '';
@@ -373,13 +373,13 @@ public function adminSummary() {
break;
}
if (isset($this->valueOptions[$value])) {
- $values .= SafeMarkup::checkPlain($this->valueOptions[$value]);
+ $values .= $this->valueOptions[$value];
}
}
}
}
- return $operator . (($values !== '') ? ' ' . $values : '');
+ return Html::escape($operator . (($values !== '') ? ' ' . $values : ''));
}
public function query() {
diff --git a/core/modules/views/src/Plugin/views/filter/NumericFilter.php b/core/modules/views/src/Plugin/views/filter/NumericFilter.php
index f88e3a6..51bd8f7 100644
--- a/core/modules/views/src/Plugin/views/filter/NumericFilter.php
+++ b/core/modules/views/src/Plugin/views/filter/NumericFilter.php
@@ -7,7 +7,6 @@
namespace Drupal\views\Plugin\views\filter;
-use Drupal\Component\Utility\SafeMarkup;
use Drupal\Core\Database\Database;
use Drupal\Core\Form\FormStateInterface;
@@ -292,12 +291,12 @@ public function adminSummary() {
}
$options = $this->operatorOptions('short');
- $output = SafeMarkup::checkPlain($options[$this->operator]);
+ $output = $options[$this->operator];
if (in_array($this->operator, $this->operatorValues(2))) {
$output .= ' ' . $this->t('@min and @max', array('@min' => $this->value['min'], '@max' => $this->value['max']));
}
elseif (in_array($this->operator, $this->operatorValues(1))) {
- $output .= ' ' . SafeMarkup::checkPlain($this->value['value']);
+ $output .= ' ' . $this->value['value'];
}
return $output;
}
diff --git a/core/modules/views/src/Plugin/views/filter/StringFilter.php b/core/modules/views/src/Plugin/views/filter/StringFilter.php
index 9713351..972aa3c 100644
--- a/core/modules/views/src/Plugin/views/filter/StringFilter.php
+++ b/core/modules/views/src/Plugin/views/filter/StringFilter.php
@@ -7,7 +7,7 @@
namespace Drupal\views\Plugin\views\filter;
-use Drupal\Component\Utility\SafeMarkup;
+use Drupal\Component\Utility\Html;
use Drupal\Core\Database\Database;
use Drupal\Core\Form\FormStateInterface;
@@ -162,10 +162,10 @@ public function adminSummary() {
$options = $this->operatorOptions('short');
$output = '';
if (!empty($options[$this->operator])) {
- $output = SafeMarkup::checkPlain($options[$this->operator]);
+ $output = Html::escape($options[$this->operator]);
}
if (in_array($this->operator, $this->operatorValues(1))) {
- $output .= ' ' . SafeMarkup::checkPlain($this->value);
+ $output .= ' ' . Html::escape($this->value);
}
return $output;
}
diff --git a/core/modules/views/src/Plugin/views/row/EntityRow.php b/core/modules/views/src/Plugin/views/row/EntityRow.php
index e95e5fa..ae6ee35 100644
--- a/core/modules/views/src/Plugin/views/row/EntityRow.php
+++ b/core/modules/views/src/Plugin/views/row/EntityRow.php
@@ -7,7 +7,7 @@
namespace Drupal\views\Plugin\views\row;
-use Drupal\Component\Utility\SafeMarkup;
+use Drupal\Component\Utility\Html;
use Drupal\Core\Entity\EntityManagerInterface;
use Drupal\Core\Form\FormStateInterface;
use Drupal\Core\Language\LanguageManagerInterface;
@@ -160,7 +160,7 @@ public function buildOptionsForm(&$form, FormStateInterface $form_state) {
public function summaryTitle() {
$options = \Drupal::entityManager()->getViewModeOptions($this->entityTypeId);
if (isset($options[$this->options['view_mode']])) {
- return SafeMarkup::checkPlain($options[$this->options['view_mode']]);
+ return Html::escape($options[$this->options['view_mode']]);
}
else {
return $this->t('No view mode selected');
diff --git a/core/modules/views/src/Tests/SearchIntegrationTest.php b/core/modules/views/src/Tests/SearchIntegrationTest.php
index 2edd22d..78c43ac 100644
--- a/core/modules/views/src/Tests/SearchIntegrationTest.php
+++ b/core/modules/views/src/Tests/SearchIntegrationTest.php
@@ -108,15 +108,16 @@ public function testSearchIntegration() {
'type' => $type->id(),
];
$this->drupalCreateNode($node);
- $node['title'] = "Drupal's search rocks really rocks!";
+ $node['title'] = "Drupal's search rocks really rocks!";
$this->drupalCreateNode($node);
$this->cronRun();
$this->drupalGet('test-arg/rocks');
$xpath = '//div[@class="views-row"]//a';
/** @var \SimpleXMLElement[] $results */
$results = $this->xpath($xpath);
- $this->assertEqual((string) $results[0], "Drupal's search rocks really rocks!");
+ $this->assertEqual((string) $results[0], "Drupal's search rocks really rocks!");
$this->assertEqual((string) $results[1], "Drupal's search rocks.");
+ $this->assertEscaped("Drupal's search rocks really rocks!");
// Test sorting with another set of titles.
