Problem/Motivation

Currently it's possible to add html to the label of a component (For example
<strong> or a <span>
with a class etc.)

However if validation fails server side and the field name is output into the messages area then the html tags are escaped and display on screen.

Steps to reproduce

Create a new form using the below. (One required element with html in the label)
Via Settings -> Form set
Disable client-side validation and Disable inline form errors

Save.

Submit form without selecting anything.

_strong_title_strong_here:
  '#type': checkbox
  '#title': '<strong>Title</strong> here'
  '#equal_stepwise_validate': 0
  '#equal_components': {  }
  '#compare': 0
  '#compare_components': ''
  '#compare_components_operator': ''
  '#compare_components_custom_error': ''
  '#some_of_several': 0
  '#some_of_several_components': {  }
  '#some_of_several_components_completed': ''
  '#some_of_several_final_validation': 0
  '#required': true
Support from Acquia helps fund testing for Drupal Acquia logo

Comments

luke.stewart created an issue. See original summary.

luke.stewart’s picture

Issue summary: View changes
luke.stewart’s picture

Issue summary: View changes
jrockowitz’s picture

Version: 6.1.0-beta2 » 8.x-5.x-dev
FileSize
710 bytes
4.76 KB

The attached webform replicates this issue and the attached patch fixes it.

This issue should also be fixed in 8.x-5.x

jrockowitz’s picture

Status: Active » Needs review
jrockowitz’s picture

Surprisingly, changing an $element['#title'] from a string to Markup could cause some unexpected regression. Let's see if all the tests pass.

I think we might want to limit the allowed tags for the $element['#title'] markup.

Status: Needs review » Needs work

The last submitted patch, 4: 3245019-4.patch, failed testing. View results
- codesniffer_fixes.patch Interdiff of automated coding standards fixes only.

jrockowitz’s picture

Status: Needs work » Needs review
FileSize
1.22 KB
luke.stewart’s picture

Came back to have a go fixing and found the solution!

Tests passing.
Looks great.
I've tested this and confirm fixes behaviour.

Note:
Was wondering if we need to consider custom validation messages - but looks like they were already working - and nice warning about html being stripped for client side validation.

I'm happy to write a test to cover this behaviour if it would be helpful but might need some pointers/suggestions on where it would best fit.

jrockowitz’s picture

To add test coverage, you would need to

- Add an example to webform.webform.test_element_validate_required.yml
- Add an test with an assertion to WebformElementValidateRequiredTest
- Update comments in WebformElementValidateRequiredTest to distinguish between custom errors and the default errors.

jrockowitz’s picture

Status: Needs review » Needs work
jrockowitz’s picture

Version: 8.x-5.x-dev » 6.x-dev
Assigned: Unassigned » jrockowitz

I would like to get this into the next 6.1.x release

jrockowitz’s picture

Status: Needs work » Needs review
FileSize
4.46 KB
jrockowitz’s picture

Status: Needs review » Fixed

  • jrockowitz authored f5c9e22 on 6.x
    Issue #3245019 by jrockowitz, luke.stewart: Validation messages escape...

Status: Fixed » Closed (fixed)

Automatically closed - issue fixed for 2 weeks with no activity.