Problem/Motivation
The title for a horizontal tab is retrivied from a details element by title: $this.find('> summary').text(), which is not the right way, because the title might be not only text but also might contain html attributes, on which diffrent css rules are applied, but by using ('> summary').text() all the html attributes and structure will be lost.
Proposed resolution
Do not break the existing structure, use as title the html, which was already there and do not retrieve only the inner text from it.
Remaining tasks
none
User interface changes
none
API changes
none
Data model changes
none
Comments
Comment #2
hchonovComment #3
nils.destoop commentedWe had same issue in our project. But your patch was leading to wrong results. In chrome, the patch worked, in firefox, all tabs got a link as title. That's because chrome already has details support.
In attachment my patch that i'm committing. Instead of taking the full html, the text of the first element found inside the summary, after removing all it's children.
Comment #5
nils.destoop commentedComment #6
hchonovI was testing with Firefox and had no problems there. It would have been nice to mention in which use case you got problems with my patch.
I don't understand why the issue is considered as fixed when the problem I described in the IS is not fixed at all and hasn't been addressed in your comment?
Comment #7
Macronomicus commentedI can confirm even with the latest release I still needed to switch to the following like the 2nd half of the patch in #2. Otherwise the tabs still say Show in them.
.append(tab.title = '<strong>' + settings.title + '</strong>')Comment #8
spacereactor commentedsame, need patch in #2 in order for horizontal tabs to display tab title in firefox
Comment #11
james.williamsI'm with hchonov here - the commit really didn't address the actual problem. It actually made the situation worse in some circumstances. e.g. I lose tab titles entirely on browsers requiring Modernizr! (collapse.js is added much later to the page, so the .details-title element the commit depended on is not even added to the page, and so the summary is set to an empty string.)
So, while this doesn't fix the original issue at all, here's a patch that undoes zuuperman's commit 2730393, which can be a start point for others to build upon.
Comment #12
james.williamsOh interesting, I hadn't seen #2743127: Add core/drupal.collapse dependency, which has since 'fixed' the dependency on core/drupal.collapse. Two things there though:
1) Core's vertical tabs intentionally loads collapse after its vertical tabs javascript, so why should horizontal tabs be any different?
2) As stated in my previous comment, the commit for this issue didn't actually address the original problem, but a slightly different one, so I still think it should be reverted and a different solution found that does actually retain the HTML.
Comment #13
james.williamsSo, having dug yet further into the problem around depending on core/drupal.collapse, the negative weight of the formatters/tabs/horizontal-tabs.js file in the field_group/element.horizontal_tabs library actually means that it comes before core/drupal.collapse in source order, despite depending on the latter. Depending on a library simply ensures the dependency is added to the page, not that it will come out first.
(Core issue #1945262: Introduce "before" and "after" for conditional ordering in library definitions is about resolving this sort of thing: weights simply aren't the way to go for this sort of thing.)
Given that, I think this is now an even stronger argument for removing the need for Modernizr or the collapse library, to avoid all these issues, given that it wasn't actually solving the problem here in the first place. Then once we're back in a working state, the actual feature request of this ticket (allowing HTML in tab titles) can be worked on.
Comment #15
anybodyThanks for commit in #14. Sadly the patch had a mistake:
.append(tab.title = $('<strong></strong>').text(settings.title))should have been
.append(tab.title = $('<strong></strong>').html(settings.title))to preserve HTML in the title. For example to allow items or other formatting. This should not be removed in the JS code.
I tested that change and now everything works great. I'll create a new patch against 8.x-3.x-dev (because I think 1.x will be dropped sooner or later?)
Comment #16
anybodyPatch attached. Please review. My tests were good.
Comment #17
thomas.frobieter+1 for RTBC
Comment #18
benjy commentedEqually as problematic is the line above the latest patch in #16
var summary = summaryElement.clone().children().remove().end().html();By removing the children, if you've done some work to get HTML elements into the tab title, e.g. like an SVG icon then they'll be removed by this.
Comment #19
anybody#16 works fine. If @benjy likes to create a patch which also fixes #18 that would be great. Otherwise let's first of all fix one problem after the other instead of waiting for further month ...
Comment #20
anybody#15 has already been fixed without a reference to this issue. So this is FIXED now. If a new problem appears please create a new issue.
@zuuperman, it would have been perfect to mention this issue and the related persons when fixing #15, but it's most important that it's fixed :)
Comment #21
anybodySorry I was wrong... we were just using that patch ... this is still an open issue and #16 should be applied.
Comment #22
nils.destoop commentedAllowing html in labels is a very bad idea. This is the result if I apply your patch:
Marking this as no fix. If you really need html in your titles, you can write custom javascript.
Comment #23
hchonovWould you please describe how exactly you've come to this result?
Comment #24
james.williams@zuuperman Sure, that value would be bad - so
filter_xss_admin(), or similar, should be applied to the setting's value on the server side. I don't see the need to still reject other people's genuine use case for HTML in labels - just to handle the HTML sensitively.But if you're the maintainer of the module, and will not allow this change, then I guess those of us that need this will have to solve the problem elsewhere. Whether that means using other modules instead, or ones that override what field_group does, I guess.
Comment #25
hchonovTentatively re-opening, because I think that #22 is not a reason to reject the feature, as like @james.williams said in #24 it is up to the developer to escape the text.
You can even make use of
\Drupal\Component\Utility\Html::escape()in\Drupal\field_group\Element\HorizontalTabs::processHorizontalTabs()to automatically escape the text.Comment #26
nils.destoop commentedThe text is already escaped. But by first using .text, and after that .html, all html codes are back.
So if you want to keep it safe, you need to go to adding Xss::filter when preparing the title. Problem there is you need to add a list of allowed html codes, so very specific to peoples current requirement (example only i tags and svg tags). The moment people start using other html tags, it breaks again.
Comment #27
james.williams@zuuperman, that's what
Xss::filterAdmin()is for? Tags that would be permissible for admins. Otherwise use Drupal's input format system which is for configuring what is allowed markup.Would you accept a patch that adds
Xss::filterAdmin()on the server-side, so that.html()can then be used on the client-side?Comment #28
nils.destoop commented@james.williams I can agree to allow filterAdmin. If people want svg, they'll need to add it via custom code.
Comment #29
anybodyPerfect, I agree filterAdmin would be the right approach! :)
Comment #30
swentel commentedWould #3024409: Add option to allow HTML in labels help ?
I also committed #2846617: Do not translate field group labels using interface translation. - it changes the default way to translate labels and description in general (better for config import/export as well).
Comment #31
james.williamsYes, I should think so! Let's just close this ticket as a duplicate, because that's looking at solving the issue that caused this problem, i.e. support for HTML in group labels. There was discussion about Modernizr's place in all this, but that's a side-issue really.
Comment #32
james.williamsComment #33
anybody