I am using a Formatted text field to populate the Marker info text unsing a token in the "Geolocation Google Maps API - Map" formatter. The HTML in the field is being escaped.

Support from Acquia helps fund testing for Drupal Acquia logo

Comments

Lukas von Blarer created an issue. See original summary.

andres.torres’s picture

Having the same issue, trying yo set a simple link to open the marker in google maps by adding this markup:
<a href="http://maps.apple.com/maps?q=[geolocation_current_item:lat],[geolocation_current_item:lng]">Open in Maps</a>
and the output is in plain text.
Is there a way to insert html or twig code into the marker?
Also noticed that adding a token or any value to display into the marker, forces the marker to add the lat, long data to the output and this is data that is not supposed to show since these values are not set on the marker info text field.

Lukas von Blarer’s picture

Yes, I solved the issue by using the raw filter in the template geolocation-common-map-location.html.twig:

<div class="geolocation" data-lat="{{ position.lat }}" data-lng="{{ position.lng }}" {% if icon is not empty %} data-icon="{{ icon }}" {% endif %} {% if location_id is not empty %} data-location-id="{{ location_id }}" {% endif %}>
    <div class="location-content">{{ content|raw }}</div>
</div>
andres.torres’s picture

Very big thank you Lucas!!! overriding the twig template with the raw option made my day!

ChristianAdamski’s picture

Hey all,

Drupal 8 has that concept of "safe markup", where is supposed to prevent XSS and other evil threats. It does mean that twig will autoescape HTML, unless marked safe. Using the "raw" filter would undermine that effort...

rodrigoaguilera’s picture

Maybe a friendly solution better than to override the twig template is to have a checkbox (unchecked by default) that Reads something like
"Allow to have unfiltered HTML markup on the marker text" with a warning in the description explaining that this is has security implications

Lukas von Blarer’s picture

Sure, my solution is just an ugly workaround and should only be used if access to the field being displayed is restricted. We have to allow input filters to be used for the marker info text. In my case it is a formatted text field and therefore it has already been escaped and is safe.

scottsawyer’s picture

I just ran into this. I am building a module that outputs the map in a block using the #type => geolocation_google_map, and I would like to provide a link to open in Google Maps in the location => content. I don't want to override the template for every map that is generated, or try to override for specific maps.

Maybe another setting on the element #locations array like: content_allowed_tags => array('span', 'a', 'div') or something?

ChristianAdamski’s picture

Status: Active » Needs review
FileSize
1.61 KB

Try this patch and report back please. It adds 'strong', 'a', 'span', 'div', to allowed tags for formatter and element.

Not sure if this is how it works.

ChristianAdamski’s picture

Locally seems to work.

Lukas von Blarer’s picture

Status: Needs review » Needs work

The filter needs to be configurable in my opinion.

madmanmax’s picture

I think the best approach is to change the info_text field to a text_format type. No need to make the allowed tags configurable, just use drupal formatters. I've attached a patch but it's for version 8.x-1.10. I don't have the time to make it for the dev version. And it might needs a hook_update_N() as well since we changed the type, but I have no clue how to do this.

JoshuaBud’s picture

With #12 is it possible to place twig arguments into the marker config? I have several fields that I want to include but not every location has all of the fields present and when no entry in the node is present it prints out the token. I would think there would be a simple way to not include empty fields in the info markers and certainly not include a token.

Lukas von Blarer’s picture

Lukas von Blarer’s picture

Status: Needs work » Needs review

Sorry, meant to change the status

Status: Needs review » Needs work

The last submitted patch, 12: 2879274-12.patch, failed testing. View results

Lukas von Blarer’s picture

Both patches don't apply anymore.

madmanmax’s picture

@JoshuaBud that sounds like a future request. The issue is regarding escaped HTML.

polmaresma’s picture

#3 solved the issue to me.
https://www.drupal.org/node/2879274#comment-12098995

Thank's!

flocondetoile’s picture

Patch #12 rerolled on latest stable version 1.11. Always need an hook_update_N(). Should a simple clear cache may be sufficient ? I could edit an existing field with an simple drush cr when rerolling this patch.

flocondetoile’s picture

Status: Needs work » Needs review

Status: Needs review » Needs work

The last submitted patch, 20: 2879274-20.patch, failed testing. View results
- codesniffer_fixes.patch Interdiff of automated coding standards fixes only.

KarenS’s picture

Status: Needs work » Reviewed & tested by the community

The patch in #20 is the correct way to fix this. It allows the user to select the appropriate text format for the info box. I tried it with a token replacement in the info box that returns markup. Before the patch the markup was escaped. After the patch it displays correctly.

This patch looks good to me.

KarenS’s picture

OK there are test errors, but it looks like they're related to the schema change, so maybe a hook update to clear caches would fix that? Testing it locally I get no errors, but I did clear caches manually.

ChristianAdamski’s picture

Note to self: look at this, adapt for 2.x and make it happen for infowindow and contextpopup as well.

ChristianAdamski’s picture

Version: 8.x-1.x-dev » 8.x-2.x-dev
Status: Reviewed & tested by the community » Fixed
FileSize
13.68 KB

  • madmanmax authored 18ecc24 on 8.x-2.x
    Issue #2879274 by ChristianAdamski, madmanmax, flocondetoile: HTML is...
ChristianAdamski’s picture

Fixed for 2.x. Won't be fixed for 1.x to preserve compatibility.

Status: Fixed » Closed (fixed)

Automatically closed - issue fixed for 2 weeks with no activity.