$node = [
diff --git a/core/modules/views/src/Views.php b/core/modules/views/src/Views.php
index 33570ae..6f11b4a 100644
--- a/core/modules/views/src/Views.php
+++ b/core/modules/views/src/Views.php
@@ -7,8 +7,6 @@
namespace Drupal\views;
-use Drupal\Component\Utility\SafeMarkup;
-
/**
* Static service container wrapper for views.
*/
@@ -398,8 +396,8 @@ public static function pluginList() {
if (!isset($plugins[$key])) {
$plugins[$key] = array(
'type' => $type,
- 'title' => SafeMarkup::checkPlain($info[$name]['title']),
- 'provider' => SafeMarkup::checkPlain($info[$name]['provider']),
+ 'title' => $info[$name]['title'],
+ 'provider' => $info[$name]['provider'],
'views' => array(),
);
}
diff --git a/core/modules/views/views.module b/core/modules/views/views.module
index b321940..fee9570 100644
--- a/core/modules/views/views.module
+++ b/core/modules/views/views.module
@@ -66,8 +66,8 @@ function views_views_pre_render($view) {
'views_dom_id:' . $view->dom_id => array(
'view_name' => $view->storage->id(),
'view_display_id' => $view->current_display,
- 'view_args' => SafeMarkup::checkPlain(implode('/', $view->args)),
- 'view_path' => SafeMarkup::checkPlain(Url::fromRoute('' . SafeMarkup::checkPlain($content));
+ $this->verbose('' . Html::escape($content));
return $content;
}
diff --git a/core/tests/Drupal/Tests/Component/Utility/HtmlTest.php b/core/tests/Drupal/Tests/Component/Utility/HtmlTest.php
index 178a662..28a2846 100644
--- a/core/tests/Drupal/Tests/Component/Utility/HtmlTest.php
+++ b/core/tests/Drupal/Tests/Component/Utility/HtmlTest.php
@@ -231,7 +231,7 @@ public function testDecodeEntities($text, $expected) {
/**
* Data provider for testDecodeEntities().
*
- * @see testCheckPlain()
+ * @see testDecodeEntities()
*/
public function providerDecodeEntities() {
return array(
@@ -272,7 +272,7 @@ public function testEscape($expected, $text) {
/**
* Data provider for testEscape().
*
- * @see testCheckPlain()
+ * @see testEscape()
*/
public function providerEscape() {
return array(
diff --git a/core/tests/Drupal/Tests/Component/Utility/SafeMarkupTest.php b/core/tests/Drupal/Tests/Component/Utility/SafeMarkupTest.php
index 366e8b9..d473c72 100644
--- a/core/tests/Drupal/Tests/Component/Utility/SafeMarkupTest.php
+++ b/core/tests/Drupal/Tests/Component/Utility/SafeMarkupTest.php
@@ -115,44 +115,6 @@ public function testInvalidSetMultiple() {
}
/**
- * Tests SafeMarkup::checkPlain().
- *
- * @dataProvider providerCheckPlain
- * @covers ::checkPlain
- *
- * @param string $text
- * The text to provide to SafeMarkup::checkPlain().
- * @param string $expected
- * The expected output from the function.
- * @param string $message
- * The message to provide as output for the test.
- * @param bool $ignorewarnings
- * Whether or not to ignore PHP 5.3+ invalid multibyte sequence warnings.
- */
- function testCheckPlain($text, $expected, $message, $ignorewarnings = FALSE) {
- $result = $ignorewarnings ? @SafeMarkup::checkPlain($text) : SafeMarkup::checkPlain($text);
- $this->assertEquals($expected, $result, $message);
- }
-
- /**
- * Data provider for testCheckPlain().
- *
- * @see testCheckPlain()
- */
- function providerCheckPlain() {
- // Checks that invalid multi-byte sequences are escaped.
- $tests[] = array("Foo\xC0barbaz", 'Foo�barbaz', 'SafeMarkup::checkPlain() escapes invalid sequence "Foo\xC0barbaz"', TRUE);
- $tests[] = array("\xc2\"", '�"', 'SafeMarkup::checkPlain() escapes invalid sequence "\xc2\""', TRUE);
- $tests[] = array("Fooÿñ", "Fooÿñ", 'SafeMarkup::checkPlain() does not escape valid sequence "Fooÿñ"');
-
- // Checks that special characters are escaped.
- $tests[] = array("