Problem/Motivation

Discovered in #2492839-28: Views replacement token bc layer allows for Twig template injection via arguments.

Steps to reproduce:
1. Install standard and create an article with an image
2. Edit File Usage view at admin/structure/views/view/files/edit/page_2
3. In preview, type "1" and click "Update preview".
4. Go to Recent log messages and you see an error LogicException: Render context is empty, because render() was called outside of a renderRoot() or renderPlain() call. Use renderPlain()/renderRoot() or #lazy_builder/#pre_render instead.

Proposed resolution

Remaining tasks

User interface changes

API changes

Data model changes

CommentFileSizeAuthor
#6 2564475-6.patch3.7 KBolli
#6 2564475-6-test.patch2.53 KBolli
#3 2564475-3.patch506 bytesolli

Comments

olli created an issue. See original summary.

dawehner’s picture

dawehner
Primary language German
commented
Issue tags: +Needs tests

.

olli’s picture

olli commented
Status: Active » Needs review
StatusFileSize
new 2564475-3.patch506 bytes

Can we use renderPlain()?

Status: Needs review » Needs work

The last submitted patch, 3: 2564475-3.patch, failed testing.

mikeker’s picture

mikeker commented

This (at least partially) blocks #2492839: Views replacement token bc layer allows for Twig template injection via arguments.

olli’s picture

olli commented
Status: Needs work » Needs review
StatusFileSize
new 2564475-6-test.patch2.53 KB
new 2564475-6.patch3.7 KB

Here's a test.

The last submitted patch, 6: 2564475-6-test.patch, failed testing.

mikeker’s picture

mikeker commented 
+++ b/core/modules/views/src/Plugin/views/PluginBase.php
@@ -396,7 +396,7 @@ function ($children, $elements) {
+      return (string) $this->getRenderer()->renderPlain($build);

Perhaps a dumb question: what happens if there is already a render context when viewsTokenReplace is called? Will renderPlain overwrite that context?

olli’s picture

olli commented

#8 not a dumb question. Docs say it calls render in another context (in isolation) so bubbling is not possible. Is that a problem?

dawehner’s picture

dawehner
Primary language German
commented

HEAD is now using renderPlain() so should we maybe just add some test coverage?

dawehner’s picture

dawehner
Primary language German
commented
Status: Needs review » Needs work

.

Version: 8.0.x-dev » 8.1.x-dev

Drupal 8.0.6 was released on April 6 and is the final bugfix release for the Drupal 8.0.x series. Drupal 8.0.x will not receive any further development aside from security fixes. Drupal 8.1.0-rc1 is now available and sites should prepare to update to 8.1.0.

Bug reports should be targeted against the 8.1.x-dev branch from now on, and new development or disruptive changes should be targeted against the 8.2.x-dev branch. For more information see the Drupal 8 minor version schedule and the Allowed changes during the Drupal 8 release cycle.

Version: 8.1.x-dev » 8.2.x-dev

Drupal 8.1.9 was released on September 7 and is the final bugfix release for the Drupal 8.1.x series. Drupal 8.1.x will not receive any further development aside from security fixes. Drupal 8.2.0-rc1 is now available and sites should prepare to upgrade to 8.2.0.

Bug reports should be targeted against the 8.2.x-dev branch from now on, and new development or disruptive changes should be targeted against the 8.3.x-dev branch. For more information see the Drupal 8 minor version schedule and the Allowed changes during the Drupal 8 release cycle.

Version: 8.2.x-dev » 8.3.x-dev

Drupal 8.2.6 was released on February 1, 2017 and is the final full bugfix release for the Drupal 8.2.x series. Drupal 8.2.x will not receive any further development aside from critical and security fixes. Sites should prepare to update to 8.3.0 on April 5, 2017. (Drupal 8.3.0-alpha1 is available for testing.)

Bug reports should be targeted against the 8.3.x-dev branch from now on, and new development or disruptive changes should be targeted against the 8.4.x-dev branch. For more information see the Drupal 8 minor version schedule and the Allowed changes during the Drupal 8 release cycle.

Version: 8.3.x-dev » 8.4.x-dev

Drupal 8.3.6 was released on August 2, 2017 and is the final full bugfix release for the Drupal 8.3.x series. Drupal 8.3.x will not receive any further development aside from critical and security fixes. Sites should prepare to update to 8.4.0 on October 4, 2017. (Drupal 8.4.0-alpha1 is available for testing.)

Bug reports should be targeted against the 8.4.x-dev branch from now on, and new development or disruptive changes should be targeted against the 8.5.x-dev branch. For more information see the Drupal 8 minor version schedule and the Allowed changes during the Drupal 8 release cycle.

Version: 8.4.x-dev » 8.5.x-dev

Drupal 8.4.4 was released on January 3, 2018 and is the final full bugfix release for the Drupal 8.4.x series. Drupal 8.4.x will not receive any further development aside from critical and security fixes. Sites should prepare to update to 8.5.0 on March 7, 2018. (Drupal 8.5.0-alpha1 is available for testing.)

Bug reports should be targeted against the 8.5.x-dev branch from now on, and new development or disruptive changes should be targeted against the 8.6.x-dev branch. For more information see the Drupal 8 minor version schedule and the Allowed changes during the Drupal 8 release cycle.

Version: 8.5.x-dev » 8.6.x-dev

Drupal 8.5.6 was released on August 1, 2018 and is the final bugfix release for the Drupal 8.5.x series. Drupal 8.5.x will not receive any further development aside from security fixes. Sites should prepare to update to 8.6.0 on September 5, 2018. (Drupal 8.6.0-rc1 is available for testing.)

Bug reports should be targeted against the 8.6.x-dev branch from now on, and new development or disruptive changes should be targeted against the 8.7.x-dev branch. For more information see the Drupal 8 minor version schedule and the Allowed changes during the Drupal 8 release cycle.

Version: 8.6.x-dev » 8.8.x-dev

Drupal 8.6.x will not receive any further development aside from security fixes. Bug reports should be targeted against the 8.8.x-dev branch from now on, and new development or disruptive changes should be targeted against the 8.9.x-dev branch. For more information see the Drupal 8 and 9 minor version schedule and the Allowed changes during the Drupal 8 and 9 release cycles.

Version: 8.8.x-dev » 8.9.x-dev

Drupal 8.8.7 was released on June 3, 2020 and is the final full bugfix release for the Drupal 8.8.x series. Drupal 8.8.x will not receive any further development aside from security fixes. Sites should prepare to update to Drupal 8.9.0 or Drupal 9.0.0 for ongoing support.

Bug reports should be targeted against the 8.9.x-dev branch from now on, and new development or disruptive changes should be targeted against the 9.1.x-dev branch. For more information see the Drupal 8 and 9 minor version schedule and the Allowed changes during the Drupal 8 and 9 release cycles.

quietone’s picture

quietone commented
Status: Needs work » Closed (cannot reproduce)
Issue tags: +Bug Smash Initiative

@olli, Thanks for reporting this issue. We rely on issue reports like this one to resolve bugs and improve Drupal core.

I tested this on 9.2.x and was not able to reproduce this error. I followed the steps given in the Issue Summary.

Therefore, closing as cannot reproduce. If you are experiencing this problem reopen the issue, by setting the status to 'Active', and provide complete steps to reproduce the issue (starting from "Install Drupal core").

Thanks!

quietone’s picture

quietone commented
Version: 8.9.x-dev » 9.2.x-dev