diff --git a/payment/uc_2checkout/lib/Drupal/uc_2checkout/Controller/CheckoutController.php b/payment/uc_2checkout/lib/Drupal/uc_2checkout/Controller/CheckoutController.php index 0cf0267..67c37fd 100644 --- a/payment/uc_2checkout/lib/Drupal/uc_2checkout/Controller/CheckoutController.php +++ b/payment/uc_2checkout/lib/Drupal/uc_2checkout/Controller/CheckoutController.php @@ -7,6 +7,7 @@ namespace Drupal\uc_2checkout\Controller; +use Drupal\Component\Utility\String; use Drupal\Component\Utility\Unicode; use Drupal\Core\Controller\ControllerBase; use Symfony\Component\HttpKernel\Exception\AccessDeniedHttpException; @@ -22,7 +23,7 @@ class CheckoutController extends ControllerBase { public function complete($cart_id = 0) { $cart_config = \Drupal::config('uc_cart.settings'); $module_config = \Drupal::config('uc_2checkout.settings'); - watchdog('2Checkout', 'Receiving new order notification for order !order_id.', array('!order_id' => check_plain($_REQUEST['merchant_order_id']))); + watchdog('2Checkout', 'Receiving new order notification for order !order_id.', array('!order_id' => String::checkPlain($_REQUEST['merchant_order_id']))); $order = uc_order_load($_REQUEST['merchant_order_id']); @@ -71,11 +72,11 @@ class CheckoutController extends ControllerBase { $order->save(); if (Unicode::strtolower($_REQUEST['email']) !== Unicode::strtolower($order->getEmail())) { - uc_order_comment_save($order->id(), 0, t('Customer used a different e-mail address during payment: !email', array('!email' => check_plain($_REQUEST['email']))), 'admin'); + uc_order_comment_save($order->id(), 0, t('Customer used a different e-mail address during payment: !email', array('!email' => String::checkPlain($_REQUEST['email']))), 'admin'); } if ($_REQUEST['credit_card_processed'] == 'Y' && is_numeric($_REQUEST['total'])) { - $comment = t('Paid by !type, 2Checkout.com order #!order.', array('!type' => $_REQUEST['pay_method'] == 'CC' ? t('credit card') : t('echeck'), '!order' => check_plain($_REQUEST['order_number']))); + $comment = t('Paid by !type, 2Checkout.com order #!order.', array('!type' => $_REQUEST['pay_method'] == 'CC' ? t('credit card') : t('echeck'), '!order' => String::checkPlain($_REQUEST['order_number']))); uc_payment_enter($order->id(), '2checkout', $_REQUEST['total'], 0, NULL, $comment); } else { diff --git a/payment/uc_authorizenet/uc_authorizenet.module b/payment/uc_authorizenet/uc_authorizenet.module index 238d595..51b5ffc 100644 --- a/payment/uc_authorizenet/uc_authorizenet.module +++ b/payment/uc_authorizenet/uc_authorizenet.module @@ -5,6 +5,7 @@ * Processes payments using Authorize.net. Supports AIM and ARB. */ +use Drupal\Component\Utility\String; use Drupal\uc_store\Encryption; define('UC_AUTHORIZENET_TEST_GATEWAY_URL', 'https://test.authorize.net/gateway/transact.dll'); @@ -545,7 +546,7 @@ function _uc_authorizenet_charge($order, $amount, $data) { $response = explode('|', $result->getBody(TRUE)); if (variable_get('uc_authnet_response_debug', FALSE)) { - watchdog('uc_authorizenet', 'Debug response: !data', array('!data' => '
' . check_plain(print_r($response, TRUE)) . '
')); + watchdog('uc_authorizenet', 'Debug response: !data', array('!data' => '
' . String::checkPlain(print_r($response, TRUE)) . '
')); } // Trim off the encapsulating character from the results. diff --git a/payment/uc_credit/uc_credit.admin.inc b/payment/uc_credit/uc_credit.admin.inc index d40a42f..0ea11af 100644 --- a/payment/uc_credit/uc_credit.admin.inc +++ b/payment/uc_credit/uc_credit.admin.inc @@ -5,6 +5,8 @@ * Credit administration menu items. */ +use Drupal\Component\Utility\String; + /** * Credit card settings form. * @@ -179,7 +181,7 @@ function uc_credit_settings_form($form, &$form_state) { foreach ($gateways as $id => $gateway) { $form['gateways'][$id] = array( '#type' => 'details', - '#title' => check_plain($gateway['title']), + '#title' => String::checkPlain($gateway['title']), '#group' => 'uc_credit', '#weight' => 5, ); diff --git a/payment/uc_credit/uc_credit.module b/payment/uc_credit/uc_credit.module index ee765e3..cba1f5d 100644 --- a/payment/uc_credit/uc_credit.module +++ b/payment/uc_credit/uc_credit.module @@ -5,6 +5,7 @@ * Defines the credit card payment method and hooks in payment gateways. */ +use Drupal\Component\Utility\String; use Drupal\uc_store\Encryption; /** Just authorize an amount on a credit card account. */ @@ -309,8 +310,6 @@ function uc_payment_method_credit($op, &$order, $form = NULL, &$form_state = NUL $cc_data['cc_number'] = str_replace(' ', '', $cc_data['cc_number']); - array_walk($cc_data, 'check_plain'); - // Recover cached CC data in // $form_state['values']['panes']['payment']['details'] if it exists. if (isset($form_state['values']['panes']['payment']['details']['payment_details_data'])) { @@ -416,10 +415,10 @@ function uc_payment_method_credit($op, &$order, $form = NULL, &$form_state = NUL case 'cart-review': if (variable_get('uc_credit_type_enabled', FALSE)) { - $review[] = array('title' => t('Card type'), 'data' => check_plain($order->payment_details['cc_type'])); + $review[] = array('title' => t('Card type'), 'data' => String::checkPlain($order->payment_details['cc_type'])); } if (variable_get('uc_credit_owner_enabled', FALSE)) { - $review[] = array('title' => t('Card owner'), 'data' => check_plain($order->payment_details['cc_owner'])); + $review[] = array('title' => t('Card owner'), 'data' => String::checkPlain($order->payment_details['cc_owner'])); } $review[] = array('title' => t('Card number'), 'data' => uc_credit_display_number($order->payment_details['cc_number'])); if (variable_get('uc_credit_start_enabled', FALSE)) { @@ -431,7 +430,7 @@ function uc_payment_method_credit($op, &$order, $form = NULL, &$form_state = NUL $review[] = array('title' => t('Issue number'), 'data' => $order->payment_details['cc_issue']); } if (variable_get('uc_credit_bank_enabled', FALSE)) { - $review[] = array('title' => t('Issuing bank'), 'data' => check_plain($order->payment_details['cc_bank'])); + $review[] = array('title' => t('Issuing bank'), 'data' => String::checkPlain($order->payment_details['cc_bank'])); } return $review; @@ -444,11 +443,11 @@ function uc_payment_method_credit($op, &$order, $form = NULL, &$form_state = NUL $rows = array(); if (!empty($order->payment_details['cc_type'])) { - $rows[] = t('Card type') . ': ' . check_plain($order->payment_details['cc_type']); + $rows[] = t('Card type') . ': ' . String::checkPlain($order->payment_details['cc_type']); } if (!empty($order->payment_details['cc_owner'])) { - $rows[] = t('Card owner') . ': ' . check_plain($order->payment_details['cc_owner']); + $rows[] = t('Card owner') . ': ' . String::checkPlain($order->payment_details['cc_owner']); } if (!empty($order->payment_details['cc_number'])) { @@ -464,11 +463,11 @@ function uc_payment_method_credit($op, &$order, $form = NULL, &$form_state = NUL } if (!empty($order->payment_details['cc_issue'])) { - $rows[] = t('Issue number') . ': ' . check_plain($order->payment_details['cc_issue']); + $rows[] = t('Issue number') . ': ' . String::checkPlain($order->payment_details['cc_issue']); } if (!empty($order->payment_details['cc_bank'])) { - $rows[] = t('Issuing bank') . ': ' . check_plain($order->payment_details['cc_bank']); + $rows[] = t('Issuing bank') . ': ' . String::checkPlain($order->payment_details['cc_bank']); } $build['cc_info'] = array( diff --git a/payment/uc_cybersource/lib/Drupal/uc_cybersource/Controller/HOPController.php b/payment/uc_cybersource/lib/Drupal/uc_cybersource/Controller/HOPController.php index b68e08d..b4e6577 100644 --- a/payment/uc_cybersource/lib/Drupal/uc_cybersource/Controller/HOPController.php +++ b/payment/uc_cybersource/lib/Drupal/uc_cybersource/Controller/HOPController.php @@ -7,6 +7,7 @@ namespace Drupal\uc_cybersource\Controller; +use Drupal\Component\Utility\String; use Drupal\Core\Controller\ControllerBase; /** @@ -40,16 +41,16 @@ class HOPController extends ControllerBase { } // Assign posted variables to local variables. - $decision = check_plain($_POST['decision']); - $reason_code = check_plain($_POST['reasonCode']); + $decision = String::checkPlain($_POST['decision']); + $reason_code = String::checkPlain($_POST['reasonCode']); $reason = _parse_cs_reason_code($reason_code); - $payment_amount = check_plain($_POST['orderAmount']); - $payment_currency = check_plain($_POST['paymentCurrency']); - $request_id = check_plain($_POST['requestID']); - $request_token = check_plain($_POST['orderPage_requestToken']); - $reconciliation_id = check_plain($_POST['reconciliationID']); - $order_id = check_plain($_POST['orderNumber']); - $payer_email = check_plain($_POST['billTo_email']); + $payment_amount = String::checkPlain($_POST['orderAmount']); + $payment_currency = String::checkPlain($_POST['paymentCurrency']); + $request_id = String::checkPlain($_POST['requestID']); + $request_token = String::checkPlain($_POST['orderPage_requestToken']); + $reconciliation_id = String::checkPlain($_POST['reconciliationID']); + $order_id = String::checkPlain($_POST['orderNumber']); + $payer_email = String::checkPlain($_POST['billTo_email']); $order = uc_order_load($_POST['orderNumber']); switch ($decision) { diff --git a/payment/uc_payment/lib/Drupal/uc_payment/Form/OrderPaymentsForm.php b/payment/uc_payment/lib/Drupal/uc_payment/Form/OrderPaymentsForm.php index 09bda95..db88399 100644 --- a/payment/uc_payment/lib/Drupal/uc_payment/Form/OrderPaymentsForm.php +++ b/payment/uc_payment/lib/Drupal/uc_payment/Form/OrderPaymentsForm.php @@ -7,6 +7,7 @@ namespace Drupal\uc_payment\Form; +use Drupal\Component\Utility\Xss; use Drupal\Core\Form\FormBase; use Drupal\uc_order\UcOrderInterface; use Drupal\uc_payment\Plugin\PaymentMethodManager; @@ -101,7 +102,7 @@ class OrderPaymentsForm extends FormBase { '#price' => $total, ); $form['payments'][$payment->receipt_id]['comment'] = array( - '#markup' => ($payment->comment == '') ? '-' : filter_xss_admin($payment->comment), + '#markup' => ($payment->comment == '') ? '-' : Xss::filterAdmin($payment->comment), ); if ($account->hasPermission('delete payments')) { $action_value = l(t('Delete'), 'admin/store/orders/' . $this->order->id() . '/payments/' diff --git a/payment/uc_payment/lib/Drupal/uc_payment/Form/PaymentMethodsForm.php b/payment/uc_payment/lib/Drupal/uc_payment/Form/PaymentMethodsForm.php index acd3d1a..396d299 100644 --- a/payment/uc_payment/lib/Drupal/uc_payment/Form/PaymentMethodsForm.php +++ b/payment/uc_payment/lib/Drupal/uc_payment/Form/PaymentMethodsForm.php @@ -7,6 +7,7 @@ namespace Drupal\uc_payment\Form; +use Drupal\Component\Utility\String; use Drupal\Core\Config\ConfigFactory; use Drupal\Core\Form\ConfigFormBase; use Drupal\uc_payment\Plugin\PaymentMethodManager; @@ -75,7 +76,7 @@ class PaymentMethodsForm extends ConfigFormBase { $form['methods'][$id]['#attributes']['class'][] = 'draggable'; $form['methods'][$id]['status'] = array( '#type' => 'checkbox', - '#title' => check_plain($method['name']), + '#title' => String::checkPlain($method['name']), '#default_value' => $method['checkout'], ); $form['methods'][$id]['weight'] = array( diff --git a/payment/uc_payment/uc_payment.module b/payment/uc_payment/uc_payment.module index 23fa48e..4dc3ed2 100644 --- a/payment/uc_payment/uc_payment.module +++ b/payment/uc_payment/uc_payment.module @@ -12,6 +12,7 @@ use Drupal\uc_order\UcOrderInterface; use Drupal\Component\Plugin\Exception\PluginException; +use Drupal\Component\Utility\Xss; require_once dirname(__FILE__) . '/uc_payment_order_pane.inc'; @@ -69,7 +70,7 @@ function template_preprocess_uc_payment_totals(&$variables) { $variables['line_items'] = $variables['order']->getDisplayLineItems(); foreach ($variables['line_items'] as $key => $line) { - $variables['line_items'][$key]['title'] = filter_xss($line['title']); + $variables['line_items'][$key]['title'] = Xss::filter($line['title']); $variables['line_items'][$key]['amount'] = uc_currency_format($line['amount']); } } diff --git a/payment/uc_paypal/uc_paypal.module b/payment/uc_paypal/uc_paypal.module index 1656e6d8..2d3690f 100644 --- a/payment/uc_paypal/uc_paypal.module +++ b/payment/uc_paypal/uc_paypal.module @@ -10,6 +10,7 @@ * https://drupal.org/node/1311198 for further information. */ +use Drupal\Component\Utility\String; /** * Implements hook_menu(). @@ -304,7 +305,7 @@ function uc_paypal_wpp_charge($order_id, $amount, $data) { 'success' => TRUE, 'comment' => t('PayPal transaction ID: @transactionid', array('@transactionid' => $nvp_response['TRANSACTIONID'])), 'message' => $message, - 'data' => check_plain($nvp_response['TRANSACTIONID']), + 'data' => String::checkPlain($nvp_response['TRANSACTIONID']), 'uid' => $user->id(), ); @@ -368,7 +369,7 @@ function _uc_paypal_build_error_messages($nvp_response) { $code = 0; $message = ''; while (array_key_exists('L_SEVERITYCODE' . $code, $nvp_response)) { - $message .= '
