Problem/Motivation

  1. Install Standard and Settings Tray.
  2. Toggle into editing mode on the frontpage.
  3. Click the branding block.
  4. In the sidebar, add a slogan that is only
    <em>Wearing the inside out
    and save.
  5. Settings Tray disappears! (And the toolbar tray is also broken as a result.)
  6. Go to /admin/config/system/site-information. Change the slogan to
    <em>Wearing the inside out</em>
    and save.
  7. Go back to the frontpage and confirm that Settings Tray works again.

Changing the site name or a block title does not seem to result in the same bug, presumably because those are escaped by default rather than XSS-filtered.

This bug also seems to affect Contextual Links (which also makes Quick Edit unavailable) and the secondary toolbar tray (the top level still works). The usability impact is lower for those modules; with Settings Tray, you can immediately lock yourself out of editing something just because you made a typo, and have to discover a different path to fix it. I'm not sure if this is a single bug in (e.g.) Contextual Links that is affecting the JS for both the Toolbar and Settings Tray, or if it is a separate issue for each module.

However, in general, this could be very difficult to debug, especially if you don't already know that these modules are sensitive to broken HTML, because broken HTML could come from a lot of places (theme templates, Views UI, various configurable things, etc.) So filing as major based on that.

Proposed resolution

One partial fix might be #2195891: Clean faulty HTML in all administrative strings, which should help at least with things like the site slogan that are XSS-filtered but not escaped or normalized. However, we should also look into whether it's possible to make Settings Tray and Contextual Links more robust.

Remaining tasks

See if there are any partial duplicates of this issue.

User interface changes

TBD

API changes

TBD

Data model changes

N/A

CommentFileSizeAuthor
#14 js-errors-broken-settings-tray.png300.9 KBklara binon
#13 js-errors.png300.9 KBklara binon
#13 em-everywhere.png111.13 KBklara binon
#12 top-menu-second-tray-not affected.png45.76 KBklara binon
#4 unclosed_tag_outside_in_disappears.png44.07 KBxjm
#4 adding_unclosed_tag.png33.93 KBxjm
Support from Acquia helps fund testing for Drupal Acquia logo

Comments

xjm created an issue. See original summary.

xjm credited alexpott.

xjm’s picture

xjm
she/her
Primary language English
CreditAttribution: xjm at Acquia commented

Crediting alexpott since he discovered this.

xjm’s picture

xjm
she/her
Primary language English
CreditAttribution: xjm at Acquia commented
Issue summary: View changes
FileSize
adding_unclosed_tag.png33.93 KB
unclosed_tag_outside_in_disappears.png44.07 KB
xjm’s picture

xjm
she/her
Primary language English
CreditAttribution: xjm at Acquia commented
Issue summary: View changes
xjm’s picture

xjm
she/her
Primary language English
CreditAttribution: xjm at Acquia commented

I confirmed Outside In is still affected after #2786459: "Offcanvas" tray should be using the existing dialog system.

Wim Leers’s picture

Wim Leers
Location Ghent 🇧🇪🇪🇺
CreditAttribution: Wim Leers at Acquia commented

This reminds me of #2551373: contextual.js and quickedit.js should fail gracefully, with useful error messages, when Twig templates forget to print attributes and #2551263: Deleting entity/field models when markup is removed can result in JS error. Maybe they're related.

Version: 8.2.x-dev » 8.3.x-dev

Drupal 8.2.6 was released on February 1, 2017 and is the final full bugfix release for the Drupal 8.2.x series. Drupal 8.2.x will not receive any further development aside from critical and security fixes. Sites should prepare to update to 8.3.0 on April 5, 2017. (Drupal 8.3.0-alpha1 is available for testing.)

Bug reports should be targeted against the 8.3.x-dev branch from now on, and new development or disruptive changes should be targeted against the 8.4.x-dev branch. For more information see the Drupal 8 minor version schedule and the Allowed changes during the Drupal 8 release cycle.

Version: 8.3.x-dev » 8.4.x-dev

Drupal 8.3.6 was released on August 2, 2017 and is the final full bugfix release for the Drupal 8.3.x series. Drupal 8.3.x will not receive any further development aside from critical and security fixes. Sites should prepare to update to 8.4.0 on October 4, 2017. (Drupal 8.4.0-alpha1 is available for testing.)

Bug reports should be targeted against the 8.4.x-dev branch from now on, and new development or disruptive changes should be targeted against the 8.5.x-dev branch. For more information see the Drupal 8 minor version schedule and the Allowed changes during the Drupal 8 release cycle.

klara binon’s picture

klara binon CreditAttribution: klara binon commented
Title: Outside In, Contextual Links, and Toolbar sub-tray disappear if there is slightly broken HTML on the page » Settings Tray, Contextual Links, and Toolbar sub-tray disappear if there is slightly broken HTML on the page
Issue summary: View changes
Issue tags: -Outside-in +Vienna2017

I am working on triaging this issue at Vienna 2017, following the instructions in #2474049: [meta] Major issue triage. @fgm is helping as my mentor.

michaellenahan’s picture

michaellenahan CreditAttribution: michaellenahan at erdfisch commented
Version: 8.4.x-dev » 8.5.x-dev

This needs to be tested against 8.5.x-dev

klara binon’s picture

klara binon CreditAttribution: klara binon commented
Issue summary: View changes
FileSize
top-menu-second-tray-not affected.png45.76 KB

I was able to partially reproduce this issue on the latest 8.5.x-dev with Aquia dev desktop
The steps used were

