Only last one of the database settings form errors is being printed

+++ b/core/lib/Drupal/Core/Database/Install/Tasks.php
@@ -152,7 +151,7 @@ public function runTasks() {
-        $message = SafeMarkup::isSafe($result) ? $result : String::checkPlain($result);
+        $message .= SafeMarkup::escape($result);

Because the resulting message is escaped or marked safe but then concatenated the "safeness" is lost for the new string. The resulting messages should be passed through SafeMarkup::set().

Thanks @lauriii we need some manual testing if anybody is up for it?

Hi, I started out testing laurriii's patch. It resolved the problem of printing only one error message. The text of the feedback did not look very well, because the error messages appeared as one block of text. In case of two failures, the HTML in the error messages was printed as plain text.

With some help of marcvangend (core sprint today, Amsterdam), I rewrote the patch. Error messages are now added to an array. The SafeMarkup::escape is removed, since the messages are already sanitized by the t()-function. SafeMarkup::set is still needed, to make sure it's not escaped twice.

Each message is now wrapped in a

-tag for readability. This causes an ugly top-margin in the first paragraph (see attached screenshot). A CSS change would be nice - if we agree this is the correct approach.

+++ b/core/lib/Drupal/Core/Database/Install/Tasks.php
@@ -148,14 +147,18 @@ public function runTasks() {
+        $messages[] .= SafeMarkup::escape($result);

Node need to concatenate here.

[] .=

@exnihilo Yeah we can add some styling to accommodate paragraphs in messages (although I noticed that most messages don't use paragraph tags at all?)

See messages.css in Seven:

.messages pre {
  margin: 0;
}

I working on this as part of DrupalCon LatinoAmerica Sprint.

After reading this issue and testing the patch, I believe the way in which the error is shown is correct, because the validation has a certain order. First it validates that the conection exsits, if it can't connect, then it should ignore the user and password errors. If the connection is correct, then you can validate user and password. If the connection and the user is correct, then you can check if the user can access the database.

Please correct me if I'm wrong.