Field labels should be escaped they're not.

Steps to reproduce:

  1. Add a field to a content type with a label like <em>field label</em>
  2. Go to the Add fields list in a content view
  3. The field label will not be escaped
CommentFileSizeAuthor
#7 2567475-7.patch1.21 KBgeertvd
#4 2567475-3.patch662 bytesgeertvd

Comments

alexpott created an issue. See original summary.

alexpott’s picture

Note that filter and sort criteria display the label escaped as expected

geertvd’s picture

Assigned: Unassigned » geertvd
geertvd’s picture

Status: Active » Needs review
StatusFileSize
new662 bytes

I think this is the right fix, working on adding test coverage.

alexpott’s picture

Status: Needs review » Needs work

I don't think this is the right fix. We need to fix it to allow auto-escape to do its thing.

geertvd’s picture

So the problem is that the field label is added to the handler option list with a !placeholder here:

/core/modules/views_ui/src/Form/Ajax/AddHandler.php
'#title' => $this->t('!group: !field', array('!group' => $option['group'], '!field' => $option['title'])),

Filter and sort handler labels are being escaped because:

core/modules/views/views.views.inc
    if (count($field_columns) == 1 || $column == 'value') {
      $title = t('@label (!name)', array('@label' => $label, '!name' => $field_name));
      $title_short = $label;
    }
    else {
      $title = t('@label (!name:!column)', array('@label' => $label, '!name' => $field_name, '!column' => $column));
      $title_short = t('@label:!column', array('@label' => $label, '!column' => $column));
    }
geertvd’s picture

Status: Needs work » Needs review
StatusFileSize
new1.21 KB

Failing test

alexpott’s picture

geertvd’s picture

Just applied the latest patch from #2557113: Make t() return a TranslationWrapper object to remove reliance on a static, unpredictable safe list.
That in combination with changing $this->t('!group: !field', array('!group' => $option['group'], '!field' => $option['title'])) to use @placeholders fixes the problem.

So I guess a combination of #2557113: Make t() return a TranslationWrapper object to remove reliance on a static, unpredictable safe list and one of the !placeholder issues will fix it.

Status: Needs review » Needs work

The last submitted patch, 7: 2567475-7.patch, failed testing.

The last submitted patch, 7: 2567475-7.patch, failed testing.

geertvd’s picture

Assigned: geertvd » Unassigned
dawehner’s picture

+++ b/core/modules/views/views.views.inc
@@ -416,8 +416,8 @@ function views_field_default_views_data(FieldStorageConfigInterface $field_stora
     $data[$table_alias][$field_alias] = array(
...
+      'title' => t('@label', array('@label' => $label)),
+      'title short' => t('@label', array('@label' => $label)),
       'help' =>  t('Appears in: @bundles.', array('@bundles' => implode(', ', $bundles_names))),

Nope, this is certainly not the right fix. We want to fix core/modules/views_ui/src/Form/Ajax/AddHandler.php:142 instead

geertvd’s picture

Status: Needs work » Closed (fixed)

Just checked, I can't reproduce this anymore since both issues mentioned in #9 got in.