  1. Install Drupal 8.5.x-dev with the Standard profile.
  2. Enable the Settings Tray module under the Experimental package.
  3. Toggle into editing mode on the frontpage.
  4. Click the branding block.
  5. In the sidebar, add a slogan that is only <em>Wearing the inside out
    and save.
  6. Settings Tray disappears, but the toolbar tray does not break anymore.
    settings tray is gone but toolbar survives
  7. repair again by going to /admin/config/system/site-information. Change the slogan to
    <em>Wearing the inside out</em> and save.
klara binon’s picture

klara binon CreditAttribution: klara binon commented
FileSize
em-everywhere.png111.13 KB
js-errors.png300.9 KB

On inspecting the problem I found that due to broken javascript, the whole html after the broken (and repaired) slogan, gets filled with 

<em>
</em>

em tag everywhere
js errors:
Only local images are allowed.
No longer working on this issue.

klara binon’s picture

klara binon CreditAttribution: klara binon commented
FileSize
js-errors-broken-settings-tray.png300.9 KB
fgm’s picture

fgm
Primary language French
Location Paris, France
CreditAttribution: fgm as a volunteer and at OSInet commented
Issue tags: +Triaged for D8 major current state

Version: 8.5.x-dev » 8.6.x-dev

Drupal 8.5.0-alpha1 will be released the week of January 17, 2018, which means new developments and disruptive changes should now be targeted against the 8.6.x-dev branch. For more information see the Drupal 8 minor version schedule and the Allowed changes during the Drupal 8 release cycle.

Version: 8.6.x-dev » 8.7.x-dev

Drupal 8.6.0-alpha1 will be released the week of July 16, 2018, which means new developments and disruptive changes should now be targeted against the 8.7.x-dev branch. For more information see the Drupal 8 minor version schedule and the Allowed changes during the Drupal 8 release cycle.

Version: 8.7.x-dev » 8.8.x-dev

Drupal 8.7.0-alpha1 will be released the week of March 11, 2019, which means new developments and disruptive changes should now be targeted against the 8.8.x-dev branch. For more information see the Drupal 8 minor version schedule and the Allowed changes during the Drupal 8 release cycle.

Version: 8.8.x-dev » 8.9.x-dev

Drupal 8.8.0-alpha1 will be released the week of October 14th, 2019, which means new developments and disruptive changes should now be targeted against the 8.9.x-dev branch. (Any changes to 8.9.x will also be committed to 9.0.x in preparation for Drupal 9’s release, but some changes like significant feature additions will be deferred to 9.1.x.). For more information see the Drupal 8 and 9 minor version schedule and the Allowed changes during the Drupal 8 and 9 release cycles.

Version: 8.9.x-dev » 9.1.x-dev

Drupal 8.9.0-beta1 was released on March 20, 2020. 8.9.x is the final, long-term support (LTS) minor release of Drupal 8, which means new developments and disruptive changes should now be targeted against the 9.1.x-dev branch. For more information see the Drupal 8 and 9 minor version schedule and the Allowed changes during the Drupal 8 and 9 release cycles.

Version: 9.1.x-dev » 9.2.x-dev

Drupal 9.1.0-alpha1 will be released the week of October 19, 2020, which means new developments and disruptive changes should now be targeted for the 9.2.x-dev branch. For more information see the Drupal 9 minor version schedule and the Allowed changes during the Drupal 9 release cycle.

Version: 9.2.x-dev » 9.3.x-dev

Drupal 9.2.0-alpha1 will be released the week of May 3, 2021, which means new developments and disruptive changes should now be targeted for the 9.3.x-dev branch. For more information see the Drupal core minor version schedule and the Allowed changes during the Drupal core release cycle.

Version: 9.3.x-dev » 9.4.x-dev

Drupal 9.3.0-rc1 was released on November 26, 2021, which means new developments and disruptive changes should now be targeted for the 9.4.x-dev branch. For more information see the Drupal core minor version schedule and the Allowed changes during the Drupal core release cycle.

larowlan’s picture

larowlan
Location 🇦🇺🏝.au GMT+10
CreditAttribution: larowlan at PreviousNext commented
Component: contextual.module » system.module

Things I learned, settings tray is still a module

The onus should be on settings tray, or the form itself to validate the HTML, not much contextual can do here.

Version: 9.4.x-dev » 9.5.x-dev

Drupal 9.4.0-alpha1 was released on May 6, 2022, which means new developments and disruptive changes should now be targeted for the 9.5.x-dev branch. For more information see the Drupal core minor version schedule and the Allowed changes during the Drupal core release cycle.

xjm’s picture

xjm
she/her
Primary language English
CreditAttribution: xjm at Acquia commented
Component: system.module » settings_tray.module
Issue tags: -Triaged for D8 major current state +Triaged for core major current state

Moving to the correct queue.

xjm’s picture

xjm
she/her
Primary language English
CreditAttribution: xjm at Acquia commented
Issue tags: -Triaged for core major current state +Triaged core major

Version: 9.5.x-dev » 10.1.x-dev

Drupal 9.5.0-beta2 and Drupal 10.0.0-beta2 were released on September 29, 2022, which means new developments and disruptive changes should now be targeted for the 10.1.x-dev branch. For more information see the Drupal core minor version schedule and the Allowed changes during the Drupal core release cycle.

Version: 10.1.x-dev » 11.x-dev

Drupal core is moving towards using a “main” branch. As an interim step, a new 11.x branch has been opened, as Drupal.org infrastructure cannot currently fully support a branch named main. New developments and disruptive changes should now be targeted for the 11.x branch, which currently accepts only minor-version allowed changes. For more information, see the Drupal core minor version schedule and the Allowed changes during the Drupal core release cycle.