Problem/Motivation

The html select list created by views_selective_filters seems to encode the ampersand (' & ') character in the select option label so it displays (' & '). The field's option value (as opposed to the viewable label) correctly contains the single ampersand (' & ') .

Steps to reproduce

Add a views_selective_filter for any field in which the text string contains an ampersand (' & ') character. The resulting html select options value contains the single ampersand (' & '), however the drop-down label is displayed as (' & ') .

Example of what I see: 

<select  ...>
<option value="INTERPRETATIONS & TECH ADVICE">INTERPRETATIONS &amp; TECH ADVICE</option>
</select>

Is there a way to use the ampersand character in a field value and have it appear correctly in the filter drop-down list exposed to the end-user?

Issue fork views_selective_filters-3213298

Command icon Show commands

Start within a Git clone of the project using the version control instructions.

Or, if you do not have SSH keys set up on git.drupalcode.org:

About issue forks

Comments

PaEricksonWaTech created an issue. See original summary.

dhirendra.mishra made their first commit to this issue’s fork.

dhirendra.mishra opened merge request !6

dhirendra.mishra’s picture

dhirendra.mishra commented
Status: Active » Needs review
pablovos’s picture

pablovos commented

In file src/Plugin/views/filter/Selective.php all HTML characters are escaped, converting various characters to HTML entities (see HTML::escape).

Current code:

$oids[$key] = Html::escape($value);

I propose to output this as:

$oids[$key] = preg_replace('<|>', '', $value);

Which leaves allowed characters intact.

joelpittet changed the visibility of the branch 3213298-values-with-ampersand to hidden.

joelpittet’s picture

joelpittet
he/him
Primary language English
Location Vancouver
commented

This is interesting... we can maybe see what Drupal Core does for this in terms of options labels and values. We don't want to double escape things and also don't want to have an XSS attack vector

joelpittet’s picture

joelpittet
he/him
Primary language English
Location Vancouver
commented
Status: Needs review » Fixed

I replaced the escape with a strip_tags() as we have that in D7 as well and it will do the trick better.

Fixed in 777c0f36dd5ecf2c57dbc739c3f8a1c14e59cc93

joelpittet closed merge request !6

Status: Fixed » Closed (fixed)

Automatically closed - issue fixed for 2 weeks with no activity.