Problem/Motivation

After upgrading to the version 6.0.2, we got an error when try to visit the node edit, revision or delete pages

Steps to reproduce

  • Install radix as a base theme
  • Create custom theme
  • Put the editorial pages to use the custom theme
  • Create a node page > save page
  • Visit created page to try to edit or see the revisions

Proposed resolution

This is definitely related to the security fixes
It is needed to ensure that the variables passed to the twig templates, in this case to the
line 67 of the file menu.theme

function radix_preprocess_links__dropbutton
'text' => htmlspecialchars_decode(Xss::filter($link['text'])),

Remaining tasks

User interface changes

API changes

Data model changes

Comments

epalomino created an issue. See original summary.

doxigo’s picture

Status: Active » Fixed

On the latest dev version of 6.x, I cannot recreate this, regardless, I implemented the suggested htmlspecialchars_decode. It's good to have that, thanks.

  • doxigo committed ef4af1ec on 6.0.x
    Issue #3529292 by epalomino: Sanitize menu link text using Xss filter in...

  • doxigo committed ef4af1ec on feature/vite
    Issue #3529292 by epalomino: Sanitize menu link text using Xss filter in...

Status: Fixed » Closed (fixed)

Automatically closed - issue fixed for 2 weeks with no activity.