Similarly to #2201703: Strip HTML in hook_node_operations(), flag labels with HTML in them display raw HTML when used in a confirm form button. The forthcoming patch passes the label through strip_tags().

CommentFileSizeAuthor
#3 2255199.flag_.flag-confirm-form-strip-tags.patch3.01 KBjoachim
#3 2255199.flag_.flag-confirm-form-strip-tags-tests-only.patch2.4 KBjoachim
#1 flag-strip-tags-confirm-form-2255199.patch625 bytesjhedstrom

Comments

jhedstrom’s picture

jhedstrom
Primary language English
Location Portland, OR
commented
Status: Active » Needs review
StatusFileSize
new flag-strip-tags-confirm-form-2255199.patch625 bytes

And the patch.

joachim’s picture

joachim commented

Looks like the right thing to do.

I was thinking it would be nice to have tests for this, and I tried changing FlagLinkTypeConfirmTestCase to have some HTML in its flag link text, but I can't figure out how assertLink() is meant to work when the link text contains HTML. Neither including it in the parameter nor stripping it seems to work!!

joachim’s picture

joachim commented
StatusFileSize
new 2255199.flag_.flag-confirm-form-strip-tags-tests-only.patch2.4 KB
new 2255199.flag_.flag-confirm-form-strip-tags.patch3.01 KB

Figured it out -- well a workaround at least.

Here's two patches: one is just the changes to tests, and should fail. The other adds in the changes from patch #1.

The last submitted patch, 3: 2255199.flag_.flag-confirm-form-strip-tags-tests-only.patch, failed testing.

joachim’s picture

joachim commented
Status: Needs review » Fixed

Perfect.

Committing.

Thanks for reporting & fixing!

  • Commit 7afd35d on 7.x-3.x by joachim: 
    Issue #2255199 by jhedstrom, joachim: Fixed button in flagging confirm...

Status: Fixed » Closed (fixed)

Automatically closed - issue fixed for 2 weeks with no activity.