' . check_plain($nvp_response['L_SEVERITYCODE' . $code]) . ': ' . check_plain($nvp_response['L_ERRORCODE' . $code]) . ': ' . check_plain($nvp_response['L_LONGMESSAGE' . $code]); + $message .= '
' . String::checkPlain($nvp_response['L_SEVERITYCODE' . $code]) . ': ' . String::checkPlain($nvp_response['L_ERRORCODE' . $code]) . ': ' . String::checkPlain($nvp_response['L_LONGMESSAGE' . $code]); $code++; } return $message; diff --git a/payment/uc_paypal/uc_paypal.pages.inc b/payment/uc_paypal/uc_paypal.pages.inc index fe7ff0a..e9c6425 100644 --- a/payment/uc_paypal/uc_paypal.pages.inc +++ b/payment/uc_paypal/uc_paypal.pages.inc @@ -5,6 +5,7 @@ * Paypal administration menu items. */ +use Drupal\Component\Utility\String; use Drupal\Component\Utility\Unicode; /** @@ -21,7 +22,7 @@ function uc_paypal_ipn() { // Sanitize order ID and cart ID $order_id = intval($order_id); - $cart_id = check_plain($cart_id); + $cart_id = String::checkPlain($cart_id); if (!empty($cart_id)) { // Needed later by uc_complete_sale to empty the correct cart @@ -42,16 +43,16 @@ function uc_paypal_ipn() { } // Assign posted variables to local variables - $payment_status = check_plain($_POST['payment_status']); - $payment_amount = check_plain($_POST['mc_gross']); - $payment_currency = check_plain($_POST['mc_currency']); - $receiver_email = check_plain($_POST['business']); + $payment_status = String::checkPlain($_POST['payment_status']); + $payment_amount = String::checkPlain($_POST['mc_gross']); + $payment_currency = String::checkPlain($_POST['mc_currency']); + $receiver_email = String::checkPlain($_POST['business']); if ($receiver_email == '') { - $receiver_email = check_plain($_POST['receiver_email']); + $receiver_email = String::checkPlain($_POST['receiver_email']); } - $txn_id = check_plain($_POST['txn_id']); - $txn_type = check_plain($_POST['txn_type']); - $payer_email = check_plain($_POST['payer_email']); + $txn_id = String::checkPlain($_POST['txn_id']); + $txn_type = String::checkPlain($_POST['txn_type']); + $payer_email = String::checkPlain($_POST['payer_email']); // Express Checkout IPNs may not have the WPS email stored. But if it is, // make sure that the right account is being paid. @@ -138,7 +139,7 @@ function uc_paypal_ipn() { case 'Pending': $order->setStatusId('paypal_pending')->save(); - uc_order_comment_save($order_id, 0, t('Payment is pending at PayPal: @reason', array('@reason' => _uc_paypal_pending_message(check_plain($_POST['pending_reason'])))), 'admin'); + uc_order_comment_save($order_id, 0, t('Payment is pending at PayPal: @reason', array('@reason' => _uc_paypal_pending_message(String::checkPlain($_POST['pending_reason'])))), 'admin'); break; // You, the merchant, refunded the payment. @@ -149,7 +150,7 @@ function uc_paypal_ipn() { case 'Reversed': watchdog('uc_paypal', 'PayPal has reversed a payment!', array(), WATCHDOG_ERROR); - uc_order_comment_save($order_id, 0, t('Payment has been reversed by PayPal: @reason', array('@reason' => _uc_paypal_reversal_message(check_plain($_POST['reason_code'])))), 'admin'); + uc_order_comment_save($order_id, 0, t('Payment has been reversed by PayPal: @reason', array('@reason' => _uc_paypal_reversal_message(String::checkPlain($_POST['reason_code'])))), 'admin'); break; case 'Processed': @@ -213,7 +214,7 @@ function uc_paypal_ec_review() { $_SESSION['PAYERID'] = $nvp_response['PAYERID']; - $shipname = check_plain($nvp_response['SHIPTONAME']); + $shipname = String::checkPlain($nvp_response['SHIPTONAME']); if (strpos($shipname, ' ') > 0) { $order->delivery_first_name = substr($shipname, 0, strrpos(trim($shipname), ' ')); $order->delivery_last_name = substr($shipname, strrpos(trim($shipname), ' ') + 1); @@ -231,16 +232,16 @@ function uc_paypal_ec_review() { $zone_id = db_query("SELECT zone_id FROM {uc_zones} WHERE zone_country_id = :id AND (zone_code = :code OR zone_name = :name)", array(':id' => $country_id, ':code' => $zone, ':name' => $zone))->fetchField(); } - $order->delivery_street1 = check_plain($nvp_response['SHIPTOSTREET']); - $order->delivery_street2 = isset($nvp_response['SHIPTOSTREET2']) ? check_plain($nvp_response['SHIPTOSTREET2']) : ''; - $order->delivery_city = check_plain($nvp_response['SHIPTOCITY']); + $order->delivery_street1 = String::checkPlain($nvp_response['SHIPTOSTREET']); + $order->delivery_street2 = isset($nvp_response['SHIPTOSTREET2']) ? String::checkPlain($nvp_response['SHIPTOSTREET2']) : ''; + $order->delivery_city = String::checkPlain($nvp_response['SHIPTOCITY']); $order->delivery_zone = !empty($zone_id) ? $zone_id : 0; - $order->delivery_postal_code = check_plain($nvp_response['SHIPTOZIP']); + $order->delivery_postal_code = String::checkPlain($nvp_response['SHIPTOZIP']); $order->delivery_country = !empty($country_id) ? $country_id : 840; - $order->billing_first_name = check_plain($nvp_response['FIRSTNAME']); - $order->billing_last_name = check_plain($nvp_response['LASTNAME']); - $order->billing_street1 = check_plain($nvp_response['EMAIL']); + $order->billing_first_name = String::checkPlain($nvp_response['FIRSTNAME']); + $order->billing_last_name = String::checkPlain($nvp_response['LASTNAME']); + $order->billing_street1 = String::checkPlain($nvp_response['EMAIL']); if (!$order->getEmail()) { $order->setEmail($nvp_response['EMAIL']); diff --git a/shipping/uc_flatrate/uc_flatrate.module b/shipping/uc_flatrate/uc_flatrate.module index 39d6b4c..d2c657e 100644 --- a/shipping/uc_flatrate/uc_flatrate.module +++ b/shipping/uc_flatrate/uc_flatrate.module @@ -5,6 +5,7 @@ * Shipping quote module that defines a flat shipping rate for each product. */ +use Drupal\Component\Utility\String; /** * Implements hook_form_BASE_FORM_ID_alter(). @@ -30,7 +31,7 @@ function uc_flatrate_form_node_form_alter(&$form, &$form_state, $form_id) { } $form['shipping']['flatrate'][$method->mid] = array( '#type' => 'uc_price', - '#title' => check_plain($method->title), + '#title' => String::checkPlain($method->title), '#default_value' => isset($form['#node']->flatrate[$method->mid]) ? $form['#node']->flatrate[$method->mid] : '', '#description' => t('Default rate: %price', array('%price' => uc_currency_format($method->product_rate))), '#weight' => $weight['flatrate_' . $method->mid], @@ -186,8 +187,8 @@ function uc_flatrate_quote($products, $details, $method) { $quotes[] = array( 'rate' => $rate, - 'label' => check_plain($method->label), - 'option_label' => check_plain($method->label), + 'label' => String::checkPlain($method->label), + 'option_label' => String::checkPlain($method->label), ); } diff --git a/shipping/uc_quote/lib/Drupal/uc_quote/Form/ShippingQuoteMethodsForm.php b/shipping/uc_quote/lib/Drupal/uc_quote/Form/ShippingQuoteMethodsForm.php index 7b21675..ded9d55 100644 --- a/shipping/uc_quote/lib/Drupal/uc_quote/Form/ShippingQuoteMethodsForm.php +++ b/shipping/uc_quote/lib/Drupal/uc_quote/Form/ShippingQuoteMethodsForm.php @@ -7,6 +7,7 @@ namespace Drupal\uc_quote\Form; +use Drupal\Component\Utility\String; use Drupal\Core\Form\ConfigFormBase; /** @@ -59,7 +60,7 @@ class ShippingQuoteMethodsForm extends ConfigFormBase { $form['methods'][$id]['status'] = array( '#type' => 'checkbox', - '#title' => check_plain($method['title']), + '#title' => String::checkPlain($method['title']), '#default_value' => $method['enabled'], ); $form['methods'][$id]['description'] = array( diff --git a/shipping/uc_quote/uc_quote.module b/shipping/uc_quote/uc_quote.module index f147ab7..5491317 100644 --- a/shipping/uc_quote/uc_quote.module +++ b/shipping/uc_quote/uc_quote.module @@ -9,6 +9,7 @@ * their specific information so that a shipment may be quoted and requested. */ +use Drupal\Component\Utility\Xss; use Drupal\Core\Ajax\AjaxResponse; use Drupal\Core\Ajax\PrependCommand; use Drupal\Core\Ajax\ReplaceCommand; @@ -510,7 +511,7 @@ function uc_checkout_pane_quotes($op, &$order, $form = NULL, &$form_state = NULL $quote_config = \Drupal::config('uc_quote.settings'); switch ($op) { case 'view': - $description = filter_xss_admin($quote_config->get('pane_description')); + $description = Xss::filterAdmin($quote_config->get('pane_description')); $contents['#attached']['css'][] = drupal_get_path('module', 'uc_quote') . '/css/uc_quote.css'; @@ -836,7 +837,7 @@ function uc_quote_build_quote_form($order, $show_errors = TRUE) { } elseif ($show_errors) { $return['error'] = array( - '#markup' => filter_xss_admin($quote_config->get('error_message')), + '#markup' => Xss::filterAdmin($quote_config->get('error_message')), ); } diff --git a/shipping/uc_shipping/lib/Drupal/uc_shipping/Plugin/views/field/ShipmentId.php b/shipping/uc_shipping/lib/Drupal/uc_shipping/Plugin/views/field/ShipmentId.php index 169c501..705e50d 100644 --- a/shipping/uc_shipping/lib/Drupal/uc_shipping/Plugin/views/field/ShipmentId.php +++ b/shipping/uc_shipping/lib/Drupal/uc_shipping/Plugin/views/field/ShipmentId.php @@ -80,8 +80,9 @@ class ShipmentId extends FieldPluginBase { /** * Overrides views_handler_field::render(). */ - public function render($values) { - return $this->render_link(check_plain($values->{$this->field_alias}), $values); + public function render(ResultRow $values) { + $value = $this->getValue($values); + return $this->render_link($this->sanitizeValue($value), $values); } } diff --git a/shipping/uc_shipping/uc_shipping.admin.inc b/shipping/uc_shipping/uc_shipping.admin.inc index a8943e0..19bfb98 100644 --- a/shipping/uc_shipping/uc_shipping.admin.inc +++ b/shipping/uc_shipping/uc_shipping.admin.inc @@ -5,7 +5,9 @@ * Shipping administration menu items. */ +use