diff --git a/core/lib/Drupal/Core/Form/FormBuilder.php b/core/lib/Drupal/Core/Form/FormBuilder.php index 05ddbba..8180467 100644 --- a/core/lib/Drupal/Core/Form/FormBuilder.php +++ b/core/lib/Drupal/Core/Form/FormBuilder.php @@ -792,8 +792,6 @@ public function doBuildForm($form_id, &$element, FormStateInterface &$form_state $element[$key] = $this->doBuildForm($form_id, $element[$key], $form_state); $count++; } - // Add after_build attribute to each element just to check safe markup. - $element['#after_build'][] = array(get_class($this), 'self::formSafeCheck'); // The #after_build flag allows any piece of a form to be altered // after normal input parsing has been completed. if (isset($element['#after_build']) && !isset($element['#after_build_done'])) { @@ -859,6 +857,9 @@ public function doBuildForm($form_id, &$element, FormStateInterface &$form_state $form_state->setValue($triggering_element['#name'], $triggering_element['#value']); } } + // Make sure each form element is checked for safe markup and + // they are properly escaped. + $element = $this->formSafeCheck($element); return $element; } @@ -867,13 +868,11 @@ public function doBuildForm($form_id, &$element, FormStateInterface &$form_state * * @param array $element * - The form element. - * @param FormStateInterface $form_state - * - The form state of the current form. * * @return array * - The form element marked as safe. */ - protected function formSafeCheck(array $element, FormStateInterface $form_state) { + protected function formSafeCheck(array $element) { // Filtering keys which are expected to contain HTML. $markup_keys = array( '#description',