The 2026 Drupal Business Survey is open. Your response will help shape the future of the Drupal business ecosystem.When I include the token submission:values in the confirmation page, and this page has a text format, the token renders as plain text, and not as html.
Reproduce:
Create a webform
Create a html textformat (without any filters)
Create a confirmation message with this text format, and add submission:values as value
Submit the form
All values are displayed in one row without any formatting.
| Comment | File | Size | Author |
|---|---|---|---|
| #2 | sanitize_option_check-2958385-2.patch | 626 bytes | joshahubbers |
Comments
Comment #2
joshahubbers commentedCause/problem:
the token_replace function expects sanitize to be true or false. Currently, we only pass true when it is explicitly true. But when sanitize is a textformat, we submit false. This check should be other way around: only pass false when it is false, else we pass true.
Security effect: the token_replace function does not sanitze the values we submit, but values are always sanitized upon submit before entering this function, so that will not be a problem.
Comment #3
liam morlandCould you make a test for this? We should have a test anyway and it would help illustrate exactly what it does.
Why would $sanitize not be a Boolean?
Comment #4
liam morlandDrupal 7 is no longer supported. If this applies to a supported version, please re-open.