Drupal\Component\Utility\String; use Drupal\Component\Utility\Unicode; +use Drupal\Component\Utility\Xss; /** * Displays a list of an order's packaged products. @@ -23,14 +25,14 @@ function uc_shipping_order_packages($order) { $product_list = array(); $result2 = db_query("SELECT op.order_product_id, pp.qty, op.title, op.model FROM {uc_packaged_products} pp LEFT JOIN {uc_order_products} op ON op.order_product_id = pp.order_product_id WHERE pp.package_id = :id", array(':id' => $package->package_id)); foreach ($result2 as $product) { - $product_list[] = $product->qty . ' x ' . check_plain($product->model); + $product_list[] = $product->qty . ' x ' . String::checkPlain($product->model); } $row[] = ''; $row[] = isset($shipping_type_options[$package->shipping_type]) ? $shipping_type_options[$package->shipping_type] : strtr($package->shipping_type, '_', ' '); - $row[] = check_plain($package->pkg_type); + $row[] = String::checkPlain($package->pkg_type); $row[] = isset($package->sid) ? l($package->sid, 'admin/store/orders/' . $order->id() . '/shipments/' . $package->sid . '/view') : ''; - $row[] = isset($package->tracking_number) ? check_plain($package->tracking_number) : ''; + $row[] = isset($package->tracking_number) ? String::checkPlain($package->tracking_number) : ''; if ($package->label_image && $image = file_load($package->label_image)) { $package->label_image = $image; @@ -132,10 +134,10 @@ function uc_shipping_new_package($form, &$form_state, $order) { '#default_value' => 0, ); $product_row['model'] = array( - '#markup' => check_plain($product->model) + '#markup' => String::checkPlain($product->model) ); $product_row['name'] = array( - '#markup' => filter_xss_admin($product->title) + '#markup' => Xss::filterAdmin($product->title) ); $range = range(1, $unboxed_qty); $product_row['qty'] = array( @@ -337,8 +339,8 @@ function uc_shipping_package_edit($form, &$form_state, $order, $package) { if ($product->qty > 0) { $product_row = array(); $product_row['checked'] = array('#type' => 'checkbox', '#default_value' => isset($package->products[$product->order_product_id])); - $product_row['model'] = array('#markup' => check_plain($product->model)); - $product_row['name'] = array('#markup' => filter_xss_admin($product->title)); + $product_row['model'] = array('#markup' => String::checkPlain($product->model)); + $product_row['name'] = array('#markup' => Xss::filterAdmin($product->title)); $range = range(1, $product->qty); $product_row['qty'] = array( '#type' => 'select', @@ -506,12 +508,12 @@ function uc_shipping_order_shipments($order) { foreach ($result as $shipment) { $row = array(); $row[] = $shipment->sid; - $row[] = check_plain($shipment->d_first_name) . ' ' . check_plain($shipment->d_last_name); - $row[] = check_plain($shipment->d_company); - $row[] = check_plain($shipment->d_city) . ', ' . uc_get_zone_code($shipment->d_zone) . ' ' . check_plain($shipment->d_postal_code); + $row[] = String::checkPlain($shipment->d_first_name) . ' ' . String::checkPlain($shipment->d_last_name); + $row[] = String::checkPlain($shipment->d_company); + $row[] = String::checkPlain($shipment->d_city) . ', ' . uc_get_zone_code($shipment->d_zone) . ' ' . String::checkPlain($shipment->d_postal_code); $row[] = format_date($shipment->ship_date, 'uc_store'); $row[] = format_date($shipment->expected_delivery, 'uc_store'); - $row[] = is_null($shipment->tracking_number) ? t('n/a') : check_plain($shipment->tracking_number); + $row[] = is_null($shipment->tracking_number) ? t('n/a') : String::checkPlain($shipment->tracking_number); $row[] = l(t('view'), 'admin/store/orders/' . $order->id() . '/shipments/' . $shipment->sid . '/view'); $row[] = l(t('edit'), 'admin/store/orders/' . $order->id() . '/shipments/' . $shipment->sid . '/edit'); $row[] = l(t('print'), 'admin/store/orders/' . $order->id() . '/shipments/' . $shipment->sid . '/print'); @@ -592,7 +594,7 @@ function uc_shipping_new_shipment($form, &$form_state, $order) { $package_row['package_id'] = array('#markup' => $package->package_id); $product_list = array(); foreach ($package->products as $product) { - $product_list[] = $product->qty . ' x ' . check_plain($product->model); + $product_list[] = $product->qty . ' x ' . String::checkPlain($product->model); } $package_row['products'] = array('#markup' => ''); $package_row['weight'] = array('#markup' => uc_weight_format($package->weight, $units)); @@ -704,14 +706,14 @@ function uc_shipping_shipment_view($order, $shipment) { ); $rows = array(); - $rows[] = array(t('Carrier:'), check_plain($shipment->carrier)); + $rows[] = array(t('Carrier:'), String::checkPlain($shipment->carrier)); if ($shipment->transaction_id) { - $rows[] = array(t('Transaction ID:'), check_plain($shipment->transaction_id)); + $rows[] = array(t('Transaction ID:'), String::checkPlain($shipment->transaction_id)); } if ($shipment->tracking_number) { - $rows[] = array(t('Tracking number:'), check_plain($shipment->tracking_number)); + $rows[] = array(t('Tracking number:'), String::checkPlain($shipment->tracking_number)); } $methods = \Drupal::moduleHandler()->invokeAll('uc_shipping_method'); @@ -812,7 +814,7 @@ function uc_shipping_shipment_edit($form, &$form_state, $order, $shipment) { $product_list = array(); $declared_value = 0; foreach ($package->products as $product) { - $product_list[] = $product->qty . ' x ' . check_plain($product->model); + $product_list[] = $product->qty . ' x ' . String::checkPlain($product->model); $declared_value += $product->qty * $product->price; } $pkg_form = array( diff --git a/shipping/uc_shipping/uc_shipping.api.php b/shipping/uc_shipping/uc_shipping.api.php index bcc0aab..85018c5 100644 --- a/shipping/uc_shipping/uc_shipping.api.php +++ b/shipping/uc_shipping/uc_shipping.api.php @@ -1,5 +1,7 @@ products as $product) { $xml_data .= ''; $xml_data .= ''; - $xml_data .= '' . check_plain($product->nid . '|' . $product->model) . ''; + $xml_data .= '' . String::checkPlain($product->nid . '|' . $product->model) . ''; $xml_data .= ''; $xml_data .= ''; $xml_data .= ''; - $xml_data .= '' . check_plain($shipment->carrier) . ''; - $xml_data .= '' . check_plain($tracking_number) . ''; + $xml_data .= '' . String::checkPlain($shipment->carrier) . ''; + $xml_data .= '' . String::checkPlain($tracking_number) . ''; $xml_data .= ''; $xml_data .= ''; $xml_data .= ''; @@ -84,7 +85,7 @@ function hook_uc_shipment($op, $shipment) { if ($google_order_number) { foreach ($shipment->packages as $package) { foreach ($package->products as $product) { - $reset_ids[] = check_plain($product->nid . '|' . $product->model); + $reset_ids[] = String::checkPlain($product->nid . '|' . $product->model); } } $request = '' . "\n"; diff --git a/shipping/uc_shipping/uc_shipping.module b/shipping/uc_shipping/uc_shipping.module index 15cd3d9..3ff1a1e 100644 --- a/shipping/uc_shipping/uc_shipping.module +++ b/shipping/uc_shipping/uc_shipping.module @@ -8,6 +8,8 @@ */ use Drupal\Component\Utility\Json; +use Drupal\Component\Utility\String; +use Drupal\Component\Utility\Xss; use Drupal\uc_store\Address; /** @@ -259,11 +261,11 @@ function template_preprocess_uc_packing_slip(&$variables) { $order = $variables['order']; $variables['order_link'] = l($order->id(), url('user/' . $order->getUserId() . '/orders/' . $order->id(), array('absolute' => TRUE))); - $variables['order_email'] = check_plain($order->getEmail()); + $variables['order_email'] = String::checkPlain($order->getEmail()); $variables['billing_address'] = $order->getAddress('billing'); - $variables['billing_phone'] = check_plain($order->getAddress('billing')->phone); + $variables['billing_phone'] = String::checkPlain($order->getAddress('billing')->phone); $variables['shipping_address'] = $order->getAddress('delivery'); - $variables['shipping_phone'] = check_plain($order->getAddress('delivery')->phone); + $variables['shipping_phone'] = String::checkPlain($order->getAddress('delivery')->phone); if (module_exists('uc_payment')) { $variables['payment_method'] = Drupal::service('plugin.manager.uc_payment.method')->createFromOrder($order)->cartReviewTitle(); @@ -273,8 +275,8 @@ function template_preprocess_uc_packing_slip(&$variables) { } $shipment = $variables['shipment']; - $variables['carrier'] = check_plain($shipment->carrier); - $variables['tracking_number'] = check_plain($shipment->tracking_number); + $variables['carrier'] = String::checkPlain($shipment->carrier); + $variables['tracking_number'] = String::checkPlain($shipment->tracking_number); $variables['packages'] = $shipment->packages; } @@ -349,7 +351,7 @@ function uc_shipping_package_view($package) { '#suffix' => '', ); - $rows[] = array(t('Contents:'), filter_xss_admin($package->description)); + $rows[] = array(t('Contents:'), Xss::filterAdmin($package->description)); if ($shipment) { $methods = \Drupal::moduleHandler()->invokeAll('uc_shipping_method'); @@ -358,7 +360,7 @@ function uc_shipping_package_view($package) { } } - $rows[] = array(t('Package type:'), isset($pkg_type) ? $pkg_type : check_plain($package->pkg_type)); + $rows[] = array(t('Package type:'), isset($pkg_type) ? $pkg_type : String::checkPlain($package->pkg_type)); if ($package->length && $package->width && $package->height) { $rows[] = array(t('Dimensions:'), t('!l x !w x !h', array('!l' => uc_length_format($package->length), '!w' => uc_length_format($package->width), '!h' => uc_length_format($package->height)))); @@ -367,7 +369,7 @@ function uc_shipping_package_view($package) { $rows[] = array(t('Insured value:'), array('data' => array('#theme' => 'uc_price', '#price' => $package->value))); if ($package->tracking_number) { - $rows[] = array(t('Tracking number:'), check_plain($package->tracking_number)); + $rows[] = array(t('Tracking number:'), String::checkPlain($package->tracking_number)); } if ($shipment && isset($package->label_image) && @@ -651,13 +653,13 @@ function uc_shipping_order_pane_packages($op, $order) { $shipment = uc_shipping_shipment_load($shipment->sid); if ($shipment->tracking_number) { $tracking[$shipment->carrier]['data'] = $shipment->carrier; - $tracking[$shipment->carrier]['children'][] = check_plain($shipment->tracking_number); + $tracking[$shipment->carrier]['children'][] = String::checkPlain($shipment->tracking_number); } else { foreach ($shipment->packages as $package) { if ($package->tracking_number) { $tracking[$shipment->carrier]['data'] = $shipment->carrier; - $tracking[$shipment->carrier]['children'][] = check_plain($package->tracking_number); + $tracking[$shipment->carrier]['children'][] = String::checkPlain($package->tracking_number); } } } diff --git a/shipping/uc_shipping/uc_shipping.tokens.inc b/shipping/uc_shipping/uc_shipping.tokens.inc index 343b9f7..c2ff4df 100644 --- a/shipping/uc_shipping/uc_shipping.tokens.inc +++ b/shipping/uc_shipping/uc_shipping.tokens.inc @@ -5,6 +5,7 @@ * Token hooks for the uc_shipping module. */ +use Drupal\Component\Utility\String; /** * Implements hook_token_info(). @@ -42,7 +43,7 @@ function uc_shipping_tokens($type, $tokens, $data = array(), $options = array()) } } $tracking = implode(', ', $tracking_numbers); - $replacements[$original] = $sanitize ? check_plain($tracking) : $tracking; + $replacements[$original] = $sanitize ? String::checkPlain($tracking) : $tracking; break; } } diff --git a/shipping/uc_ups/uc_ups.ship.inc b/shipping/uc_ups/uc_ups.ship.inc index 6fcd61d..33059d3 100644 --- a/shipping/uc_ups/uc_ups.ship.inc +++ b/shipping/uc_ups/uc_ups.ship.inc @@ -5,6 +5,7 @@ * UPS functions for label generation. */ +use Drupal\Component\Utility\String; use Symfony\Component\HttpKernel\Exception\NotFoundHttpException; /** @@ -569,37 +570,37 @@ function theme_uc_ups_confirm_shipment($variables) { $output = '
