Since this is just an addition to drupal_set_message(), devel can be preemptive before the following lands in core: #2408955: drupal_set_message should filter output by default.

CommentFileSizeAuthor
#3 add_pass_through-2831622-3.patch1.39 KBmarkhalliwell
#2 add_pass_through-2831622-2.patch1.22 KBmarkhalliwell
Support from Acquia helps fund testing for Drupal Acquia logo

Comments

markcarver created an issue. See original summary.

markhalliwell’s picture

markhalliwell
Primary language English
CreditAttribution: markhalliwell at Tag1 Consulting commented
Status: Active » Needs review
FileSize
add_pass_through-2831622-2.patch1.22 KB
markhalliwell’s picture

markhalliwell
Primary language English
CreditAttribution: markhalliwell at Tag1 Consulting commented
FileSize
add_pass_through-2831622-3.patch1.39 KB

Forgot to add some commenting to explain why this is needed.

Also, it should be noted that this isn't an issue in 8.x because Twig auto-escapes.

jvogt’s picture

jvogt CreditAttribution: jvogt commented

Should this patch address the issue we're experiencing with Devel + Bootstrap 3.8+? I ran the patch (add_pass_through-2831622-3.patch), but the dpm() output is still broken.

I also tested it manually like so:

$export = kprint_r($form_state, TRUE, 'form_state');
drupal_set_message($export, 'status', 'true', PASS_THROUGH);

No luck there either. Is there something I need to do to make PASS_THROUGH function?

Stats:

* Core 7.52
* Devel 7.x-1.5
* Bootstrap 7.x-3.10

Thanks in advance for any advice!

markhalliwell’s picture

markhalliwell
Primary language English
CreditAttribution: markhalliwell at Tag1 Consulting commented

This issue is preemptive in the sense that it can technically be committed without currently breaking anything.

However, this patch will technically only work if core is patched as well: #2408955: drupal_set_message should filter output by default.

jvogt’s picture

jvogt CreditAttribution: jvogt commented

I see. Thanks, I'll give that a try.

MustangGB’s picture

MustangGB CreditAttribution: MustangGB commented

Here is an alternative to allow the XSS filter to remain, and instead fix Krumo #2855666: Make Krumo compatible with XSS injection protection to drupal_set_message().

MustangGB’s picture

MustangGB CreditAttribution: MustangGB commented
Category: Task » Feature request
Status: Needs review » Postponed

There is no indication that #2408955: drupal_set_message should filter output by default will be accepted into core, so postponing for the time being.

MustangGB’s picture

MustangGB CreditAttribution: MustangGB commented
Status: Postponed » Closed (won't fix)

Resolved by #2855666: Make Krumo compatible with XSS injection protection to drupal_set_message().