diff --git a/core/lib/Drupal/Core/Field/Plugin/Field/FieldFormatter/NumericFormatterBase.php b/core/lib/Drupal/Core/Field/Plugin/Field/FieldFormatter/NumericFormatterBase.php index cc360b9..31d85e4 100644 --- a/core/lib/Drupal/Core/Field/Plugin/Field/FieldFormatter/NumericFormatterBase.php +++ b/core/lib/Drupal/Core/Field/Plugin/Field/FieldFormatter/NumericFormatterBase.php @@ -71,8 +71,8 @@ public function viewElements(FieldItemListInterface $items) { // Account for prefix and suffix. if ($this->getSetting('prefix_suffix')) { - $prefixes = isset($settings['prefix']) ? array_map('field_filter_xss', explode('|', $settings['prefix'])) : array(''); - $suffixes = isset($settings['suffix']) ? array_map('field_filter_xss', explode('|', $settings['suffix'])) : array(''); + $prefixes = isset($settings['prefix']) ? array_map('\Drupal\Core\Field\WidgetBase::fieldFilterXss', explode('|', $settings['prefix'])) : array(''); + $suffixes = isset($settings['suffix']) ? array_map('\Drupal\Core\Field\WidgetBase::fieldFilterXss', explode('|', $settings['suffix'])) : array(''); $prefix = (count($prefixes) > 1) ? format_plural($item->value, $prefixes[0], $prefixes[1]) : $prefixes[0]; $suffix = (count($suffixes) > 1) ? format_plural($item->value, $suffixes[0], $suffixes[1]) : $suffixes[0]; $output = $prefix . $output . $suffix; diff --git a/core/lib/Drupal/Core/Field/Plugin/Field/FieldWidget/NumberWidget.php b/core/lib/Drupal/Core/Field/Plugin/Field/FieldWidget/NumberWidget.php index fa31ce7..880f393 100644 --- a/core/lib/Drupal/Core/Field/Plugin/Field/FieldWidget/NumberWidget.php +++ b/core/lib/Drupal/Core/Field/Plugin/Field/FieldWidget/NumberWidget.php @@ -100,11 +100,11 @@ public function formElement(FieldItemListInterface $items, $delta, array $elemen // Add prefix and suffix. if ($field_settings['prefix']) { $prefixes = explode('|', $field_settings['prefix']); - $element['#field_prefix'] = field_filter_xss(array_pop($prefixes)); + $element['#field_prefix'] = static::fieldFilterXss(array_pop($prefixes)); } if ($field_settings['suffix']) { $suffixes = explode('|', $field_settings['suffix']); - $element['#field_suffix'] = field_filter_xss(array_pop($suffixes)); + $element['#field_suffix'] = static::fieldFilterXss(array_pop($suffixes)); } return array('value' => $element); diff --git a/core/lib/Drupal/Core/Field/WidgetBase.php b/core/lib/Drupal/Core/Field/WidgetBase.php index 1fe4939..a6a521a 100644 --- a/core/lib/Drupal/Core/Field/WidgetBase.php +++ b/core/lib/Drupal/Core/Field/WidgetBase.php @@ -7,9 +7,12 @@ namespace Drupal\Core\Field; +use Drupal\Component\Utility\Html; use Drupal\Component\Utility\NestedArray; +use Drupal\Component\Utility\SafeMarkup; use Drupal\Component\Utility\SortArray; use Drupal\Component\Utility\String; +use Drupal\Component\Utility\Xss; use Symfony\Component\Validator\ConstraintViolationInterface; use Symfony\Component\Validator\ConstraintViolationListInterface; @@ -81,7 +84,7 @@ public function form(FieldItemListInterface $items, array &$form, array &$form_s $delta = isset($get_delta) ? $get_delta : 0; $element = array( '#title' => String::checkPlain($this->fieldDefinition->getLabel()), - '#description' => field_filter_xss(\Drupal::token()->replace($this->fieldDefinition->getDescription())), + '#description' => static::fieldFilterXss(\Drupal::token()->replace($this->fieldDefinition->getDescription())), ); $element = $this->formSingleElement($items, $delta, $element, $form, $form_state); @@ -160,7 +163,7 @@ protected function formMultipleElements(FieldItemListInterface $items, array &$f } $title = String::checkPlain($this->fieldDefinition->getLabel()); - $description = field_filter_xss(\Drupal::token()->replace($this->fieldDefinition->getDescription())); + $description = static::fieldFilterXss(\Drupal::token()->replace($this->fieldDefinition->getDescription())); $elements = array(); @@ -533,4 +536,39 @@ protected function handlesMultipleValues() { return $definition['multiple_values']; } + /** + * Filters an HTML string to prevent cross-site-scripting (XSS) vulnerabilities. + * + * Like \Drupal\Component\Utility\Xss::filterAdmin(), but with a shorter list + * of allowed tags. + * + * Used for items entered by administrators, like field