' . t('Ship from:') . '
'; $output .= uc_address_format( - check_plain($_SESSION['ups']['origin']->first_name), - check_plain($_SESSION['ups']['origin']->last_name), - check_plain($_SESSION['ups']['origin']->company), - check_plain($_SESSION['ups']['origin']->street1), - check_plain($_SESSION['ups']['origin']->street2), - check_plain($_SESSION['ups']['origin']->city), - check_plain($_SESSION['ups']['origin']->zone), - check_plain($_SESSION['ups']['origin']->postal_code), - check_plain($_SESSION['ups']['origin']->country) + String::checkPlain($_SESSION['ups']['origin']->first_name), + String::checkPlain($_SESSION['ups']['origin']->last_name), + String::checkPlain($_SESSION['ups']['origin']->company), + String::checkPlain($_SESSION['ups']['origin']->street1), + String::checkPlain($_SESSION['ups']['origin']->street2), + String::checkPlain($_SESSION['ups']['origin']->city), + String::checkPlain($_SESSION['ups']['origin']->zone), + String::checkPlain($_SESSION['ups']['origin']->postal_code), + String::checkPlain($_SESSION['ups']['origin']->country) ); - $output .= '
' . check_plain($_SESSION['ups']['origin']->email); + $output .= '
' . String::checkPlain($_SESSION['ups']['origin']->email); $output .= '
'; $output .= '
' . t('Ship to:') . '
'; $output .= uc_address_format( - check_plain($_SESSION['ups']['destination']->first_name), - check_plain($_SESSION['ups']['destination']->last_name), - check_plain($_SESSION['ups']['destination']->company), - check_plain($_SESSION['ups']['destination']->street1), - check_plain($_SESSION['ups']['destination']->street2), - check_plain($_SESSION['ups']['destination']->city), - check_plain($_SESSION['ups']['destination']->zone), - check_plain($_SESSION['ups']['destination']->postal_code), - check_plain($_SESSION['ups']['destination']->country) + String::checkPlain($_SESSION['ups']['destination']->first_name), + String::checkPlain($_SESSION['ups']['destination']->last_name), + String::checkPlain($_SESSION['ups']['destination']->company), + String::checkPlain($_SESSION['ups']['destination']->street1), + String::checkPlain($_SESSION['ups']['destination']->street2), + String::checkPlain($_SESSION['ups']['destination']->city), + String::checkPlain($_SESSION['ups']['destination']->zone), + String::checkPlain($_SESSION['ups']['destination']->postal_code), + String::checkPlain($_SESSION['ups']['destination']->country) ); - $output .= '
' . check_plain($_SESSION['ups']['destination']->email); + $output .= '
' . String::checkPlain($_SESSION['ups']['destination']->email); $output .= '
'; $output .= '
'; $method = uc_ups_uc_shipping_method(); $output .= '' . $method['ups']['quote']['accessorials'][$_SESSION['ups']['service']] . '
'; - $output .= '' . check_plain($_SESSION['ups']['rate']['type']) . ': ' . theme('uc_price', array('price' => $_SESSION['ups']['rate']['amount'])) . ' (' . check_plain($_SESSION['ups']['rate']['currency']) . ') -- '; + $output .= '' . String::checkPlain($_SESSION['ups']['rate']['type']) . ': ' . theme('uc_price', array('price' => $_SESSION['ups']['rate']['amount'])) . ' (' . String::checkPlain($_SESSION['ups']['rate']['currency']) . ') -- '; $output .= '' . t('Paid') . ': ' . $_SESSION['ups']['paid'] . '
'; $ship_date = $_SESSION['ups']['ship_date']; $output .= 'Ship date: ' . format_date(gmmktime(12, 0, 0, $ship_date['month'], $ship_date['day'], $ship_date['year']), 'uc_store'); diff --git a/shipping/uc_weightquote/uc_weightquote.module b/shipping/uc_weightquote/uc_weightquote.module index 93850cf..1b5724c 100644 --- a/shipping/uc_weightquote/uc_weightquote.module +++ b/shipping/uc_weightquote/uc_weightquote.module @@ -6,6 +6,7 @@ * product. */ +use Drupal\Component\Utility\String; /** * Implements hook_form_BASE_FORM_ID_alter(). @@ -33,7 +34,7 @@ function uc_weightquote_form_node_form_alter(&$form, &$form_state, $form_id) { $unit = \Drupal::config('uc_store.settings')->get('units.weight'); $form['shipping']['weightquote'][$method->mid] = array( '#type' => 'uc_price', - '#title' => check_plain($method->title), + '#title' => String::checkPlain($method->title), '#default_value' => isset($form['#node']->weightquote[$method->mid]) ? $form['#node']->weightquote[$method->mid] : '', '#description' => t('Default rate: %price per @unit', array('%price' => uc_currency_format($method->product_rate), '@unit' => $unit)), '#field_suffix' => t('per @unit', array('@unit' => $unit)), @@ -191,8 +192,8 @@ function uc_weightquote_quote($products, $details, $method) { $quotes[] = array( 'rate' => $rate, - 'label' => check_plain($method->label), - 'option_label' => check_plain($method->label), + 'label' => String::checkPlain($method->label), + 'option_label' => String::checkPlain($method->label), ); } diff --git a/uc_attribute/lib/Drupal/uc_attribute/Controller/AttributeController.php b/uc_attribute/lib/Drupal/uc_attribute/Controller/AttributeController.php index 520d8ee..6bba212 100644 --- a/uc_attribute/lib/Drupal/uc_attribute/Controller/AttributeController.php +++ b/uc_attribute/lib/Drupal/uc_attribute/Controller/AttributeController.php @@ -7,6 +7,7 @@ namespace Drupal\uc_attribute\Controller; +use Drupal\Component\Utility\String; use Drupal\Core\Controller\ControllerBase; /** @@ -46,8 +47,8 @@ class AttributeController extends ControllerBase { $attr->label = $attr->name; } $rows[] = array( - check_plain($attr->name), - check_plain($attr->label), + String::checkPlain($attr->name), + String::checkPlain($attr->label), $attr->required == 1 ? t('Yes') : t('No'), $attr->ordering, $attr->options, diff --git a/uc_attribute/lib/Drupal/uc_attribute/Form/AttributeOptionsForm.php b/uc_attribute/lib/Drupal/uc_attribute/Form/AttributeOptionsForm.php index 610a099..a6a98c9 100644 --- a/uc_attribute/lib/Drupal/uc_attribute/Form/AttributeOptionsForm.php +++ b/uc_attribute/lib/Drupal/uc_attribute/Form/AttributeOptionsForm.php @@ -7,6 +7,7 @@ namespace Drupal\uc_attribute\Form; +use Drupal\Component\Utility\String; use Drupal\Core\Form\FormBase; /** @@ -52,7 +53,7 @@ class AttributeOptionsForm extends FormBase { foreach ($attribute->options as $oid => $option) { $form['options'][$oid]['#attributes']['class'][] = 'draggable'; $form['options'][$oid]['name'] = array( - '#markup' => check_plain($option->name), + '#markup' => String::checkPlain($option->name), ); $form['options'][$oid]['cost'] = array( '#theme' => 'uc_price', diff --git a/uc_attribute/lib/Drupal/uc_attribute/Form/ObjectAttributesFormBase.php b/uc_attribute/lib/Drupal/uc_attribute/Form/ObjectAttributesFormBase.php index 0cfc344..acf4e15 100644 --- a/uc_attribute/lib/Drupal/uc_attribute/Form/ObjectAttributesFormBase.php +++ b/uc_attribute/lib/Drupal/uc_attribute/Form/ObjectAttributesFormBase.php @@ -7,6 +7,7 @@ namespace Drupal\uc_attribute\Form; +use Drupal\Component\Utility\String; use Drupal\Core\Form\FormBase; /** @@ -75,7 +76,7 @@ abstract class ObjectAttributesFormBase extends FormBase { '#title_display' => 'invisible', ); $form['attributes'][$aid]['name'] = array( - '#markup' => check_plain($attribute->name), + '#markup' => String::checkPlain($attribute->name), ); $form['attributes'][$aid]['label'] = array( '#type' => 'textfield', @@ -85,7 +86,7 @@ abstract class ObjectAttributesFormBase extends FormBase { '#size' => 20, ); $form['attributes'][$aid]['option'] = array( - '#markup' => $option ? (check_plain($option->name) . ' (' . uc_currency_format($option->price) . ')' ) : t('n/a'), + '#markup' => $option ? (String::checkPlain($option->name) . ' (' . uc_currency_format($option->price) . ')' ) : t('n/a'), ); $form['attributes'][$aid]['required'] = array( '#type' => 'checkbox', diff --git a/uc_attribute/lib/Drupal/uc_attribute/Form/ObjectOptionsFormBase.php b/uc_attribute/lib/Drupal/uc_attribute/Form/ObjectOptionsFormBase.php index 5ec2684..985af2e 100644 --- a/uc_attribute/lib/Drupal/uc_attribute/Form/ObjectOptionsFormBase.php +++ b/uc_attribute/lib/Drupal/uc_attribute/Form/ObjectOptionsFormBase.php @@ -7,6 +7,7 @@ namespace Drupal\uc_attribute\Form; +use Drupal\Component\Utility\String; use Drupal\Core\Form\FormBase; /** @@ -60,7 +61,7 @@ abstract class ObjectOptionsFormBase extends FormBase { t('Weight'), t('List position'), ), - '#caption' => '

' . check_plain($attribute->name) . '

', + '#caption' => '

' . String::checkPlain($attribute->name) . '

', '#empty' => $this->t('This attribute does not have any options.'), '#tabledrag' => array( array( @@ -105,7 +106,7 @@ abstract class ObjectOptionsFormBase extends FormBase { $form['attributes'][$aid]['options'][$oid]['#attributes']['class'][] = 'draggable'; $form['attributes'][$aid]['options'][$oid]['select'] = array( '#type' => 'checkbox', - '#title' => check_plain($option->name), + '#title' => String::checkPlain($option->name), '#default_value' => isset($attribute->options[$oid]), ); $form['attributes'][$aid]['options'][$oid]['default'] = array( diff --git a/uc_attribute/lib/Drupal/uc_attribute/Form/ProductAdjustmentsForm.php b/uc_attribute/lib/Drupal/uc_attribute/Form/ProductAdjustmentsForm.php index e37eda0..1af803e 100644 --- a/uc_attribute/lib/Drupal/uc_attribute/Form/ProductAdjustmentsForm.php +++ b/uc_attribute/lib/Drupal/uc_attribute/Form/ProductAdjustmentsForm.php @@ -7,6 +7,7 @@ namespace Drupal\uc_attribute\Form; +use Drupal\Component\Utility\String; use Drupal\Core\Form\FormBase; use Drupal\node\NodeInterface; @@ -72,7 +73,7 @@ class ProductAdjustmentsForm extends FormBase { ->orderBy("ao$i.name"); ++$i; - $attribute_names .= '' . check_plain($prod_attr->name) . ''; + $attribute_names .= '' . String::checkPlain($prod_attr->name) . ''; $attribute_ids[] = $prod_attr->aid; } $num_prod_attr = count($attribute_ids); @@ -111,8 +112,8 @@ class ProductAdjustmentsForm extends FormBase { $row_title = ''; $comb_array = array(); for ($j = 1; $j <= $num_prod_attr; ++$j) { - $cells .= '' . check_plain($combo->{'name' . $j}) . ''; - $row_title .= check_plain($combo->{'name' . $j}) . ', '; + $cells .= '' . String::checkPlain($combo->{'name' . $j}) . ''; + $row_title .