Field labels should be escaped they're not.
Steps to reproduce:
- Add a field to a content type with a label like <em>field label</em>
- Go to the Add fields list in a content view
- The field label will not be escaped
| Comment | File | Size | Author |
|---|---|---|---|
| #7 | 2567475-7.patch | 1.21 KB | geertvd |
| #4 | 2567475-3.patch | 662 bytes | geertvd |
Comments
Comment #2
alexpottNote that filter and sort criteria display the label escaped as expected
Comment #3
geertvd commentedComment #4
geertvd commentedI think this is the right fix, working on adding test coverage.
Comment #5
alexpottI don't think this is the right fix. We need to fix it to allow auto-escape to do its thing.
Comment #6
geertvd commentedSo the problem is that the field label is added to the handler option list with a !placeholder here:
Filter and sort handler labels are being escaped because:
Comment #7
geertvd commentedFailing test
Comment #8
alexpottI think this issue will be fixed by #2557113: Make t() return a TranslationWrapper object to remove reliance on a static, unpredictable safe list
Comment #9
geertvd commentedJust applied the latest patch from #2557113: Make t() return a TranslationWrapper object to remove reliance on a static, unpredictable safe list.
That in combination with changing
$this->t('!group: !field', array('!group' => $option['group'], '!field' => $option['title']))to use @placeholders fixes the problem.So I guess a combination of #2557113: Make t() return a TranslationWrapper object to remove reliance on a static, unpredictable safe list and one of the !placeholder issues will fix it.
Comment #12
geertvd commentedComment #13
dawehnerNope, this is certainly not the right fix. We want to fix core/modules/views_ui/src/Form/Ajax/AddHandler.php:142 instead
Comment #14
geertvd commentedJust checked, I can't reproduce this anymore since both issues mentioned in #9 got in.