On a fresh Drupal 8.2.3 install, using tablefield 8.x-2.x-dev.

1. Create a tablefield field on any content type.
2. Create some content, in any of the table cells enter "John's data"
3. View the node.

This is being output as "john's data" instead of "John's data". Looking at the source code the cell contains "john's data", so it looks like the HTML escaping process is being run twice.

Around line 54 of TablefieldFormatter.php I can see the following line:

'data' => empty($table->format) ? Html::escape($cell) : check_markup($cell, $table->format),

It looks like you don't need to run Html::escape here, as it will be run again on the field when rendered.

CommentFileSizeAuthor
#7 tablefield-remove-double-escaping-2831324-7.patch1.05 KBfdverwoerd
#5 tablefield-use-decode-entities-2831324-5.patch804 bytesfdverwoerd
#2 tablefield-use-decode-entities-2831324-2.patch826 bytesfdverwoerd

Comments

ThomWilhelm created an issue. See original summary.

fdverwoerd’s picture

fdverwoerd commented
StatusFileSize
new tablefield-use-decode-entities-2831324-2.patch826 bytes

Yes, simple "word's" gets escaped because the object `$table->format` is not set (Plain). I changed the 'escaping' to decodeEntities in a patch.

lolandese’s picture

lolandese commented
Status: Active » Needs review

There is now a patch to review.

hgoto’s picture

hgoto commented
Status: Needs review » Needs work

I tested the patch #2. It works well. Yet, I believe we can rely on the Twig autoescaping.

https://www.drupal.org/node/2296163

So the line can be simply like

    'data' => empty($table->format) ? $cell : check_markup($cell, $table->format),

without using Html::escape(), I think. @fdverwoerd, if you don't mind, could you please update the patch?

fdverwoerd’s picture

fdverwoerd commented
Status: Needs work » Needs review
StatusFileSize
new tablefield-use-decode-entities-2831324-5.patch804 bytes

Hi @hgoto,

I've updated the patch without escaping the 'cell', and it still works for me!

Thanks, need's review again.

hgoto’s picture

hgoto commented
Status: Needs review » Needs work

@fdverwoerd thank you! I tested the patch #5 and it works well for me.

Nitpick. Html is no longer used in TablefieldFormatter.php and maybe we can remove the following line as well?

use Drupal\Component\Utility\Html;
fdverwoerd’s picture

fdverwoerd commented
Status: Needs work » Needs review
StatusFileSize
new tablefield-remove-double-escaping-2831324-7.patch1.05 KB

True, it isn't used anymore indeed. I've removed it and updated patch.

hgoto’s picture

hgoto commented
Status: Needs review » Reviewed & tested by the community

I tested the patch #7 and it works well. I believe it's OK to mark this RTBC. Thanks!

hgoto’s picture

hgoto commented
StevenWill’s picture

StevenWill commented

I have also tested patch #7 and it works for me. Also fixed a issue with &.

lolandese’s picture

lolandese commented
Status: Reviewed & tested by the community » Fixed

Thanks for your contribution.

Status: Fixed » Closed (fixed)

Automatically closed - issue fixed for 2 weeks with no activity.