Problem

When I haven't authorized my module yet, I get an message:

You must Drupal to use your Google Analytics account before you can view reports.

Following with this warning message:

Warning: htmlspecialchars() expects parameter 1 to be string, object given in Drupal\Component\Utility\Html::escape() (line 421 of core/lib/Drupal/Component/Utility/Html.php).
Drupal\Component\Utility\Html::escape(Object) (Line: 259)
Drupal\Component\Render\FormattableMarkup::placeholderEscape(Object) (Line: 200)
Drupal\Component\Render\FormattableMarkup::placeholderFormat('You must @link Drupal to use your Google Analytics account before you can view reports.', Array) (Line: 204)
Drupal\Core\StringTranslation\TranslatableMarkup->render() (Line: 15)
Drupal\Core\StringTranslation\TranslatableMarkup->__toString() (Line: 451)
drupal_set_message(Object) (Line: 310)
Drupal\google_analytics_reports\Plugin\views\query\GoogleAnalyticsQuery->execute(Object) (Line: 1413)
Drupal\views\ViewExecutable->execute(NULL) (Line: 1441)
Drupal\views\ViewExecutable->render() (Line: 2391)
Drupal\views\Plugin\views\display\DisplayPluginBase->preview() (Line: 1649)
Drupal\views\ViewExecutable->preview('top_searches_block') (Line: 128)
Drupal\views\Plugin\views\area\View->render(1) (Line: 2219)
Drupal\views\Plugin\views\display\DisplayPluginBase->renderArea('header', 1) (Line: 2164)
Drupal\views\Plugin\views\display\DisplayPluginBase->elementPreRender(Array)
call_user_func(Array, Array) (Line: 376)
Drupal\Core\Render\Renderer->doRender(Array) (Line: 448)
Drupal\Core\Render\Renderer->doRender(Array, ) (Line: 195)
Drupal\Core\Render\Renderer->render(Array, ) (Line: 226)
Drupal\Core\Render\MainContent\HtmlRenderer->Drupal\Core\Render\MainContent\{closure}() (Line: 574)
Drupal\Core\Render\Renderer->executeInRenderContext(Object, Object) (Line: 227)
Drupal\Core\Render\MainContent\HtmlRenderer->prepare(Array, Object, Object) (Line: 117)
Drupal\Core\Render\MainContent\HtmlRenderer->renderResponse(Array, Object, Object) (Line: 90)
Drupal\Core\EventSubscriber\MainContentViewSubscriber->onViewRenderArray(Object, 'kernel.view', Object) (Line: 111)
Drupal\Component\EventDispatcher\ContainerAwareEventDispatcher->dispatch('kernel.view', Object) (Line: 149)
Symfony\Component\HttpKernel\HttpKernel->handleRaw(Object, 1) (Line: 64)
Symfony\Component\HttpKernel\HttpKernel->handle(Object, 1, 1) (Line: 57)
Drupal\Core\StackMiddleware\Session->handle(Object, 1, 1) (Line: 47)
Drupal\Core\StackMiddleware\KernelPreHandle->handle(Object, 1, 1) (Line: 99)
Drupal\page_cache\StackMiddleware\PageCache->pass(Object, 1, 1) (Line: 78)
Drupal\page_cache\StackMiddleware\PageCache->handle(Object, 1, 1) (Line: 34)
Drupal\uhsg_redirect_to_login\StackMiddleware\RedirectToLogin->handle(Object, 1, 1) (Line: 47)
Drupal\Core\StackMiddleware\ReverseProxyMiddleware->handle(Object, 1, 1) (Line: 50)
Drupal\Core\StackMiddleware\NegotiationMiddleware->handle(Object, 1, 1) (Line: 23)
Stack\StackedHttpKernel->handle(Object, 1, 1) (Line: 652)
Drupal\Core\DrupalKernel->handle(Object) (Line: 19)

Potential cause

This is caused by \Drupal\google_analytics_reports\Plugin\views\query\GoogleAnalyticsQuery::execute in the beginning when checking whether the authorization is done.

    // Initial check to see if we should attempt to run the query.
    if (!$this->configFactory->get('google_analytics_reports_api.settings')->get('access_token')) {
      // Optionally do not warn users on every query attempt before auth.
      drupal_set_message(t('You must @link Drupal to use your Google Analytics account before you can view reports.', ['@link' => Link::createFromRoute('Authorize', 'google_analytics_reports_api.settings')]));
      return;
    }

Proposed fix

Inject URL only same way as we do in google_analytics_reports_api_requirements(). Patch following in the comments.

Support from Acquia helps fund testing for Drupal Acquia logo

Comments

iMiksu created an issue. See original summary.

iMiksu’s picture

Status: Active » Needs review
FileSize
1.43 KB

See patch.

othermachines’s picture

Status: Needs review » Reviewed & tested by the community

I don't think we need to wait on more reviews for this dead simple fix. It's tested and working. Thanks!

abu-zakham’s picture

Hello, I think we should use ':url' instead of '@url',

https://api.drupal.org/api/drupal/core%21lib%21Drupal%21Component%21Rend...

I have re-rolled the patch in #2, And I have enhanced the message.

Regards.

abu-zakham’s picture

FileSize
1.53 KB
dcrellen’s picture

Patch 2 worked for me. Also, after opening Google Analytics Summary and not having set up Google properly, the message for need to setup with enclosed link to the instructions was very helpful. The linked instructions were absolutely spot on. Thank you to the team that maintains this module.

Rajab Natshah’s picture

Following with:
https://api.drupal.org/api/drupal/core%21lib%21Drupal%21Component%21Rend...

In the case of @url

Escape if the value is not an object from a class that implements
\Drupal\Component\Render\MarkupInterface, for example strings will
be escaped.
Strings that are safe within HTML fragments, but not within other
contexts, may still be an instance of
\Drupal\Component\Render\MarkupInterface, so this placeholder type
must not be used within HTML attributes, JavaScript, or CSS.

In the case of :url

Strip URL protocols that can be XSS vectors.
Escape unconditionally, without checking whether the value is an
instance of \Drupal\Component\Render\MarkupInterface. This forces
characters that are unsafe for use in an "href" HTML attribute to
be encoded. If a caller wants to pass a value that is extracted
from HTML and therefore is already HTML encoded, it must invoke
\Drupal\Component\Render\OutputStrategyInterface::renderFromHtml()
on it prior to passing it in as a placeholder value of this type.
@todo Add some advice and stronger warnings.
https://www.drupal.org/node/2569041.

In the case of %url

Similarly to @, escape non-safe values. Also, add wrapping markup
in order to render as a placeholder. Not for use within attributes,
per the warning above about
\Drupal\Component\Render\MarkupInterface and also due to the
wrapping markup.

Having the :url from #5

Rajab Natshah’s picture

Rajab Natshah’s picture

Status: Reviewed & tested by the community » Fixed

Status: Fixed » Closed (fixed)

Automatically closed - issue fixed for 2 weeks with no activity.