From ecf7ad41d0c3b8d4ea12e3883d3b5c9060eb2963 Mon Sep 17 00:00:00 2001
From: Angie Byron <webchick@24967.no-reply.drupal.org>
Date: Sat, 11 Oct 2008 21:11:02 +0000
Subject: [PATCH] #242873 by pwolanin and bjaspan: Make drupal_set_title() do
check_plain() by default.
---
includes/batch.inc | 8 +--
includes/common.inc | 23 +++++++-
includes/form.inc | 5 ++
includes/path.inc | 9 +++-
modules/aggregator/aggregator.pages.inc | 2 +-
modules/block/block.admin.inc | 2 +-
modules/blog/blog.pages.inc | 2 +-
modules/book/book.admin.inc | 2 +-
modules/book/book.pages.inc | 2 +-
modules/comment/comment.module | 2 +-
modules/contact/contact.pages.inc | 2 +-
modules/filter/filter.admin.inc | 6 +--
modules/forum/forum.module | 4 +-
modules/node/node.module | 4 +-
modules/node/node.pages.inc | 8 +--
modules/openid/openid.pages.inc | 2 +-
modules/path/path.admin.inc | 2 +-
modules/poll/poll.pages.inc | 4 +-
modules/profile/profile.admin.inc | 4 +-
modules/profile/profile.pages.inc | 4 +-
modules/statistics/statistics.admin.inc | 6 +--
modules/statistics/statistics.pages.inc | 4 +-
modules/system/system.module | 7 ++-
modules/system/system.test | 65 +++++++++++++++++++++++
modules/taxonomy/taxonomy.pages.inc | 2 +-
modules/tracker/tracker.pages.inc | 2 +-
modules/translation/translation.pages.inc | 2 +-
modules/user/user.pages.inc | 4 +-
28 files changed, 145 insertions(+), 44 deletions(-)
diff --git a/includes/batch.inc b/includes/batch.inc
index ad5630368248..2cc41a92211b 100644
--- a/includes/batch.inc
+++ b/includes/batch.inc
@@ -80,10 +80,10 @@ function _batch_start() {
function _batch_progress_page_js() {
$batch = batch_get();
- // The first batch set gets to set the page title
- // and the initialization and error messages.
+ // The first batch set gets to set the page title and the initialization and
+ // error messages. Only safe strings should be passed in to batch_set().
$current_set = _batch_current_set();
- drupal_set_title($current_set['title']);
+ drupal_set_title($current_set['title'], PASS_THROUGH);
drupal_add_js('misc/progress.js', 'core', 'header', FALSE, FALSE);
$url = url($batch['url'], array('query' => array('id' => $batch['id'])));
@@ -126,7 +126,7 @@ function _batch_progress_page_nojs() {
$batch =& batch_get();
$current_set = _batch_current_set();
- drupal_set_title($current_set['title']);
+ drupal_set_title($current_set['title'], PASS_THROUGH);
$new_op = 'do_nojs';
diff --git a/includes/common.inc b/includes/common.inc
index a244dfbd1f9f..f6b3c1553fa0 100644
--- a/includes/common.inc
+++ b/includes/common.inc
@@ -24,6 +24,27 @@
*/
define('SAVED_DELETED', 3);
+/**
+ * @name Title text filtering flags
+ * @{
+ * Flags for use in drupal_set_title().
+ */
+
+/**
+ * Flag for drupal_set_title(); text is not sanitized, so run check_plain().
+ */
+define('CHECK_PLAIN', 0);
+
+/**
+ * Flag for drupal_set_title(); text has already been sanitized.
+ */
+define('PASS_THROUGH', -1);
+
+/**
+ * @} End of "Title text filtering flags".
+ */
+
+
/**
* Set content for a specified region.
*
@@ -750,7 +771,7 @@ function fix_gpc_magic() {
* to escape HTML characters. Use this for any output that's displayed within
* a Drupal page.
