diff --git a/core/lib/Drupal/Core/Utility/Token.php b/core/lib/Drupal/Core/Utility/Token.php index 8d98232..c786846 100644 --- a/core/lib/Drupal/Core/Utility/Token.php +++ b/core/lib/Drupal/Core/Utility/Token.php @@ -204,11 +204,11 @@ public function replace($text, array $data = array(), array $options = array(), } } + $sanitize = !empty($options['sanitize']); // Escape the tokens, unless they are explicitly markup. foreach ($replacements as $token => $value) { - $replacements[$token] = $value instanceof MarkupInterface ? $value : new HtmlEscapedText($value); + $replacements[$token] = ($value instanceof MarkupInterface || $sanitize == FALSE) ? $value : new HtmlEscapedText($value); } - // Optionally alter the list of replacement values. if (!empty($options['callback'])) { $function = $options['callback']; diff --git a/core/modules/node/node.tokens.inc b/core/modules/node/node.tokens.inc index 17c529d..523668b 100644 --- a/core/modules/node/node.tokens.inc +++ b/core/modules/node/node.tokens.inc @@ -8,6 +8,7 @@ use Drupal\Core\Datetime\Entity\DateFormat; use Drupal\Core\Render\BubbleableMetadata; use Drupal\user\Entity\User; +use Drupal\Component\Utility\Html; /** * Implements hook_token_info(). @@ -115,16 +116,16 @@ function node_tokens($type, $tokens, array $data, array $options, BubbleableMeta break; case 'type': - $replacements[$original] = $node->getType(); + $replacements[$original] = $sanitize ? Html::escape($node->getType()) : $node->getType(); break; case 'type-name': $type_name = node_get_type_label($node); - $replacements[$original] = $type_name; + $replacements[$original] = $sanitize ? Html::escape($type_name) : $type_name; break; case 'title': - $replacements[$original] = $node->getTitle(); + $replacements[$original] = $sanitize ? Html::escape($node->getTitle()) : $node->getTitle(); break; case 'body': @@ -133,11 +134,11 @@ function node_tokens($type, $tokens, array $data, array $options, BubbleableMeta $item = $items[0]; // If the summary was requested and is not empty, use it. if ($name == 'summary' && !empty($item->summary)) { - $output = $item->summary_processed; + $output = $sanitize ? $item->summary_processed : $item->summary; } // Attempt to provide a suitable version of the 'body' field. else { - $output = $item->processed; + $output = $sanitize ? $item->processed : $item->value; // A summary was requested. if ($name == 'summary') { // Generate an optionally trimmed summary of the body field. @@ -163,7 +164,7 @@ function node_tokens($type, $tokens, array $data, array $options, BubbleableMeta break; case 'langcode': - $replacements[$original] = $node->language()->getId(); + $replacements[$original] = $sanitize ? Html::escape($node->language()->getId()) : $node->language()->getId(); break; case 'url': @@ -178,7 +179,7 @@ function node_tokens($type, $tokens, array $data, array $options, BubbleableMeta case 'author': $account = $node->getOwner() ? $node->getOwner() : User::load(0); $bubbleable_metadata->addCacheableDependency($account); - $replacements[$original] = $account->label(); + $replacements[$original] = $sanitize ? Html::escape($account->label()) : $account->label(); break; case 'created': diff --git a/core/modules/taxonomy/taxonomy.tokens.inc b/core/modules/taxonomy/taxonomy.tokens.inc index fafea47..867f4c7 100644 --- a/core/modules/taxonomy/taxonomy.tokens.inc +++ b/core/modules/taxonomy/taxonomy.tokens.inc @@ -7,6 +7,7 @@ use Drupal\Core\Render\BubbleableMetadata; use Drupal\taxonomy\Entity\Vocabulary; +use Drupal\Component\Utility\Html; /** * Implements hook_token_info(). @@ -67,7 +68,7 @@ function taxonomy_token_info() { 'description' => t("The number of terms belonging to the taxonomy vocabulary."), ); - // Chained tokens for taxonomies + // Chained tokens for taxonomies. $term['vocabulary'] = array( 'name' => t("Vocabulary"), 'description' => t("The vocabulary the taxonomy term belongs to."), @@ -111,13 +112,14 @@ function taxonomy_tokens($type, $tokens, array $data, array $options, Bubbleable else { $langcode = NULL; } + $sanitize = !empty($options['sanitize']); + $taxonomy_storage = \Drupal::entityManager()->getStorage('taxonomy_term'); if ($type == 'term') { /** @var \Drupal\taxonomy\TermInterface $term */ $term = \Drupal::entityManager()->getTranslationFromContext($data['term'], $langcode, ['operation' => 'term_tokens']); - $sanitize = !empty($options['sanitize']); - /** @var \Drupal\taxonomy\TermStorageInterface $taxonomy_storage */ + /** @var \Drupal\taxonomy\TermStorageInterface $taxonomy_storage */ foreach ($tokens as $name => $original) { switch ($name) { case 'tid': @@ -125,13 +127,13 @@ function taxonomy_tokens($type, $tokens, array $data, array $options, Bubbleable break; case 'name': - $replacements[$original] = $term->getName(); + $replacements[$original] = $sanitize ? $term->getName() : $term->name->value; break; case 'description': // "processed" returns a \Drupal\Component\Render\MarkupInterface via // check_markup(). - $replacements[$original] = $term->description->processed; + $replacements[$original] = $sanitize ? $term->description->processed : $term->description->value; break; case 'url': @@ -139,11 +141,12 @@ function taxonomy_tokens($type, $tokens, array $data, array $options, Bubbleable break; case 'node-count': - $query = db_select('taxonomy_index'); - $query->condition('tid', $term->id()); - $query->addTag('term_node_count'); - $count = $query->countQuery()->execute()->fetchField(); - $replacements[$original] = $count; + $replacements[$original] = db_select('taxonomy_index') + ->condition('tid', $term->id()) + ->addTag('term_node_count') + ->countQuery() + ->execute() + ->fetchField(); break; case 'vocabulary': @@ -151,7 +154,6 @@ function taxonomy_tokens($type, $tokens, array $data, array $options, Bubbleable $vocabulary = Vocabulary::load($term->bundle()); $bubbleable_metadata->addCacheableDependency($vocabulary); $replacements[$original] = $sanitize ? Html::escape($vocabulary->label()) : $vocabulary->label(); - $replacements[$original] = $vocabulary->label(); break; case 'parent': @@ -159,17 +161,11 @@ function taxonomy_tokens($type, $tokens, array $data, array $options, Bubbleable $term_first_parent = \Drupal::entityManager()->getTranslationFromContext(array_pop($parents), $langcode, ['operation' => 'term_tokens']); $bubbleable_metadata->addCacheableDependency($term_first_parent); $replacements[$original] = $sanitize ? Html::escape($term_first_parent->getName()) : $term_first_parent->getName(); - $replacements[$original] = $parent->getName(); } break; } } - if ($vocabulary_tokens = $token_service->findWithPrefix($tokens, 'vocabulary')) { - $vocabulary = Vocabulary::load($term->bundle()); - $replacements += $token_service->generate('vocabulary', $vocabulary_tokens, array('vocabulary' => $vocabulary), $options, $bubbleable_metadata); - } - if (($term_parent_tokens = $token_service->findWithPrefix($tokens, 'parent')) && $term_parents = $taxonomy_storage->loadParents($term->id()) ) {