Drupal\field_ui\DisplayOverview takes the definitions of extra fields, and runs the label through check_plain():
$extra_fields = field_info_extra_fields($this->entity_type, $this->bundle, 'display');
// SNIP
'human_name' => array(
'#markup' => check_plain($extra_field['label']),
),
However, the documentation and the sample code for the hook that defines the label, http://api.drupal.org/api/drupal/core!modules!field!field.api.php/functi..., implies that it's the hook's responsibility to sanitize this:
> label: The human readable name of the element.
'Human labels' are usually sanitized text, I think. And the sample code has:
$extra['node'][$bundle->type]['display']['language'] = array(
'label' => t('Language'),
'description' => $description,
'weight' => 0,
'visible' => FALSE,
);
The problem with the user running check_plain() is that the '%' placeholder can't be used in the call to t() for emphasis.
For example, with Flag module, I'd like to say: "Flag %user-entered-label".
| Comment | File | Size | Author |
|---|---|---|---|
| #1 | 1991292-1.patch | 2.35 KB | swentel |
Comments
Comment #1
swentel commentedMakes sense in a way. Most extra field labels are defined programmatically. Except for the title label for a content type.
Comment #2
yched commentedAgreed.
Comment #3
catchCommitted/pushed to 8.x
This could use a change notice, since modules currently not sanitizing user-entered text in this hook will become insecure now.
Comment #4
joachim commentedI don't remember the process for a CR. I've filed https://drupal.org/node/2153775 -- does it need someone to review it?
Comment #5
swentel commentedYep - and is good for me.
We can't really backport this without potentially breaking a lot of things in contrib.