* @code
- * drupal_set_title($title = t("@name's blog", array('@name' => $account->name)));
+ * drupal_set_title($title = t("@name's blog", array('@name' => $account->name)), PASS_THROUGH);
* @endcode
*
* - %variable, which indicates that the string should be HTML escaped and
diff --git a/includes/form.inc b/includes/form.inc
index 21f7224ddc4c..2293389315fd 100644
--- a/includes/form.inc
+++ b/includes/form.inc
@@ -2379,6 +2379,11 @@ function form_clean_id($id = NULL, $flush = FALSE) {
* batch_process();
* @endcode
*
+ * Note - if the batch 'title', 'init_message', 'progress_message',
+ * or 'error_message' could contain any user input, it is the responsibility of
+ * the code calling batch_set() to sanitize them first with a function like
+ * check_plain() or filter_xss().
+ *
* Sample batch operations:
* @code
* // Simple and artificial: load a node of a given type for a given user
diff --git a/includes/path.inc b/includes/path.inc
index 617e69a239b1..159920e8760b 100644
--- a/includes/path.inc
+++ b/includes/path.inc
@@ -196,15 +196,20 @@ function drupal_get_title() {
* @param $title
* Optional string value to assign to the page title; or if set to NULL
* (default), leaves the current title unchanged.
+ * @param $output
+ * Optional flag - normally should be left as CHECK_PLAIN. Only set to
+ * PASS_THROUGH if you have already removed any possibly dangerous code
+ * from $title using a function like check_plain() or filter_xss(). With this
+ * flag the string will be passed through unchanged.
*
* @return
* The updated title of the current page.
*/
-function drupal_set_title($title = NULL) {
+function drupal_set_title($title = NULL, $output = CHECK_PLAIN) {
static $stored_title;
if (isset($title)) {
- $stored_title = $title;
+ $stored_title = ($output == PASS_THROUGH) ? $title : check_plain($title);
}
return $stored_title;
}
diff --git a/modules/aggregator/aggregator.pages.inc b/modules/aggregator/aggregator.pages.inc
index 6a37cd00cff0..4df1d0391d86 100644
--- a/modules/aggregator/aggregator.pages.inc
+++ b/modules/aggregator/aggregator.pages.inc
@@ -37,7 +37,7 @@ function aggregator_page_source($arg1, $arg2 = NULL) {
// $arg1 is $form_state and $arg2 is $feed. Otherwise, $arg1 is $feed.
$feed = is_array($arg2) ? $arg2 : $arg1;
$feed = (object)$feed;
- drupal_set_title(check_plain($feed->title));
+ drupal_set_title($feed->title);
$feed_source = theme('aggregator_feed_source', $feed);
// It is safe to include the fid in the query because it's loaded from the
diff --git a/modules/block/block.admin.inc b/modules/block/block.admin.inc
index af7e47749bf3..ad5541b0b4aa 100644
--- a/modules/block/block.admin.inc
+++ b/modules/block/block.admin.inc
@@ -174,7 +174,7 @@ function block_admin_configure(&$form_state, $module = NULL, $delta = 0) {
// Get the block subject for the page title.
$info = module_invoke($module, 'block', 'list');
if (isset($info[$delta])) {
- drupal_set_title(t("'%name' block", array('%name' => $info[$delta]['info'])));
+ drupal_set_title(t("'%name' block", array('%name' => $info[$delta]['info'])), PASS_THROUGH);
}
// Standard block configurations.
diff --git a/modules/blog/blog.pages.inc b/modules/blog/blog.pages.inc
index 042b089edcc4..2deb15cef9f5 100644
--- a/modules/blog/blog.pages.inc
+++ b/modules/blog/blog.pages.inc
@@ -12,7 +12,7 @@
function blog_page_user($account) {
global $user;
- drupal_set_title($title = t("@name's blog", array('@name' => $account->name)));
+ drupal_set_title($title = t("@name's blog", array('@name' => $account->name)), PASS_THROUGH);
$items = array();
diff --git a/modules/book/book.admin.inc b/modules/book/book.admin.inc
index 088c2d68aeb6..be8fe7b4a1a7 100644
--- a/modules/book/book.admin.inc
+++ b/modules/book/book.admin.inc
@@ -70,7 +70,7 @@ function book_admin_settings_validate($form, &$form_state) {
* @ingroup forms.