descriptions, allowed + * values, where some (mainly inline) mark-up may be desired (so + * drupal_htmlspecialchars() is not acceptable). + * + * @param $string + * The string with raw HTML in it. + * + * @return \Drupal\Component\Utility\SafeMarkup + * An XSS safe version of $string, or an empty string if $string is not valid + * UTF-8. + */ + public static function fieldFilterXss($string) { + return SafeMarkup::set(Html::normalize(Xss::filter($string, static::allowedTags()))); + } + + /** + * Returns a list of tags allowed by field_filter_xss(). + */ + public static function allowedTags() { + return array('a', 'b', 'big', 'code', 'del', 'em', 'i', 'ins', 'pre', 'q', 'small', 'span', 'strong', 'sub', 'sup', 'tt', 'ol', 'ul', 'li', 'p', 'br', 'img'); + } + + /** + * Returns a human-readable list of allowed tags for display in help texts. + */ + public static function displayAllowedTags() { + return '<' . implode('> <', static::allowedTags()) . '>'; + } + } diff --git a/core/modules/content_translation/content_translation.install b/core/modules/content_translation/content_translation.install index 06a355b..fb6e3bd 100644 --- a/core/modules/content_translation/content_translation.install +++ b/core/modules/content_translation/content_translation.install @@ -89,17 +89,23 @@ function content_translation_install() { module_set_weight('content_translation', 10); \Drupal::service('language_negotiator')->saveConfiguration(LanguageInterface::TYPE_CONTENT, array(LanguageNegotiationUrl::METHOD_ID => 0)); - $config_names = \Drupal::configFactory()->listAll(\Drupal::entityManager()->getDefinition('field_storage_config')->getConfigPrefix() . '.'); - foreach ($config_names as $name) { - \Drupal::config($name) - ->set('settings.translation_sync', FALSE) - ->save(); - } - $config_names = \Drupal::configFactory()->listAll('field.instance.'); - foreach ($config_names as $name) { - \Drupal::config($name) - ->set('settings.translation_sync', FALSE) - ->save(); + if (\Drupal::moduleHandler()->moduleExists('field')) { + $config_names = \Drupal::configFactory()->listAll( + \Drupal::entityManager() + ->getDefinition('field_storage_config') + ->getConfigPrefix() . '.' + ); + foreach ($config_names as $name) { + \Drupal::config($name) + ->set('settings.translation_sync', FALSE) + ->save(); + } + $config_names = \Drupal::configFactory()->listAll('field.instance.'); + foreach ($config_names as $name) { + \Drupal::config($name) + ->set('settings.translation_sync', FALSE) + ->save(); + } } } diff --git a/core/modules/field/field.info.yml b/core/modules/field/field.info.yml index f30ba86..13b5da0 100644 --- a/core/modules/field/field.info.yml +++ b/core/modules/field/field.info.yml @@ -4,4 +4,3 @@ description: 'Field API to add fields to entities like nodes and users.' package: Core version: VERSION core: 8.x -required: true diff --git a/core/modules/field/field.module b/core/modules/field/field.module index 444a92d..cbdc953 100644 --- a/core/modules/field/field.module +++ b/core/modules/field/field.module @@ -243,41 +243,6 @@ function field_entity_bundle_delete($entity_type, $bundle) { } /** - * Filters an HTML string to prevent cross-site-scripting (XSS) vulnerabilities. - * - * Like \Drupal\Component\Utility\Xss::filterAdmin(), but with a shorter list - * of allowed tags. - * - * Used for items entered by administrators, like field descriptions, allowed - * values, where some (mainly inline) mark-up may be desired (so - * drupal_htmlspecialchars() is not acceptable). - * - * @param $string - * The string with raw HTML in it. - * - * @return - * An XSS safe version of $string, or an empty string if $string is not valid - * UTF-8. - */ -function field_filter_xss($string) { - return SafeMarkup::set(Html::normalize(Xss::filter($string, _field_filter_xss_allowed_tags()))); -} - -/** - * Returns a list of tags allowed by field_filter_xss(). - */ -function _field_filter_xss_allowed_tags() { - return array('a', 'b', 'big', 'code', 'del', 'em', 'i', 'ins', 'pre', 'q', 'small', 'span', 'strong', 'sub', 'sup', 'tt', 'ol', 'ul', 'li', 'p', 'br', 'img'); -} - -/** - * Returns a human-readable list of allowed tags for display in help texts. - */ -function _field_filter_xss_display_allowed_tags() { - return '<' . implode('> <', _field_filter_xss_allowed_tags()) . '>'; -} - -/** * @} End of "defgroup field". */ diff --git a/core/modules/field/src/Plugin/views/argument/FieldList.php b/core/modules/field/src/Plugin/views/argument/FieldList.php index 5bfd935..1b9163e 100644 --- a/core/modules/field/src/Plugin/views/argument/FieldList.php +++ b/core/modules/field/src/Plugin/views/argument/FieldList.php @@ -8,6 +8,7 @@ namespace Drupal\field\Plugin\views\argument; use Drupal\Component\Utility\String; +use Drupal\Core\Field\WidgetBase; use Drupal\views\ViewExecutable; use Drupal\views\Plugin\views\display\DisplayPluginBase; use Drupal\views\Plugin\views\argument\Numeric; @@ -66,7 +67,7 @@ public function summaryName($data) { $value = $data->{$this->name_alias}; // If the list element has a human readable name show it, if (isset($this->allowed_values[$value]) && !empty($this->options['summary']['human'])) { - return field_filter_xss($this->allowed_values[$value]); + return WidgetBase::fieldFilterXss(($this->allowed_values[$value]); } // else fallback to the key. else { diff --git a/core/modules/field/src/Plugin/views/argument/ListString.php b/core/modules/field/src/Plugin/views/argument/ListString.php index 02d049a..69c1623 100644 --- a/core/modules/field/src/Plugin/views/argument/ListString.php +++ b/core/modules/field/src/Plugin/views/argument/ListString.php @@ -8,6 +8,7 @@ namespace Drupal\field\Plugin\views\argument; use Drupal\Component\Utility\String as UtilityString; +use Drupal\Core\Field\WidgetBase; use Drupal\views\ViewExecutable; use Drupal\views\Plugin\views\display\DisplayPluginBase; use Drupal\views\Plugin\views\argument\String; @@ -68,7 +69,7 @@ public function summaryName($data) { $value = $data->{$this->name_alias}; // If the list element has a human readable name show it, if (isset($this->allowed_values[$value]) && !empty($this->options['summary']['human'])) { - return $this->caseTransform(field_filter_xss($this->allowed_values[$value]), $this->options['case']); + return $this->caseTransform(WidgetBase::fieldfilterXss($this->allowed_values[$value]), $this->options['case']); } // else fallback to the key. else { diff --git a/core/modules/file/src/Plugin/Field/FieldWidget/FileWidget.php b/core/modules/file/src/Plugin/Field/FieldWidget/FileWidget.php index 5f71e9a..71e2541 100644 --- a/core/modules/file/src/Plugin/Field/FieldWidget/FileWidget.php +++ b/core/modules/file/src/Plugin/Field/FieldWidget/FileWidget.php @@ -96,7 +96,7 @@ protected function formMultipleElements(FieldItemListInterface $items, array &$f } $title = String::checkPlain($this->fieldDefinition->getLabel()); - $description = field_filter_xss($this->fieldDefinition->getDescription()); + $description = static::fieldFilterXss($this->fieldDefinition->getDescription()); $elements = array(); diff --git a/core/modules/image/src/Plugin/Field/FieldWidget/ImageWidget.php b/core/modules/image/src/Plugin/Field/FieldWidget/ImageWidget.php index 0ba9e7e..eca5057 100644 --- a/core/modules/image/src/Plugin/Field/FieldWidget/ImageWidget.php +++ b/core/modules/image/src/Plugin/Field/FieldWidget/ImageWidget.php @@ -95,7 +95,7 @@ protected function formMultipleElements(FieldItemListInterface $items, array &$f if ($cardinality == 1) { // If there's only one field, return it as delta 0. if (empty($elements[0]['#default_value']['fids'])) { - $file_upload_help['#description'] = field_filter_xss($this->fieldDefinition->getDescription()); + $file_upload_help['#description'] = static::fieldFilterXss($this->fieldDefinition->getDescription()); $elements[0]['#description'] = drupal_render($file_upload_help); } } diff --git a/core/modules/options/src/Plugin/Field/FieldWidget/OptionsWidgetBase.php b/core/modules/options/src/Plugin/Field/FieldWidget/OptionsWidgetBase.php index 01e7688..111b286 100644 --- a/core/modules/options/src/Plugin/Field/FieldWidget/OptionsWidgetBase.php +++ b/core/modules/options/src/Plugin/Field/FieldWidget/OptionsWidgetBase.php @@ -220,7 +220,7 @@ protected function supportsGroups() { */ static protected function sanitizeLabel(&$label) { // Allow a limited set of HTML tags. - $label = field_filter_xss($label); + $label = static::fieldFilterXss($label); } /**