I have entered a <em> in my custom error message and now the user see the <em> and the text in between is not italic as it has been check_plain()'ed.

We should only filter with http://api.drupal.org/api/drupal/modules%21field%21field.module/function... or http://api.drupal.org/api/drupal/includes%21common.inc/function/filter_x... to allow a bit more for HTML for admins. They should be the only persons who administer the validation rules. We may trust them and allow them to use inline HTML.

Comments

g089h515r806’s picture

g089h515r806 commented

I agree with it.
Which is the better filter_xss_admin , filter_xss?

hass’s picture

hass commented

It depends, but I think http://api.drupal.org/api/drupal/modules!field!field.module/function/field_filter_xss/7 should cover really the most as it contains nearly all typically used inline stuff.

g089h515r806’s picture

g089h515r806 commented
Status: Active » Fixed

Commited

hass’s picture

hass commented
Title: Filter form error messages with through field_filter_xss() to allow inline HTML » Filter form error messages with field_filter_xss() to allow inline HTML

Thx

Status: Fixed » Closed (fixed)

Automatically closed -- issue fixed for 2 weeks with no activity.