Problem/Motivation

includes/install.inc:      'description' => t('The following modules are required but were not found. Move them into the appropriate modules subdirectory, such as <em>/modules</em>. Missing modules: !modules', array('!modules' => implode(', ', $modules))),
modules/datetime/src/Plugin/Field/FieldWidget/DateTimeDatelistWidget.php:    $summary[] = t('Date part order: !order', array('!order' => $this->getSetting('date_order')));
modules/datetime/src/Plugin/Field/FieldWidget/DateTimeDatelistWidget.php:      $summary[] = t('Time type: !time_type', array('!time_type' => $this->getSetting('time_type')));
modules/datetime/src/Plugin/Field/FieldWidget/DateTimeDatelistWidget.php:      $summary[] = t('Time increments: !increment', array('!increment' => $this->getSetting('increment')));
modules/language/src/Plugin/Derivative/LanguageBlock.php:        $this->derivatives[$type]['admin_label'] = t('Language switcher (!type)', array('!type' => $info[$type]['name']));
modules/migrate/src/MigrateExecutable.php:            $this->message->display($this->t('Invalid PHP memory_limit !limit, setting to unlimited.',

Proposed resolution

Beta phase evaluation

See #2506427: [meta] !placeholder causes strings to be escaped and makes the sanitization API harder to understand.

Remaining tasks

TBD

User interface changes

Ideally, fewer completely unexpected double-escaping bugs.

API changes

None.

Support from Acquia helps fund testing for Drupal Acquia logo

Comments

dawehner created an issue. See original summary.

amateescu’s picture

Status: Active » Needs review
FileSize
3.74 KB

:)

stefan.r’s picture

Status: Needs review » Reviewed & tested by the community

RTBC as these should all be safe to convert:

  1. +++ b/core/includes/install.inc
    @@ -558,7 +558,7 @@ function drupal_verify_profile($install_state) {
    +      'description' => t('The following modules are required but were not found. Move them into the appropriate modules subdirectory, such as <em>/modules</em>. Missing modules: @modules', array('@modules' => implode(', ', $modules))),
    

    machine name

  2. +++ b/core/modules/datetime/src/Plugin/Field/FieldWidget/DateTimeDatelistWidget.php
    @@ -141,10 +141,10 @@ function settingsForm(array $form, FormStateInterface $form_state) {
    +    $summary[] = t('Date part order: @order', array('@order' => $this->getSetting('date_order')));
    

    three letters in a row only (YMD / DMY / MDY)

  3. +++ b/core/modules/datetime/src/Plugin/Field/FieldWidget/DateTimeDatelistWidget.php
    @@ -141,10 +141,10 @@ function settingsForm(array $form, FormStateInterface $form_state) {
    +      $summary[] = t('Time type: @time_type', array('@time_type' => $this->getSetting('time_type')));
    +      $summary[] = t('Time increments: @increment', array('@increment' => $this->getSetting('increment')));
    

    integers only

  4. +++ b/core/modules/language/src/Plugin/Derivative/LanguageBlock.php
    @@ -26,7 +26,7 @@ public function getDerivativeDefinitions($base_plugin_definition) {
    +        $this->derivatives[$type]['admin_label'] = t('Language switcher (@type)', array('@type' => $info[$type]['name']));
    

    Always wrapped in t()

  5. +++ b/core/modules/migrate/src/MigrateExecutable.php
    @@ -148,8 +148,8 @@ public function __construct(MigrationInterface $migration, MigrateMessageInterfa
    +              array('@limit' => $limit)));
    

    integer

dawehner’s picture

Status: Reviewed & tested by the community » Needs work
+++ b/core/includes/install.inc
@@ -558,7 +558,7 @@ function drupal_verify_profile($install_state) {
-      'description' => t('The following modules are required but were not found. Move them into the appropriate modules subdirectory, such as <em>/modules</em>. Missing modules: !modules', array('!modules' => implode(', ', $modules))),
+      'description' => t('The following modules are required but were not found. Move them into the appropriate modules subdirectory, such as <em>/modules</em>. Missing modules: @modules', array('@modules' => implode(', ', $modules))),

Given that $modules is HTML already, that won't work. What about using an inline template?

stefan.r’s picture

Actually 1 is returns a string of markup that is not marked safe (not machine names).

So maybe we need to wait for that suffix helper that's still to do?

/edit: seems @dawehner already spotted this :)

dawehner’s picture

Status: Needs work » Needs review
FileSize
4.37 KB
1.5 KB

We could just do the following bit.

stefan.r’s picture

We could, but we don't explicitly support render arrays in hook_requirements yet, so #2505499: Explicitly support render arrays in hook_requirements() would probably need to go in first in order to do #6? A renderPlain might also work but are we sure that will work in the installer?

