Problem/Motivation

If you have a node title like "Me & my friends" and name your file using a token like [node:title] your file will get the name "Me & my friends".

This happens even if you don't have the transliterate and pathauto settings checked.

Cause

Drupal\Core\Utility\Token::replace() explicitly escapes token values. Its docs suggest "If the result is intended to be used as plain text, using PlainTextOutput::renderFromHtml() is recommended."

Proposed resolution

Use PlainTextOutput::renderFromHtml() after token sustitution in filefield_paths_process_string(). If site builders want special characters suppressed, that's the job of the existing transliterate and pathauto settings.

This has significant backwards compatiblility implications. At least a minor version bump would be needed.

Comments

jonathanshaw created an issue.

jonathanshaw’s picture

jonathanshaw
Primary language English
Location Stroud, UK
commented

The only workaround I know is to create a custom token that returns an instance of MarkupInterface, e.g. Markup::create($my_entity->label());.

anybody’s picture

anybody
Primary language German
Location Porta Westfalica
commented

@jonathanshaw might this be a token / core issue / discussion?

We're having the same issue in #3315093: Strings displayed on the Previous / Next Link through tokens are getting escaped twice..
Also see #3026041: Token escaping, but this indeed seems to be problematic for several modules?