Allow limited HTML in captions through domPurify, move caption README in main module and fix tests

I am also seeing this in captions after applying the security update, the tags are output with HTML entities:

<div class="pswp__dynamic-caption pswp__hide-on-close pswp__dynamic-caption--aside" data-pswp-caption-type="aside" style="left: 985px; top: 0px; transform: translateY(0px);">

&lt;div class="caption-building"&gt;&lt;a href="/my-link" hreflang="und"&gt;The title&lt;/a&gt;&lt;/div&gt;
  Side and profile of the building
  &lt;hr&gt;
  &lt;div class="caption-category"&gt;&lt;a href="/building" hreflang="en"&gt;Building&lt;/a&gt;&lt;/div&gt;
  &lt;hr&gt;
</div>

Maybe the Status should be bumped up, since this blocks rolling out the security update?

Thanks @ressa we'll check that. Is this issue reproducible in a vanilla installation or did you override any template or something?
Anything else we should know?

Thanks for a fast response @anybody, as always. I have reproduced it in a fresh Drupal 11 installation, both for a single node, and in a View. Let me know if you need more information.

Preparation

• Create a node with this Body, and attach a few images:

  A strong text.

• Install previous release, allow it first:
  

  composer config policy.advisories.block false
  composer require drupal/photoswipe:5.0.8
  

Node

• Open Manage display under /admin/structure/types/manage/article/display/default
• Set "Photoswipe image caption" to use "Body"
• Click the images to open them with Photoswipe, and see the caption text is output well formatted, as expected:

  A strong text.

• Update to the latest version
  composer require drupal/photoswipe
• ... refresh, and see this:

  <p>A <strong>bold</strong> text.</p>

View

• Download previous release of Photoswipe (5.0.8)
• Fix Third-party missing in Views bug: Patch Views, see #3523410-13: Missing Photoswipe Views caption: Drupal core's third party settings formatter missing from Views UI and #2686145: Formatter third party settings missing from Views UI
• Create a view, and set the image field to use "Photoswipe" as "Formatter"
• Remember to set a class: https://git.drupalcode.org/project/photoswipe/#photoswipe-images-in-views
• Check "Use third party settings" and "Custom (with tokens)" and add this:

  A strong VIEWS text.

• Check that the formatting looks good in the previous release
• Switch to latest release and see HTML entities in the output

As the captions submodule is an integral part of the photoswipe module, I'll bump this up to major.

Alright, this does the trick.

Please review!

A few unrelated issues also fixed with internal agreement by @anybody.

Should be all! Please review!

Also allowed to pass and alter cache tags by other modules, so that programmatically changing the setting will also lead the js to "refresh". We did that previously through manually invalidating cache tags in the submit form, But this is not needed anymore.

Perfect, thank you!

Let's merge this and tag a release so people have a working solution.

Thanks @grevil and @anybody for building and releasing a perfect solution so fast, very impressive! It works like a charm.

If I may suggest a single improvement, it would be to tweak the last sentence under Manual installation:

3. Enable the "allowHtmlCaptions" global setting.

... to something like this?

3. Enable "Allow HTML captions" under "Dynamic Caption Settings"

Another detail, which puzzled me yesterday: I enabled "Allow HTML captions" and visited the Status Report page, where all other missing libraries are usually reported, but saw nothing, and concluded there was no check ...

So today I was about to create an issue, but double checked the MR, and realised there is actually a check, nice! But it is shown on the Settings page.

So perhaps the display can be moved to the Status report page, so it is shown there? I created an issue.

Also, should the setting have been under options, like the other ones?

$ drush config:get photoswipe_dynamic_caption.settings
options:
  type: auto
  mobileLayoutBreakpoint: 600
  horizontalEdgeThreshold: 20
  mobileCaptionOverlapRatio: 0.3
  verticallyCenterImage: false
allowHtmlCaptions: true

I.e. it should have been indented in photoswipe_dynamic_caption.schema.yml, like this:

[...]
        verticallyCenterImage:
          type: boolean
          label: 'Vertically center image'
        allowHtmlCaptions:
          type: boolean
          label: 'Allow HTML captions using DOMpurify'

@ressa thank you very muc for your positive words and feedback.

I agree with you in all points but one: I don't think we should move the settings, because the other options are direct Photoswipe Captions options, while this one is Drupal-specific. So let's keep it like this.

Could you please open a follow-up for the things you suggested and prepare a MR for these please?

Regarding the status report, I'm fine with the addition, but please also keep the check on the settings page, because this is where it gets enabled and where people should get immediate feedback.
ONLY show an additional message the status report, IF the option is enabled! Otherwise, neither a positive nor a negative message should appear to not confuse people, who don't use this specific setting. And please put it into the captions submodule.

Thank you very much once again, very helpful feedback! :)

You're welcome, it's always a joy to participate in issues where Drowl is involved.

Thanks for clarifying the distinction between Photoswipe- and Drupal-related settings, and in that case it makes sense to keep them separated.

I actually did create an MR yesterday (#3620978: Show warning on Status report page if DOMPurify file is missing), but only added it as a related issue in my comment, where I should have made this clearer, my bad. As the warning on the settings page, it is only triggered if the "Allow HTML captions" is enabled AND the DOMpurify script is missing.

I was in doubt yesterday about removing the warning on the Settings page ("DRY Principle"), but decided to do so, though I was not 100% sure about it ... So I do agree that it could also be kept, so I updated the MR, and it is no longer removed.

Thank you @ressa! We'll review the follow-up. :)

I'm fine with the addition, but please also keep the check on the settings page, because this is where it gets enabled and where people should get immediate feedback.

Not entirely true, we never introduced validation. Meaning the user won't get "immediate feedback" when enabling the setting. Only when revisiting the site.