Similarly to #2201703: Strip HTML in hook_node_operations(), flag labels with HTML in them display raw HTML when used in a confirm form button. The forthcoming patch passes the label through strip_tags().

CommentFileSizeAuthor
#3 2255199.flag_.flag-confirm-form-strip-tags.patch3.01 KBjoachim
#3 2255199.flag_.flag-confirm-form-strip-tags-tests-only.patch2.4 KBjoachim
#1 flag-strip-tags-confirm-form-2255199.patch625 bytesjhedstrom
Support from Acquia helps fund testing for Drupal Acquia logo

Comments

jhedstrom’s picture

jhedstrom
Primary language English
Location Portland, OR
CreditAttribution: jhedstrom commented
Status: Active » Needs review
FileSize
flag-strip-tags-confirm-form-2255199.patch625 bytes

And the patch.

joachim’s picture

joachim CreditAttribution: joachim commented

Looks like the right thing to do.

I was thinking it would be nice to have tests for this, and I tried changing FlagLinkTypeConfirmTestCase to have some HTML in its flag link text, but I can't figure out how assertLink() is meant to work when the link text contains HTML. Neither including it in the parameter nor stripping it seems to work!!

joachim’s picture

joachim CreditAttribution: joachim commented
FileSize
2255199.flag_.flag-confirm-form-strip-tags-tests-only.patch2.4 KB
2255199.flag_.flag-confirm-form-strip-tags.patch3.01 KB

Figured it out -- well a workaround at least.

Here's two patches: one is just the changes to tests, and should fail. The other adds in the changes from patch #1.

The last submitted patch, 3: 2255199.flag_.flag-confirm-form-strip-tags-tests-only.patch, failed testing.

joachim’s picture

joachim CreditAttribution: joachim commented
Status: Needs review » Fixed

Perfect.

Committing.

Thanks for reporting & fixing!

  • Commit 7afd35d on 7.x-3.x by joachim: 
    Issue #2255199 by jhedstrom, joachim: Fixed button in flagging confirm...

Status: Fixed » Closed (fixed)

Automatically closed - issue fixed for 2 weeks with no activity.