Problem/Motivation

Recently, https://www.drupal.org/node/3245019 seems to have tightened up the allowable HTML markup within Webform elements' titles. Unfortunately, it seems that the the new restrictions has removed the ability for titles to span multiple lines (via <br> for example).

A visual regression with multi-line titles between 6.0.x and 6.1.x

Steps to reproduce

  1. Install Webform 6.0.x
  2. Configure an element with a <br> in the title that makes it span multiple lines.
  3. Upgrade to Webform 6.1.x
  4. Notice that the title is no longer multi-line

Proposed resolution

Can we allow <br> tags in the '#title'?

@@ -784,6 +785,12 @@ class WebformElementBase extends PluginBase implements WebformElementInterface,
         $element['#attributes']['data-webform-required-error'] = WebformHtmlHelper::toPlainText($element['#required_error']);
         $element['#required_error'] = WebformHtmlHelper::toHtmlMarkup($element['#required_error']);
       }

      // Convert #title to HTML markup so that it can displayed properly
      // in error messages.
      if (isset($element['#title'])) {
-        $element['#title'] = WebformHtmlHelper::toHtmlMarkup($element['#title'], WebformXss::getHtmlTagList());
+        $element['#title'] = WebformHtmlHelper::toHtmlMarkup($element['#title'], WebformXss::getHtmlTagList() + ['br']);
      }
     }

or perhaps add <br> to the list of allowed tags in the WebformXss utility class?

Is there a security angle that I'm not seeing here?

Remaining tasks

TBD

User interface changes

None

API changes

None

Data model changes

None

Thanks so much!

CommentFileSizeAuthor
#2 3253403-2.patch0 bytesjrockowitz
visual-regression.png421.27 KBluke.leber

Issue fork webform-3253403

Command icon Show commands

Start within a Git clone of the project using the version control instructions.

Or, if you do not have SSH keys set up on git.drupalcode.org:

Comments

Luke.Leber created an issue. See original summary.

jrockowitz’s picture

Status: Active » Needs review
StatusFileSize
new0 bytes

I think adding support for multiline titles is a good idea.

  • jrockowitz committed 78a339a on 6.1.x
    Issue #3253403 by jrockowitz, Luke.Leber: Restore support for multi-line...
jrockowitz’s picture

Status: Needs review » Fixed

  • jrockowitz committed 78a339a on 6.x
    Issue #3253403 by jrockowitz, Luke.Leber: Restore support for multi-line...

Status: Fixed » Closed (fixed)

Automatically closed - issue fixed for 2 weeks with no activity.

charginghawk’s picture