= String::checkPlain($combo->{'name' . $j}) . ', '; $comb_array[$combo->{'aid' . $j}] = $combo->{'oid' . $j}; } ksort($comb_array); diff --git a/uc_attribute/uc_attribute.module b/uc_attribute/uc_attribute.module index 95c30a5..3f250b9 100644 --- a/uc_attribute/uc_attribute.module +++ b/uc_attribute/uc_attribute.module @@ -12,6 +12,8 @@ */ use Drupal\Component\Utility\NestedArray; +use Drupal\Component\Utility\String; +use Drupal\Component\Utility\Xss; use Drupal\Core\Ajax\AjaxResponse; use Drupal\Core\Ajax\PrependCommand; use Drupal\Core\Ajax\ReplaceCommand; @@ -1212,10 +1214,10 @@ function _uc_attribute_alter_form($id, &$product, $use_ajax) { } } - // Select options are check_plain()ed, but radio button labels are not. + // Select options are sanitized, but radio button labels are not. $build = array( '#theme' => 'uc_attribute_option', - '#option' => $attribute->display == 2 ? check_plain($option->name) : $option->name, + '#option' => $attribute->display == 2 ? String::checkPlain($option->name) : $option->name, '#price' => $display_price, ); $options[$option->oid] = drupal_render($build); @@ -1271,10 +1273,10 @@ function _uc_attribute_alter_form($id, &$product, $use_ajax) { $name = _uc_attribute_get_name($attribute, FALSE); if (!is_null($name)) { - $form_attributes[$attribute->aid]['#title'] = check_plain($name); + $form_attributes[$attribute->aid]['#title'] = String::checkPlain($name); } - $form_attributes[$attribute->aid]['#description'] = filter_xss($attribute->description); + $form_attributes[$attribute->aid]['#description'] = Xss::filter($attribute->description); $form_attributes[$attribute->aid]['#required'] = $attribute->required; } diff --git a/uc_cart/lib/Drupal/uc_cart/Form/CheckoutForm.php b/uc_cart/lib/Drupal/uc_cart/Form/CheckoutForm.php index 241630d..d8326a9 100644 --- a/uc_cart/lib/Drupal/uc_cart/Form/CheckoutForm.php +++ b/uc_cart/lib/Drupal/uc_cart/Form/CheckoutForm.php @@ -7,6 +7,7 @@ namespace Drupal\uc_cart\Form; +use Drupal\Component\Utility\String; use Drupal\Core\Form\FormBase; use Drupal\uc_cart\Plugin\CheckoutPaneManager; use Symfony\Component\DependencyInjection\ContainerInterface; @@ -95,7 +96,7 @@ class CheckoutForm extends FormBase { $form['panes'][$id] = $pane->view($order, $form, $form_state); $form['panes'][$id] += array( '#type' => 'details', - '#title' => check_plain($pane->getTitle()), + '#title' => String::checkPlain($pane->getTitle()), '#id' => $id . '-pane', '#open' => TRUE, ); diff --git a/uc_cart/lib/Drupal/uc_cart/Form/CheckoutSettingsForm.php b/uc_cart/lib/Drupal/uc_cart/Form/CheckoutSettingsForm.php index ab30eb1..843b938 100644 --- a/uc_cart/lib/Drupal/uc_cart/Form/CheckoutSettingsForm.php +++ b/uc_cart/lib/Drupal/uc_cart/Form/CheckoutSettingsForm.php @@ -7,6 +7,7 @@ namespace Drupal\uc_cart\Form; +use Drupal\Component\Utility\String; use Drupal\Core\Config\ConfigFactory; use Drupal\Core\Form\ConfigFormBase; use Drupal\uc_cart\Plugin\CheckoutPaneManager; @@ -172,7 +173,7 @@ class CheckoutSettingsForm extends ConfigFormBase { $form['checkout']['panes'][$id]['#attributes']['class'][] = 'draggable'; $form['checkout']['panes'][$id]['status'] = array( '#type' => 'checkbox', - '#title' => check_plain($pane->getTitle()), + '#title' => String::checkPlain($pane->getTitle()), '#default_value' => $pane->isEnabled(), ); $form['checkout']['panes'][$id]['weight'] = array( diff --git a/uc_cart/lib/Drupal/uc_cart/Plugin/Ubercart/CheckoutPane/AddressPaneBase.php b/uc_cart/lib/Drupal/uc_cart/Plugin/Ubercart/CheckoutPane/AddressPaneBase.php index 9d8978d..a75654b 100644 --- a/uc_cart/lib/Drupal/uc_cart/Plugin/Ubercart/CheckoutPane/AddressPaneBase.php +++ b/uc_cart/lib/Drupal/uc_cart/Plugin/Ubercart/CheckoutPane/AddressPaneBase.php @@ -7,6 +7,7 @@ namespace Drupal\uc_cart\Plugin\Ubercart\CheckoutPane; +use Drupal\Component\Utility\String; use Drupal\uc_cart\CheckoutPanePluginBase; use Drupal\uc_order\UcOrderInterface; use Drupal\uc_store\Address; @@ -157,7 +158,7 @@ abstract class AddressPaneBase extends CheckoutPanePluginBase { $address = $order->getAddress($pane); $review[] = array('title' => t('Address'), 'data' => $address); if (uc_address_field_enabled('phone') && !empty($address->phone)) { - $review[] = array('title' => t('Phone'), 'data' => check_plain($address->phone)); + $review[] = array('title' => t('Phone'), 'data' => String::checkPlain($address->phone)); } return $review; } diff --git a/uc_cart/lib/Drupal/uc_cart/Plugin/Ubercart/CheckoutPane/CustomerInfoPane.php b/uc_cart/lib/Drupal/uc_cart/Plugin/Ubercart/CheckoutPane/CustomerInfoPane.php index 9056662..bad7d28 100644 --- a/uc_cart/lib/Drupal/uc_cart/Plugin/Ubercart/CheckoutPane/CustomerInfoPane.php +++ b/uc_cart/lib/Drupal/uc_cart/Plugin/Ubercart/CheckoutPane/CustomerInfoPane.php @@ -7,6 +7,7 @@ namespace Drupal\uc_cart\Plugin\Ubercart\CheckoutPane; +use Drupal\Component\Utility\String; use Drupal\uc_cart\CheckoutPanePluginBase; use Drupal\uc_order\UcOrderInterface; @@ -164,7 +165,7 @@ class CustomerInfoPane extends CheckoutPanePluginBase { * {@inheritdoc} */ public function review(UcOrderInterface $order) { - $review[] = array('title' => t('E-mail'), 'data' => check_plain($order->getEmail())); + $review[] = array('title' => t('E-mail'), 'data' => String::checkPlain($order->getEmail())); return $review; } diff --git a/uc_cart/lib/Drupal/uc_cart/Plugin/Ubercart/CheckoutPane/OrderCommentsPane.php b/uc_cart/lib/Drupal/uc_cart/Plugin/Ubercart/CheckoutPane/OrderCommentsPane.php index bacd5a5..0bc36ab 100644 --- a/uc_cart/lib/Drupal/uc_cart/Plugin/Ubercart/CheckoutPane/OrderCommentsPane.php +++ b/uc_cart/lib/Drupal/uc_cart/Plugin/Ubercart/CheckoutPane/OrderCommentsPane.php @@ -7,6 +7,7 @@ namespace Drupal\uc_cart\Plugin\Ubercart\CheckoutPane; +use Drupal\Component\Utility\String; use Drupal\uc_cart\CheckoutPanePluginBase; use Drupal\uc_order\UcOrderInterface; @@ -64,7 +65,7 @@ class OrderCommentsPane extends CheckoutPanePluginBase { $review = NULL; $result = db_query("SELECT message FROM {uc_order_comments} WHERE order_id = :id", array(':id' => $order->id())); if ($comment = $result->fetchObject()) { - $review[] = array('title' => t('Comment'), 'data' => check_plain($comment->message)); + $review[] = array('title' => t('Comment'), 'data' => String::checkPlain($comment->message)); } return $review; } diff --git a/uc_cart/uc_cart.api.php b/uc_cart/uc_cart.api.php index f9be0d3..a73ae60 100644 --- a/uc_cart/uc_cart.api.php +++ b/uc_cart/uc_cart.api.php @@ -1,5 +1,7 @@ 'checkbox'); $element['title'] = array( - '#markup' => $node->access('view') ? l($item->title, 'node/' . $item->nid) : check_plain($item->title), + '#markup' => $node->access('view') ? l($item->title, 'node/' . $item->nid) : String::checkPlain($item->title), ); @@ -342,7 +344,7 @@ function uc_checkout_pane_callback($op, $order, $form = NULL, &$form_state = NUL $review = NULL; $result = db_query("SELECT message FROM {uc_order_comments} WHERE order_id = :id", array(':id' => $order->id())); if ($comment = $result->fetchObject()) { - $review[] = array('title' => t('Comment'), 'data' => check_plain($comment->message)); + $review[] = array('title' => t('Comment'), 'data' => String::checkPlain($comment->message)); } return $review; } diff --git a/uc_cart/uc_cart.module b/uc_cart/uc_cart.module index f9187b0..f1f7e29 100644 --- a/uc_cart/uc_cart.module +++ b/uc_cart/uc_cart.module @@ -11,6 +11,7 @@ */ use Drupal\Component\Utility\UrlHelper; +use Drupal\Component\Utility\Xss; /** * Time in seconds after which a cart order is deemed abandoned. @@ -275,7 +276,7 @@ function uc_cart_complete_sale($order, $login = FALSE) { return array( '#theme' => 'uc_cart_complete_sale', - '#message' => filter_xss_admin($message), + '#message' => Xss::filterAdmin($message), '#order' => $order, ); } diff --git a/uc_cart_links/lib/Drupal/uc_cart_links/Controller/CartLinksReports.php b/uc_cart_links/lib/Drupal/uc_cart_links/Controller/CartLinksReports.php index 86c22a9..ff06746 100644 --- a/uc_cart_links/lib/Drupal/uc_cart_links/Controller/CartLinksReports.php +++ b/uc_cart_links/lib/Drupal/uc_cart_links/Controller/CartLinksReports.php @@ -7,6 +7,8 @@ namespace Drupal\uc_cart_links\Controller; +use Drupal\Component\Utility\String; + /** * Displays the Cart Links report. * @@ -37,7 +39,7 @@ class CartLinksReports { $result = $query->execute(); foreach ($result as $data) { $rows[] = array( - check_plain($data->cart_link_id), + String::checkPlain($data->cart_link_id), $data->clicks, format_date($data->last_click, 'short'), ); diff --git a/uc_file/uc_file.admin.inc b/uc_file/uc_file.admin.inc index f54bf2b..8a9449a 100644 --- a/uc_file/uc_file.admin.inc +++ b/uc_file/uc_file.admin.inc @@ -6,6 +6,7 @@ */ use Drupal\Component\Utility\Json; +use Drupal\Component\Utility\String; /** * Form step values. @@ -84,11 +85,11 @@ function uc_file_admin_files_form_show_files($form, &$form_state) { foreach ($result as $file) { $options[$file->fid] = array( 'filename' => array( - 'data' => check_plain($file->filename), + 'data' => String::checkPlain($file->filename), 'class' => is_dir(uc_file_qualify_file($file->filename)) ? array('uc-file-directory-view') : array(), ), 'title' => l($file->title, 'node/' . $file->nid), - 'model' => check_plain($file->model), + 'model' => String::checkPlain($file->model), ); } diff --git a/uc_file/uc_file.module b/uc_file/uc_file.module index 78b9942..71d591f 100644 --- a/uc_file/uc_file.module +++ b/uc_file/uc_file.module @@ -13,6 +13,7 @@ * Development sponsored by the Ubercart project. http://www.ubercart.org */ +use Drupal\Component\Utility\String; use Symfony\Component\HttpFoundation\JsonResponse; /** @@ -1439,7 +1440,7 @@ function uc_file_remove_user($user) { drupal_set_message(t('!user has had all of his/her downloadable files removed.', array( '!user' => theme('username', array( 'account' => $user, - 'name' => check_plain($user->name), + 'name' => String::checkPlain($user->name), 'link_path' => 'user/' . $user->id(), )), ))); @@ -1465,7 +1466,7 @@ function uc_file_remove_user_file_by_id($user, $fid) { drupal_set_message(t('!user has had %file removed from his/her downloadable file list.', array( '!user' => theme('username', array( 'account' => $user, - 'name' => check_plain($user->name), + 'name' => String::checkPlain($user->name), 'link_path' => 'user/' . $user->id(), )), '%file' => $file->filename, diff --git a/uc_file/uc_file.pages.inc b/uc_file/uc_file.pages.inc index 09299bb..f935984 100644 --- a/uc_file/uc_file.pages.inc +++ b/uc_file/uc_file.pages.inc @@ -265,7 +265,6 @@ function _uc_file_download_validate($file_download, &$user, $ip) { if (!