When I try to put html tags (em, strong, etc) in the title field, they don't render as html. The tags get escaped out as &gt and &lt:

<em>Chicago Tribune</em> article

<em>Chicago Tribune</em> article

I've noticed similar issues for 5.x and 6.x versions, but nothing for 7.x.

Comments

chris_ege’s picture

I found a fix - in theme_link_formatter_default($vars), i changed the following line:

return l($vars['element']['title'], $vars['element']['url'], array('attributes' => $vars['element']['attributes']));

to this:

return l($vars['element']['title'], $vars['element']['url'], array('attributes' => $vars['element']['attributes'], 'html' => TRUE));

This solves the problem for my particular case. It seems like 'html' => TRUE should be set wherever return l() is called, as the module states:

"Static and token-based titles may include most inline XHTML tags such as strong, em, img, span, etc.'"

W.M.’s picture

Thanks Chris, the solution you have provided solves this issue too http://drupal.org/node/1245104

zroger’s picture

I think this is safe to be committed, since link_field_prepare_view() sanitizes the title field.

imiksu’s picture

We should use element properties instead, rather setting it once again. I'm not sure where exactly it gets set but I think this might be better.

Change

<?php
return l($vars['element']['title'], $vars['element']['url'], array('attributes' => $vars['element']['attributes']));
?>

to

<?php
return l($vars['element']['title'], $vars['element']['url'], array('attributes' => $vars['element']['attributes'], 'html' => $vars['element']['html']));
?>

See patch attached.

dqd’s picture

Status: Active » Needs review

thx 2 all

will review and commit the patch asap ...

romenov’s picture

Actualy .. the title field is already sanitized when it reaches that function it seems to me .. which is resulting in poor display of the text: Jack & Jones , which turns into Jack &amp; Jones.

dqd’s picture

btw. html tags in a single line text field without drupal text format filters and its role permissions involved should be discussed and can become a security issue soon.

please read about Drupal text formats and text fields. The title field of link works exact like a single line text field which doesn't use text formating imho in drupal core.

So, sadly to sad, but, I think it works as designed. Not sure if this will go into a release ... (btw: there are some cases, I can think of, where I don't want it to interpret my input. And there are sooo many modules around for handling field markup, like display suite etc, I won't count them here ... )

(for those who still want that for their individual use please review the patch)

dqd’s picture

Category: bug » feature

typing <strong>My Title</strong> results here in the output <strong>My Title</strong>. (D7.8, link alpha3) single line text field as plaintext

http://drupal.org/node/224921
http://drupal.org/node/213156

works as designed ...

imiksu’s picture

I am using static title to determine an image from other field.

The descriptions says:

Static and token-based titles may include most inline XHTML tags such as strong, em, img, span, etc.

And I am using static title <img src="[node:field_image]" alt="[node:title]"/>.

By not using the patch I can't use XHTML tag such as img. So is this really a feature request or am I understanding this wrong?

dqd’s picture

Status: Fixed » Needs review

Thank you for pointing to it clearly again, iMiksu!

I can reproduce it now:


<img src="[node:field_image]" alt="[node:title]"/>

by using static like decsribed in line 88 of link.module results in


<img src="/link/to/file/path/text" alt="image title"/>

but not in:

(browser view)


linked title to the image

(from rendered sourcecode)


<a href="/link/to/file/path/text" alt="image title">linked title to the image</a>

... as expected.

thx 2 all, and special thanks to iMiksu again for the report.

dqd’s picture

Category: feature » bug
Status: Needs review » Fixed

EDIT: By testing it again with latest --dev, it seems, that the issue has been mostly fixed (97% at least). Not sure in the moment, if the patch of iMiksu took place or if jcfiala did it already before. But thank you for all the efforts.

So, please understand (sorry) - I have to close the issue again for better overview and have to point to using the latest --dev shot of link module for solving any leftovers of this issue (if so) to go on with further testing from the as-is-now status.

Any reports and patches are much much appreciated in the moment, since we have still a lot to catch up to get right for final D7 release. I am appointed in here since yesterday to push things forward.

Status: Needs review » Closed (fixed)

Automatically closed -- issue fixed for 2 weeks with no activity.