Discussed this with @pwolanin and just a SafeString::create() might be the safest bet for now, as well as maybe a Xss::filterAdmin() in case $modules ever becomes unsafe when code changes.

dawehner’s picture

SafeString::create() though is always wrong.

pwolanin’s picture

@dawehner - since drupal_render() it not available there, the alternative we discussed of making a render array and rendering it is not possible.

I don't think this is wrong during install/requirements.

pwolanin’s picture

I don't even this this needs the Xss::filter(). If we are concerned it shoudl just use Html::escape()

dawehner’s picture

Well, SafeString::create() for not a low level system is just wrong. It gives a bad example so that people actually start using it.
Rendering something (escpecially via renderPlain()) totally works. If you argue that the render API might call out to things which doesn't exist it, its much like
any other API call, the module developers need to think about that.

dawehner’s picture

The patch I posted I uploaded on comment #6

pwolanin’s picture

ok, let's try this?

stefan.r’s picture

@pwolanin that sure looks a bit cleaner than the SafeString::create(), assuming the renderer works during the installer. Will do manual testing and post screenshots.

+++ b/core/includes/install.inc
@@ -12,6 +12,8 @@
+use Drupal\Core\Render\SafeString;
+use Drupal\Component\Utility\Xss;

Not used anymore

pwolanin’s picture

fixing trailing commas and use statements

dawehner’s picture

Status: Needs review » Reviewed & tested by the community

I can't see remotely why this should be better than using the inline template from above, but well.

alexpott’s picture

Status: Reviewed & tested by the community » Needs work
+++ b/core/includes/install.inc
@@ -549,16 +549,21 @@ function drupal_verify_profile($install_state) {
+  $count = count($missing_modules);
+  if ($count) {
+    $build = array();
+
     foreach ($missing_modules as $module) {
-      $modules[] = '<span class="admin-missing">' . Unicode::ucfirst($module) . '</span>';
+      $count--;
+      $build[] = array('#markup' => '<span class="admin-missing">' . Unicode::ucfirst($module) . '</span>', '#suffix' => $count ? ', ' : '');
     }

Let's use the inline item list for this... see #2505931: Remove SafeMarkup::set in ViewListBuilder

dawehner’s picture

Status: Needs work » Needs review
FileSize
4.57 KB
1.85 KB

Alright.

pwolanin’s picture

Status: Needs review » Needs work

Needs the if (count($missing_modules)) {

dawehner’s picture

Status: Needs work » Needs review
FileSize
4.46 KB
1.85 KB

Sadly when you manually add non existing issues, you get Fatal error: Call to a member function getPath() on a non-object in /Users/dawehner/www/d8/core/includes/install.inc on line 914

The last submitted patch, 18: 2572599-18.patch, failed testing.

stefan.r’s picture

FileSize
4.43 KB
1.82 KB

@dawehner that sounds like a bug - we saw this before when removing the file scan fallback

dawehner’s picture

@stefan.r
Yeah but its totally out of scope of the issue, right? You also posted the same patch as #20, right?

stefan.r’s picture

Status: Needs review » Reviewed & tested by the community
FileSize
214.75 KB
51.82 KB

This looks OK. Screenshots for reference:

#20 is unrelated to this patch - and for the drush output the PlainTextFormattedOutput thing might be a great use case later on as this will format the HTML nicely for CLI output as well.

stefan.r’s picture

Oops @dawehner I didn't mean to post that, we cross posted. Let me do an interdiff and see if they are the same.

Let me look at the "before" output of the Required modules error as well to see if this needs a CSS followup - I kind of like the fact they are now red and on a separate line, but would be good to at least know if this is changing the look of the output in any way.

dawehner’s picture

Ah great, maybe just ignore me

stefan.r’s picture

Re-uploading @dawehner's patch as that is where the screenshots come from (and #22 was escaping)

The only difference with the current behavior is that the list of items is wrapping to the next line as it's a div, but this is a general problem - we run into this elsewhere as well, so it would be good if we could fix this everywhere.

This should either be a span or be an inline div, but fixing this may not be in scope here. Leaving RTBC for a core committer to have a look at this.

The last submitted patch, 6: 2572599-6.patch, failed testing.

Status: Reviewed & tested by the community » Needs work

The last submitted patch, 27: 2572599-19.patch, failed testing.

alexpott’s picture

Status: Needs work » Fixed

The new line in the comma list will be addressed by #2557367: Fix inline list CSS.

Committed fc45b90 and pushed to 8.0.x. Thanks!

I cancelled the pifr test of #27 hence the failure. I'm trusting the DrupalCI test result.

  • alexpott committed fc45b90 on 8.0.x
    Issue #2572599 by stefan.r, dawehner, pwolanin, amateescu: Replace !...

The last submitted patch, 15: 2572599-15.patch, failed testing.

The last submitted patch, 18: 2572599-18.patch, failed testing.

The last submitted patch, 20: 2572599-19.patch, failed testing.

The last submitted patch, 22: 2572599-20.patch, failed testing.

Status: Fixed » Closed (fixed)

Automatically closed - issue fixed for 2 weeks with no activity.