$file_download || !is_readable($file_download->full_path)) { cache()->set('uc_file_' . $ip, $requests, REQUEST_TIME + 86400); if ($requests == UC_FILE_REQUEST_LIMIT) { - // $message_user has already been passed through check_plain() watchdog('uc_file', '!username has been temporarily banned from file downloads.', array('!username' => $message_user), WATCHDOG_WARNING); } @@ -276,7 +275,6 @@ function _uc_file_download_validate($file_download, &$user, $ip) { // Check the number of locations. if (!empty($file_download->address_limit) && !in_array($ip, $addresses) && count($addresses) >= $file_download->address_limit) { - // $message_user has already been passed through check_plain() watchdog('uc_file', '!username has been denied a file download by downloading it from too many IP addresses.', array('!username' => $message_user), WATCHDOG_WARNING); return UC_FILE_ERROR_TOO_MANY_LOCATIONS; @@ -284,7 +282,6 @@ function _uc_file_download_validate($file_download, &$user, $ip) { // Check the downloads so far. if (!empty($file_download->download_limit) && $file_download->accessed >= $file_download->download_limit) { - // $message_user has already been passed through check_plain() watchdog('uc_file', '!username has been denied a file download by downloading it too many times.', array('!username' => $message_user), WATCHDOG_WARNING); return UC_FILE_ERROR_TOO_MANY_DOWNLOADS; @@ -292,7 +289,6 @@ function _uc_file_download_validate($file_download, &$user, $ip) { // Check if it's expired. if ($file_download->expiration && REQUEST_TIME >= $file_download->expiration) { - // $message_user has already been passed through check_plain() watchdog('uc_file', '!username has been denied an expired file download.', array('!username' => $message_user), WATCHDOG_WARNING); return UC_FILE_ERROR_EXPIRED; @@ -309,7 +305,6 @@ function _uc_file_download_validate($file_download, &$user, $ip) { } // Everything's ok! - // $message_user has already been passed through check_plain() watchdog('uc_file', '!username has started download of the file %filename.', array('!username' => $message_user, '%filename' => drupal_basename($file_download->filename)), WATCHDOG_NOTICE); } diff --git a/uc_order/lib/Drupal/uc_order/Plugin/views/argument_validator/CurrentUserOrPermission.php b/uc_order/lib/Drupal/uc_order/Plugin/views/argument_validator/CurrentUserOrPermission.php index dae9105..d3f7dda 100644 --- a/uc_order/lib/Drupal/uc_order/Plugin/views/argument_validator/CurrentUserOrPermission.php +++ b/uc_order/lib/Drupal/uc_order/Plugin/views/argument_validator/CurrentUserOrPermission.php @@ -7,6 +7,7 @@ namespace Drupal\uc_order\Plugin\views\argument_validator; +use Drupal\Component\Utility\String; use Drupal\views\Plugin\views\argument_validator\ArgumentValidatorPluginBase; /** @@ -117,7 +118,7 @@ class CurrentUserOrPermission extends ArgumentValidatorPluginBase { } $this->argument->argument = $account->id(); - $this->argument->validated_title = check_plain($account->hasPermission($account)); + $this->argument->validated_title = String::checkPlain($account->hasPermission($account)); return TRUE; } diff --git a/uc_order/lib/Drupal/uc_order/UcOrderProductViewBuilder.php b/uc_order/lib/Drupal/uc_order/UcOrderProductViewBuilder.php index dbd9d5f..7122021 100644 --- a/uc_order/lib/Drupal/uc_order/UcOrderProductViewBuilder.php +++ b/uc_order/lib/Drupal/uc_order/UcOrderProductViewBuilder.php @@ -7,6 +7,7 @@ namespace Drupal\uc_order; +use Drupal\Component\Utility\String; use Drupal\Core\Entity\EntityViewBuilder; /** @@ -27,13 +28,13 @@ class UcOrderProductViewBuilder extends EntityViewBuilder { '#cell_attributes' => array('class' => array('qty')), ); $node = node_load($product->nid->value); - $title = $node->access('view') ? l($product->title->value, 'node/' . $product->nid->value) : check_plain($product->title->value); + $title = $node->access('view') ? l($product->title->value, 'node/' . $product->nid->value) : String::checkPlain($product->title->value); $product->content['product'] = array( '#markup' => $title . uc_product_get_description($product), '#cell_attributes' => array('class' => array('product')), ); $product->content['model'] = array( - '#markup' => check_plain($product->model->value), + '#markup' => String::checkPlain($product->model->value), '#cell_attributes' => array('class' => array('sku')), ); $account = \Drupal::currentUser(); diff --git a/uc_order/uc_order.admin.inc b/uc_order/uc_order.admin.inc index 33cf8b9..6074190 100644 --- a/uc_order/uc_order.admin.inc +++ b/uc_order/uc_order.admin.inc @@ -121,7 +121,6 @@ function uc_order_select_customer($email = NULL) { // Check to see if the e-mail address for a new user is unique. if (arg(5) == 'check') { - $email = check_plain($_POST['email']); $build['email'] = array('#markup' => ''); $result = db_query("SELECT uid, mail FROM {users} WHERE mail = :mail", array(':mail' => $email)); if ($user = $result->fetchObject()) { diff --git a/uc_order/uc_order.api.php b/uc_order/uc_order.api.php index b09400f..a21f40b 100644 --- a/uc_order/uc_order.api.php +++ b/uc_order/uc_order.api.php @@ -338,7 +338,7 @@ function uc_order_pane_callback($op, $order, &$form = NULL, &$form_state = NULL) $comments = uc_order_comments_load($form['order_id']['#value'], TRUE); if (is_array($comments) && count($comments) > 0) { foreach ($comments as $comment) { - $items[] = '[' . theme('uc_uid', array('uid' => $comment->uid)) . '] ' . filter_xss_admin($comment->message); + $items[] = '[' . theme('uc_uid', array('uid' => $comment->uid)) . '] ' . \Drupal\Component\Utility\Xss::filterAdmin($comment->message); } } else { diff --git a/uc_order/uc_order.module b/uc_order/uc_order.module index ec23ac7..4ac285a 100644 --- a/uc_order/uc_order.module +++ b/uc_order/uc_order.module @@ -11,6 +11,8 @@ */ use Drupal\Core\Template\Attribute; +use Drupal\Component\Utility\String; +use Drupal\Component\Utility\Xss; require_once dirname(__FILE__) . '/uc_order.order_pane.inc'; require_once dirname(__FILE__) . '/uc_order.line_item.inc'; @@ -764,9 +766,9 @@ function template_preprocess_uc_order_invoice_page(&$variables) { $variables['html_attributes']['dir'] = $language_interface->direction ? 'rtl' : 'ltr'; $site_config = \Drupal::config('system.site'); - $head_title = array('name' => check_plain($site_config->get('name'))); + $head_title = array('name' => String::checkPlain($site_config->get('name'))); if ($site_config->get('slogan')) { - $head_title['slogan'] = strip_tags(filter_xss_admin($site_config->get('slogan'))); + $head_title['slogan'] = strip_tags(Xss::filterAdmin($site_config->get('slogan'))); } // Add favicon. diff --git a/uc_order/uc_order.order_pane.inc b/uc_order/uc_order.order_pane.inc index a30afa4..dbdae3f 100644 --- a/uc_order/uc_order.order_pane.inc +++ b/uc_order/uc_order.order_pane.inc @@ -10,6 +10,8 @@ * default order panes are defined in uc_order_order_pane() in uc_order.module. */ +use Drupal\Component\Utility\String; +use Drupal\Component\Utility\Xss; use Drupal\Core\Ajax\AjaxResponse; use Drupal\Core\Ajax\PrependCommand; use Drupal\Core\Ajax\ReplaceCommand; @@ -46,7 +48,7 @@ function uc_order_pane_ship_to($op, $order, &$form = NULL, &$form_state = NULL) } case 'view': $address = $order->getAddress('delivery'); - $build = array('#markup' => $address . '
' . check_plain($address->phone)); + $build = array('#markup' => $address . '
' . String::checkPlain($address->phone)); return $build; case 'edit-form': @@ -89,7 +91,7 @@ function uc_order_pane_bill_to($op, $order, &$form = NULL, &$form_state = NULL) case 'view': case 'customer': $address = $order->getAddress('billing'); - $build = array('#markup' => $address . '
' . check_plain($address->phone)); + $build = array('#markup' => $address . '
' . String::checkPlain($address->phone)); return $build; case 'edit-form': @@ -380,7 +382,7 @@ function uc_order_add_product_form($form, &$form_state, $order, $node) { } $node = uc_product_load_variant(intval($form_state['values']['product_controls']['nid']), $data); $form['title'] = array( - '#markup' => '

' . check_plain($node->label()) . '

', + '#markup' => '

' . String::checkPlain($node->label()) . '

', ); $form['nid'] = array( '#type' => 'hidden', @@ -701,7 +703,7 @@ function uc_order_pane_line_items($op, $order, &$form = NULL, &$form_state = NUL ); $table_row['title'] = array( - '#markup' => check_plain($item['title']), + '#markup' => String::checkPlain($item['title']), '#prefix' => '', '#suffix' => '', ); @@ -724,7 +726,7 @@ function uc_order_pane_line_items($op, $order, &$form = NULL, &$form_state = NUL $line_items = $order->line_items; foreach ($items as $item) { if (isset($item['add_list']) && $item['add_list'] === TRUE) { - $options[$item['id']] = check_plain($item['title']); + $options[$item['id']] = String::checkPlain($item['title']); } if (isset($item['display_only']) && $item['display_only'] == TRUE) { $result = $item['callback']('display', $order); @@ -798,7 +800,7 @@ function uc_order_pane_line_items($op, $order, &$form = NULL, &$form_state = NUL } else { $form['line_items'][$item['line_item_id']]['title'] = array( - '#markup' => check_plain($item['title']), + '#markup' => String::checkPlain($item['title']), ); $form['line_items'][$item['line_item_id']]['amount'] = array( '#theme' => 'uc_price', @@ -921,8 +923,8 @@ function uc_order_pane_order_comments($op, $order, &$form = NULL, &$form_state = array('data' => format_date($comment->created, 'short'), 'class' => array('date')), array('data' => array('#theme' => 'uc_uid', '#uid' => $comment->uid), 'class' => array('user')), array('data' => array('#theme' => 'image', '#uri' => drupal_get_path('module', 'uc_order') . '/images/' . $icon), 'class' => array('notified')), - array('data' => check_plain($statuses[$comment->order_status]->name), 'class' => array('status')), - array('data' => check_plain($comment->message), 'class' => array('message')), + array('data' => String::checkPlain($statuses[$comment->order_status]->name), 'class' => array('status')), + array('data' => String::checkPlain($comment->message), 'class' => array('message')), ); } return $build; @@ -940,8 +942,8 @@ function uc_order_pane_order_comments($op, $order, &$form = NULL, &$form_state = foreach ($comments as $comment) { $rows[] = array( array('data' => format_date($comment->created, 'uc_store'), 'class' => array('date')), - array('data' => check_plain($statuses[$comment->order_status]->name), 'class' => array('status')), - array('data' => check_plain($comment->message), 'class' => array('message')), + array('data' => String::checkPlain($statuses[$comment->order_status]->name), 'class' => array('status')), + array('data' => String::checkPlain($comment->message), 'class' => array('message')), ); } } @@ -978,7 +980,7 @@ function uc_order_pane_admin_comments($op, $order, &$form = NULL, &$form_state = $build['#rows'][] = array( array('data' => format_date($comment->created, 'short'), 'class' => array('date')), array('data' => array('#theme' => 'uc_uid', '#uid' => $comment->uid), 'class' => array('user')), - array('data' => filter_xss_admin($comment->message), 'class' => array('message')), + array('data' => Xss::filterAdmin($comment->message), 'class' => array('message')), ); } return $build; @@ -1002,7 +1004,7 @@ function uc_order_pane_admin_comments($op, $order, &$form = NULL, &$form_state = '#theme' => 'uc_uid', '#uid' => $comment->uid, ); - $items[] = '[' . drupal_render($username) . '] ' . filter_xss_admin($comment->message); + $items[] = '[' . drupal_render($username) . '] ' . Xss::filterAdmin($comment->message); } $item_list = array( '#theme' => 'item_list', diff --git a/uc_order/uc_order.tokens.inc b/uc_order/uc_order.tokens.inc index f968ee3..40b5851 100644 --- a/uc_order/uc_order.tokens.inc +++ b/uc_order/uc_order.tokens.inc @@ -5,6 +5,8 @@ * Token hooks for the uc_order module. */ +use Drupal\Component\Utility\String; + /** * Implements hook_token_info(). */ @@ -149,7 +151,7 @@ function uc_order_tokens($type, $tokens, $data = array(), $options = array()) { switch ($name) { case 'new-username': if (isset($order->data['new_user']['name'])) { - $replacements[$original] = $sanitize ? check_plain($order->data['new_user']['name']) : $order->data['new_user']['name']; + $replacements[$original] = $sanitize ? String::checkPlain($order->data['new_user']['name']) : $order->data['new_user']['name']; } break; @@ -210,7 +212,7 @@ function uc_order_tokens($type, $tokens, $data = array(), $options = array()) { case 'email': case 'mail': - $replacements[$original] = $sanitize ? check_plain($order->getEmail()) : $order->getEmail(); + $replacements[$original] = $sanitize ? String::checkPlain($order->getEmail()) : $order->getEmail(); break; case 'shipping-method': @@ -232,7 +234,7 @@ function uc_order_tokens($type, $tokens, $data = array(), $options = array()) { break; case 'shipping-phone': - $replacements[$original] = check_plain($order->getAddress('delivery')->phone); + $replacements[$original] = String::checkPlain($order->getAddress('delivery')->phone); break; case 'billing-address': @@ -242,31 +244,31 @@ function uc_order_tokens($type, $tokens, $data = array(), $options = array()) { break; case 'billing-phone': - $replacements[$original] = check_plain($order->getAddress('billing')->phone); + $replacements[$original] = String::checkPlain($order->getAddress('billing')->phone); break; case 'first-name': if (\Drupal::config('uc_store.settings')->get('customer_address') == 'shipping') { - $replacements[$original] = $sanitize ? check_plain($order->getAddress('delivery')->first_name) : $order->getAddress('delivery')->first_name; + $replacements[$original] = $sanitize ? String::checkPlain($order->getAddress('delivery')->first_name) : $order->getAddress('delivery')->first_name; } else { - $replacements[$original] = $sanitize ? check_plain($order->getAddress('billing')->first_name) : $order->getAddress('billing')->first_name; + $replacements[$original] = $sanitize ? String::checkPlain($order->getAddress('billing')->first_name) : $order->getAddress('billing')->first_name; } break; case 'last-name': if (\Drupal::config('uc_store.settings')->get('customer_address') == 'shipping') { - $replacements[$original] = $sanitize ? check_plain($order->getAddress('delivery')->last_name) : $order->getAddress('delivery')->last_name; + $replacements[$original] = $sanitize ? String::checkPlain($order->getAddress('delivery')->last_name) : $order->getAddress('delivery')->last_name; } else { - $replacements[$original] = $sanitize ? check_plain($order->getAddress('billing')->last_name) : $order->getAddress('billing')->last_name; + $replacements[$original] = $sanitize ? String::checkPlain($order->getAddress('billing')->last_name) : $order->getAddress('billing')->last_name; } break; case 'comments': $result = db_query_range("SELECT message FROM {uc_order_comments} WHERE order_id = :order_id AND uid = :uid ORDER BY created DESC", 0, 1, array(':order_id' => $order->id(), ':uid' => 0))->fetchField(); if ($sanitize) { - $result = check_plain($result); + $result = String::checkPlain($result); } $replacements[$original] = empty($result) ? t('No comments left.') : $result; break; @@ -274,13 +276,13 @@ function uc_order_tokens($type, $tokens, $data = array(), $options = array()) { case 'last-comment': $result = db_query_range("SELECT message FROM {uc_order_comments} WHERE order_id = :order_id AND uid > :uid ORDER BY created DESC", 0, 1, array(':order_id' => $order->id(), ':uid' => 0))->fetchField(); if ($sanitize) { - $result = check_plain($result); + $result = String::checkPlain($result); } $replacements[$original] = empty($result) ? t('No comment found.') : $result; break; case 'order-status': - $replacements[$original] = $sanitize ? check_plain($order->getStatus()->name) : $order->getStatus()->name; + $replacements[$original] = $sanitize ? String::checkPlain($order->getStatus()->name) : $order->getStatus()->name; break; case 'customer': @@ -305,7 +307,7 @@ function uc_order_tokens($type, $tokens, $data = array(), $options = array()) { $products[] = drupal_render($qty) . ' ' . $product->title->value; } if ($sanitize) { - $products = array_map('check_plain', $products); + $products = array_map('\Drupal\Component\Utility\String::checkPlain', $products); } $replacements[$original] = implode("
\n", $products); break; diff --git a/uc_product/lib/Drupal/uc_product/Controller/ProductController.php b/uc_product/lib/Drupal/uc_product/Controller/ProductController.php index 4392ca2..9b1aeef 100644 --- a/uc_product/lib/Drupal/uc_product/Controller/ProductController.php +++ b/uc_product/lib/Drupal/uc_product/Controller/ProductController.php @@ -7,6 +7,8 @@ namespace Drupal\uc_product\Controller; +use Drupal\Component\Utility\String; +use Drupal\Component\Utility\Xss; use Drupal\Core\Controller\ControllerBase; /** @@ -30,9 +32,9 @@ class ProductController extends ControllerBase { $ops[] = l(t('delete'), 'admin/structure/types/manage/' . $class->type . '/delete'); } $rows[] = array( - check_plain($class->type), - check_plain($class->name), - filter_xss_admin($class->description), + String::checkPlain($class->type), + String::checkPlain($class->name), + Xss::filterAdmin($class->description), implode(' ', $ops), ); } diff --git a/uc_product/uc_product.module b/uc_product/uc_product.module index 06c82a6..b31820a 100644 --- a/uc_product/uc_product.module +++ b/uc_product/uc_product.module @@ -8,6 +8,7 @@ * classes for more specification. */ +use Drupal\Component\Utility\String; use Drupal\Core\Ajax\AjaxResponse; use Drupal\Core\Entity\EntityInterface; use Drupal\Core\Field\FieldDefinitionInterface; @@ -827,7 +828,7 @@ function uc_product_uc_cart_display($item) { $element['remove'] = array('#type' => 'submit', '#value' => t('Remove')); $element['title'] = array( - '#markup' => $node->access('view') ? l($item->title, 'node/' . $node->id()) : check_plain($item->title), + '#markup' => $node->access('view') ? l($item->title, 'node/' . $node->id()) : String::checkPlain($item->title), ); $element['#total'] = $item->price * $item->qty->value; diff --git a/uc_product/uc_product.theme.inc b/uc_product/uc_product.theme.inc index 4906af0..6bd426b 100644 --- a/uc_product/uc_product.theme.inc +++ b/uc_product/uc_product.theme.inc @@ -4,6 +4,7 @@ * Theme functions for uc_product module. */ +use Drupal\Component\Utility\String; use Drupal\Core\Template\Attribute; /** @@ -27,7 +28,7 @@ function theme_uc_product_model($variables) { $output = '
'; $output .= '' . t('SKU') . ': '; - $output .= '' . check_plain($model) . ''; + $output .= '' . String::checkPlain($model) . ''; $output .= '
'; return $output; diff --git a/uc_product/uc_product.tokens.inc b/uc_product/uc_product.tokens.inc index 7932f16..7eb0191 100644 --- a/uc_product/uc_product.tokens.inc +++ b/uc_product/uc_product.tokens.inc @@ -5,6 +5,8 @@ * Token hooks for the uc_product module. */ +use Drupal\Component\Utility\String; + /** * Implements hook_token_info(). */ @@ -153,7 +155,7 @@ function uc_product_tokens($type, $tokens, $data = array(), $options = array()) foreach ($tokens as $name => $original) { switch ($name) { case 'product:model': - $replacements[$original] = $sanitize ? check_plain($product->model) : $product->model; + $replacements[$original] = $sanitize ? String::checkPlain($product->model) : $product->model; break; case 'product:list-price': diff --git a/uc_product_kit/uc_product_kit.module b/uc_product_kit/uc_product_kit.module index f73ec6e..b2af7e8 100644 --- a/uc_product_kit/uc_product_kit.module +++ b/uc_product_kit/uc_product_kit.module @@ -7,6 +7,7 @@ * Product kits are groups of products that are sold as a unit. */ +use Drupal\Component\Utility\String; use Drupal\Core\Entity\EntityInterface; use Drupal\entity\Entity\EntityViewDisplay; use Drupal\node\NodeInterface; @@ -100,7 +101,7 @@ function uc_product_kit_uc_form_alter(&$form, &$form_state, $form_id) { $form['products'] = array('#tree' => TRUE); foreach ($kit->products as $i => $product) { - $form['products'][$i] = array('#title' => check_plain($product->label())); + $form['products'][$i] = array('#title' => String::checkPlain($product->label())); $form['products'][$i]['nid'] = array('#type' => 'hidden', '#value' => $product->id()); $form['products'][$i]['qty'] = array('#type' => 'hidden', '#value' => $product->qty); } @@ -116,7 +117,7 @@ function uc_product_kit_uc_form_alter(&$form, &$form_state, $form_id) { $form['products'] = array('#tree' => TRUE); foreach ($node->products as $i => $product) { - $form['products'][$i] = array('#title' => check_plain($product->title)); + $form['products'][$i] = array('#title' => String::checkPlain($product->title)); $form['products'][$i]['nid'] = array('#type' => 'hidden', '#value' => $product->nid); $form['products'][$i]['qty'] = array('#type' => 'hidden', '#value' => $product->qty); } diff --git a/uc_product_kit/uc_product_kit.theme.inc b/uc_product_kit/uc_product_kit.theme.inc index cec200f..6b4dda3 100644 --- a/uc_product_kit/uc_product_kit.theme.inc +++ b/uc_product_kit/uc_product_kit.theme.inc @@ -5,6 +5,7 @@ * Theme functions for the uc_product_kit module. */ +use Drupal\Component\Utility\String; use Drupal\node\NodeInterface; /** @@ -21,7 +22,7 @@ function theme_uc_product_kit_list_item($variables) { $title = l($product->label(), 'node/' . $product->id()); } else { - $title = check_plain($product->label()); + $title = String::checkPlain($product->label()); } $qty = $product->qty; } @@ -31,7 +32,7 @@ function theme_uc_product_kit_list_item($variables) { $title = l($product->title, 'node/' . $product->nid->value); } else { - $title = check_plain($product->title); + $title = String::checkPlain($product->title); } $qty = $product->qty->value; } diff --git a/uc_reports/uc_reports.module b/uc_reports/uc_reports.module index 8ddddc5..c66ad1f 100644 --- a/uc_reports/uc_reports.module +++ b/uc_reports/uc_reports.module @@ -10,6 +10,8 @@ * number sold, and revenue produced. */ +use Drupal\Component\Utility\String; + /** * The maximum number of records. */ @@ -73,7 +75,7 @@ function uc_reports_help($path, $arg) { if ($include_statuses) { $statuses = array(); foreach (uc_reports_order_statuses() as $status) { - $statuses[] = check_plain(entity_load('uc_order_status', $status)->name); + $statuses[] = String::checkPlain(entity_load('uc_order_status', $status)->name); } $order_statuses = t('Order statuses used: @statuses', array('@statuses' => implode(', ', array_filter($statuses)))); diff --git a/uc_roles/uc_roles.admin.inc b/uc_roles/uc_roles.admin.inc index ae1cfa8..157fc26 100644 --- a/uc_roles/uc_roles.admin.inc +++ b/uc_roles/uc_roles.admin.inc @@ -5,6 +5,8 @@ * Roles administration menu items. */ +use Drupal\Component\Utility\String; + /** * Creates the header for the table/pager. */ @@ -40,13 +42,13 @@ function uc_roles_expiration($form, &$form_state) { // Stick the expirations into the form. foreach ($result as $row) { $account = user_load($row->uid); - $name = check_plain(user_format_name($account)); + $name = String::checkPlain(user_format_name($account)); $form['name'][$row->uid . ' ' . $row->rid] = array( '#theme' => 'username', '#account' => $account, '#name' => $name, ); - $form['role'][$row->uid . ' ' . $row->rid] = array('#markup' => check_plain(_uc_roles_get_name($row->rid))); + $form['role'][$row->uid . ' ' . $row->rid] = array('#markup' => String::checkPlain(_uc_roles_get_name($row->rid))); $form['expiration'][$row->uid . ' ' . $row->rid] = array('#markup' => format_date($row->expiration, 'short')); $form['edit'][$row->uid . ' ' . $row->rid] = array('#markup' => l(t('edit'), 'user/' . $row->uid . '/edit', array('fragment' => 'role-expiration-' . $row->rid, 'query' => array('destination' => 'admin/people/expiration')))); $form['delete'][$row->uid . ' ' . $row->rid] = array('#markup' => l(t('delete'), 'admin/people/expiration/delete/' . $row->uid . '/' . $row->rid)); @@ -115,7 +117,7 @@ function uc_roles_deletion_form($form, &$form_state, $account, $rid) { t('Delete expiration of %role_name role for the user !user?', array( '!user' => theme('username', array( 'account' => $account, - 'name' => check_plain(user_format_name($account)), + 'name' => String::checkPlain(user_format_name($account)), 'link_path' => 'user/' . $account->id(), )), '%role_name' => $role_name, @@ -124,7 +126,7 @@ function uc_roles_deletion_form($form, &$form_state, $account, $rid) { t('Deleting the expiration will give !user privileges set by the %role_name role indefinitely unless manually removed.', array( '!user' => theme('username', array( 'account' => $account, - 'name' => check_plain(user_format_name($account)), + 'name' => String::checkPlain(user_format_name($account)), 'link_path' => 'user/' . $account->id(), )), '%role_name' => $role_name, diff --git a/uc_roles/uc_roles.module b/uc_roles/uc_roles.module index 49b32b9..e1383bc 100644 --- a/uc_roles/uc_roles.module +++ b/uc_roles/uc_roles.module @@ -10,6 +10,7 @@ * expire/need to be renewed/etc. */ +use Drupal\Component\Utility\String; /** * Implements hook_help(). @@ -351,7 +352,7 @@ function uc_roles_user_view($account, $view_mode) { foreach ($expirations as $expiration) { $form[$expiration->rid] = array( '#type' => 'item', - '#title' => check_plain(_uc_roles_get_name($expiration->rid)), + '#title' => String::checkPlain(_uc_roles_get_name($expiration->rid)), '#markup' => t('This role will expire on !date', array('!date' => format_date($expiration->expiration, 'short'))), ); } @@ -989,7 +990,7 @@ function uc_roles_delete($account, $rid = NULL, $silent = FALSE) { drupal_set_message(t('The expiration of %role_name role for the user !user has been deleted.', array( '!user' => theme('username', array( 'account' => $account, - 'name' => check_plain(user_format_name($account)), + 'name' => String::checkPlain(user_format_name($account)), 'link_path' => 'user/' . $account->id(), )), '%role_name' => _uc_roles_get_name($rid), @@ -1035,7 +1036,7 @@ function uc_roles_revoke(&$account, $rid, $silent = FALSE) { drupal_set_message(t('!user has had the %role role revoked.', array( '!user' => theme('username', array( 'account' => $account, - 'name' => check_plain(user_format_name($account)), + 'name' => String::checkPlain(user_format_name($account)), 'link_path' => 'user/' . $account->id(), )), '%role' => $role_name, @@ -1104,7 +1105,7 @@ function uc_roles_grant(&$account, $rid, $timestamp, $save_user = TRUE, $silent $message = t('!user has been granted the %role role.', array( '!user' => theme('username', array( 'account' => $account, - 'name' => check_plain(user_format_name($account)), + 'name' => String::checkPlain(user_format_name($account)), 'link_path' => 'user/' . $account->id(), )), '%role' => $role_name, @@ -1167,7 +1168,7 @@ function uc_roles_renew($account, $rid, $timestamp, $silent = FALSE) { $message = t("!user's %role role has been renewed. It will expire on %date.", array( '!user' => theme('username', array( 'account' => $account, - 'name' => check_plain(user_format_name($account)), + 'name' => String::checkPlain(user_format_name($account)), 'link_path' => 'user/' . $account->id(), )), '%role' => $role_name, diff --git a/uc_roles/uc_roles.theme.inc b/uc_roles/uc_roles.theme.inc index 4e54b48..551fb57 100644 --- a/uc_roles/uc_roles.theme.inc +++ b/uc_roles/uc_roles.theme.inc @@ -5,6 +5,8 @@ * Theme functions for the uc_roles module. */ +use Drupal\Component\Utility\String; + /** * Themes the roles dialog on the account edit page. * @@ -63,7 +65,7 @@ function theme_uc_roles_user_expiration($variables) { $rows[] = array( array('data' => drupal_render($data['remove'])), - array('data' => check_plain($data['name']['#value'])), + array('data' => String::checkPlain($data['name']['#value'])), array('data' => format_date($data['expiration']['#value'], 'short')), // Options to adjust the expiration. diff --git a/uc_roles/uc_roles.tokens.inc b/uc_roles/uc_roles.tokens.inc index 3cb78e7..1a40097 100644 --- a/uc_roles/uc_roles.tokens.inc +++ b/uc_roles/uc_roles.tokens.inc @@ -5,6 +5,8 @@ * Token hooks for the uc_roles module. */ +use Drupal\Component\Utility\String; + /** * Implements hook_token_info(). */ @@ -50,7 +52,7 @@ function uc_roles_tokens($type, $tokens, $data = array(), $options = array()) { $replacements[$original] = format_date($object->expiration, 'medium'); break; case 'name': - $replacements[$original] = $sanitize ? check_plain(_uc_roles_get_name($object->rid)) : _uc_roles_get_name($object->rid); + $replacements[$original] = $sanitize ? String::checkPlain(_uc_roles_get_name($object->rid)) : _uc_roles_get_name($object->rid); break; } } diff --git a/uc_stock/lib/Drupal/uc_stock/Form/StockEditForm.php b/uc_stock/lib/Drupal/uc_stock/Form/StockEditForm.php index fad29f6..3ecd6e0 100644 --- a/uc_stock/lib/Drupal/uc_stock/Form/StockEditForm.php +++ b/uc_stock/lib/Drupal/uc_stock/Form/StockEditForm.php @@ -7,6 +7,7 @@ namespace Drupal\uc_stock\Form; +use Drupal\Component\Utility\String; use Drupal\Core\Form\FormBase; use Drupal\node\NodeInterface; @@ -46,7 +47,7 @@ class StockEditForm extends FormBase { '#default_value' => !empty($stock['active']) ? $stock['active'] : 0, ); $form['stock'][$sku]['sku'] = array( - '#markup' => check_plain($sku), + '#markup' => String::checkPlain($sku), ); $form['stock'][$sku]['stock'] = array( '#type' => 'textfield', diff --git a/uc_stock/uc_stock.tokens.inc b/uc_stock/uc_stock.tokens.inc index a3bf072..2d6ec02 100644 --- a/uc_stock/uc_stock.tokens.inc +++ b/uc_stock/uc_stock.tokens.inc @@ -5,6 +5,8 @@ * Token hooks for the uc_stock module. */ +use Drupal\Component\Utility\String; + /** * Implements hook_token_info(). */ @@ -52,7 +54,7 @@ function uc_stock_tokens($type, $tokens, $data = array(), $options = array()) { break; case 'model': - $replacements[$original] = $sanitize ? check_plain($object->sku) : $object->sku; + $replacements[$original] = $sanitize ? String::checkPlain($object->sku) : $object->sku; break; case 'threshold': diff --git a/uc_store/lib/Drupal/uc_store/Address.php b/uc_store/lib/Drupal/uc_store/Address.php index af1870a..c5f51e7 100644 --- a/uc_store/lib/Drupal/uc_store/Address.php +++ b/uc_store/lib/Drupal/uc_store/Address.php @@ -7,6 +7,7 @@ namespace Drupal\uc_store; +use Drupal\Component\Utility\String; use Drupal\Component\Utility\Unicode; /** @@ -135,15 +136,15 @@ class Address { $variables = array( "\r\n" => '
', - '!company' => check_plain($this->company), - '!first_name' => check_plain($this->first_name), - '!last_name' => check_plain($this->last_name), - '!street1' => check_plain($this->street1), - '!street2' => check_plain($this->street2), - '!city' => check_plain($this->city), + '!company' => String::checkPlain($this->company), + '!first_name' => String::checkPlain($this->first_name), + '!last_name' => String::checkPlain($this->last_name), + '!street1' => String::checkPlain($this->street1), + '!street2' => String::checkPlain($this->street2), + '!city' => String::checkPlain($this->city), '!zone_code' => $zone_data['zone_code'], '!zone_name' => $zone_data['zone_name'], - '!postal_code' => check_plain($this->postal_code), + '!postal_code' => String::checkPlain($this->postal_code), '!country_name' => t($country_data['country_name']), '!country_code2' => $country_data['country_iso_code_2'], '!country_code3' => $country_data['country_iso_code_3'], diff --git a/uc_store/uc_store.module b/uc_store/uc_store.module index 26fae52..73428b9 100644 --- a/uc_store/uc_store.module +++ b/uc_store/uc_store.module @@ -11,6 +11,7 @@ use Drupal\Component\Utility\Json; use Drupal\Component\Utility\NestedArray; +use Drupal\Component\Utility\String; use Drupal\Component\Utility\Unicode; use Drupal\uc_store\Address; @@ -820,15 +821,15 @@ function uc_address_format($first_name, $last_name, $company, $street1, $street2 $variables = array( "\r\n" => '
', - '!company' => check_plain($company), - '!first_name' => check_plain($first_name), - '!last_name' => check_plain($last_name), - '!street1' => check_plain($street1), - '!street2' => check_plain($street2), - '!city' => check_plain($city), + '!company' => String::checkPlain($company), + '!first_name' => String::checkPlain($first_name), + '!last_name' => String::checkPlain($last_name), + '!street1' => String::checkPlain($street1), + '!street2' => String::checkPlain($street2), + '!city' => String::checkPlain($city), '!zone_code' => $zone_data['zone_code'], '!zone_name' => $zone_data['zone_name'], - '!postal_code' => check_plain($postal_code), + '!postal_code' => String::checkPlain($postal_code), '!country_name' => t($country_data['country_name']), '!country_code2' => $country_data['country_iso_code_2'], '!country_code3' => $country_data['country_iso_code_3'], @@ -1109,7 +1110,7 @@ function uc_select_address($uid, $type = 'billing', $onchange = '', $title = NUL (isset($addresses[$key + 1]) && $option == $addresses[$key + 1]['street1'])) { $option .= ' - ' . $address['first_name'] . ' ' . $address['last_name']; } - $options[Json::encode($address)] = check_plain($option); + $options[Json::encode($address)] = String::checkPlain($option); } $select = array( @@ -1146,7 +1147,7 @@ function uc_select_addresses($uid, $type = 'billing') { (isset($addresses[$key + 1]) && $option == $addresses[$key + 1]['street1'])) { $option .= ' - ' . $address['first_name'] . ' ' . $address['last_name']; } - $options[$key] = check_plain($option); + $options[$key] = String::checkPlain($option); } $addresses['#options'] = $options; diff --git a/uc_taxes/lib/Drupal/uc_taxes/Controller/TaxesController.php b/uc_taxes/lib/Drupal/uc_taxes/Controller/TaxesController.php index fded8d6..73f2246 100644 --- a/uc_taxes/lib/Drupal/uc_taxes/Controller/TaxesController.php +++ b/uc_taxes/lib/Drupal/uc_taxes/Controller/TaxesController.php @@ -7,6 +7,7 @@ namespace Drupal\uc_taxes\Controller; +use Drupal\Component\Utility\String; use Drupal\Core\Controller\ControllerBase; /** @@ -23,7 +24,7 @@ class TaxesController extends ControllerBase { $rows = array(); foreach (uc_taxes_rate_load() as $rate_id => $rate) { $rows[] = array( - check_plain($rate->name), + String::checkPlain($rate->name), $rate->rate * 100 . '%', $rate->shippable ? t('Shippable products') : t('Any product'), implode(', ', $rate->taxed_product_types), diff --git a/uc_taxes/uc_taxes.module b/uc_taxes/uc_taxes.module index 30a23a4..8427f34 100644 --- a/uc_taxes/uc_taxes.module +++ b/uc_taxes/uc_taxes.module @@ -7,6 +7,7 @@ * Allows tax rules to be set up and applied to orders. */ +use Drupal\Component\Utility\String; use Drupal\Core\Entity\EntityInterface; use Drupal\entity\Entity\EntityViewDisplay; @@ -60,7 +61,7 @@ function uc_taxes_form_uc_order_edit_form_alter(&$form, &$form_state) { // the user. if ($item['type'] == 'tax') { $form['line_items'][$item['line_item_id']]['title'] = array( - '#markup' => check_plain($item['title']), + '#markup' => String::checkPlain($item['title']), ); $form['line_items'][$item['line_item_id']]['amount'] = array( '#theme' => 'uc_price',