*/
function book_admin_edit($form_state, $node) {
- drupal_set_title(check_plain($node->title));
+ drupal_set_title($node->title);
$form = array();
$form['#node'] = $node;
_book_admin_table($node, $form);
diff --git a/modules/book/book.pages.inc b/modules/book/book.pages.inc
index 6ec9ce00c829..01dfe388181b 100644
--- a/modules/book/book.pages.inc
+++ b/modules/book/book.pages.inc
@@ -90,7 +90,7 @@ function book_export_html($nid) {
* Menu callback; show the outline form for a single node.
*/
function book_outline($node) {
- drupal_set_title(check_plain($node->title));
+ drupal_set_title($node->title);
return drupal_get_form('book_outline_form', $node);
}
diff --git a/modules/comment/comment.module b/modules/comment/comment.module
index cde48a9890ef..db663aa87f32 100644
--- a/modules/comment/comment.module
+++ b/modules/comment/comment.module
@@ -1442,7 +1442,7 @@ function comment_form_box($edit, $title = NULL) {
function comment_form_add_preview($form, &$form_state) {
global $user;
$edit = $form_state['values'];
- drupal_set_title(t('Preview comment'));
+ drupal_set_title(t('Preview comment'), PASS_THROUGH);
$output = '';
$node = node_load($edit['nid']);
diff --git a/modules/contact/contact.pages.inc b/modules/contact/contact.pages.inc
index 63b5241e03ff..e9a9f00d3d56 100644
--- a/modules/contact/contact.pages.inc
+++ b/modules/contact/contact.pages.inc
@@ -164,7 +164,7 @@ function contact_user_page($account) {
$output = t("You cannot send more than %number messages per hour. Please try again later.", array('%number' => variable_get('contact_hourly_threshold', 3)));
}
else {
- drupal_set_title(check_plain($account->name));
+ drupal_set_title($account->name);
$output = drupal_get_form('contact_mail_user', $account);
}
diff --git a/modules/filter/filter.admin.inc b/modules/filter/filter.admin.inc
index 8fcebb7aa44e..f74fd2d6b5a8 100644
--- a/modules/filter/filter.admin.inc
+++ b/modules/filter/filter.admin.inc
@@ -94,7 +94,7 @@ function theme_filter_admin_overview($form) {
*/
function filter_admin_format_page($format = NULL) {
if (!isset($format->name)) {
- drupal_set_title(t("Add input format"));
+ drupal_set_title(t('Add input format'), PASS_THROUGH);
$format = (object)array('name' => '', 'roles' => '', 'format' => '');
}
return drupal_get_form('filter_admin_format_form', $format);
@@ -302,7 +302,7 @@ function filter_admin_delete_submit($form, &$form_state) {
* Menu callback; display settings defined by a format's filters.
*/
function filter_admin_configure_page($format) {
- drupal_set_title(t("Configure %format", array('%format' => $format->name)));
+ drupal_set_title(t("Configure %format", array('%format' => $format->name)), PASS_THROUGH);
return drupal_get_form('filter_admin_configure', $format);
}
@@ -343,7 +343,7 @@ function filter_admin_configure_submit($form, &$form_state) {
* Menu callback; display form for ordering filters for a format.
*/
function filter_admin_order_page($format) {
- drupal_set_title(t("Rearrange %format", array('%format' => $format->name)));
+ drupal_set_title(t("Rearrange %format", array('%format' => $format->name)), PASS_THROUGH);
return drupal_get_form('filter_admin_order', $format);
}
diff --git a/modules/forum/forum.module b/modules/forum/forum.module
index 1ad242382c54..99083e895c70 100644
--- a/modules/forum/forum.module
+++ b/modules/forum/forum.module
@@ -723,7 +723,7 @@ function template_preprocess_forums(&$variables) {
}
}
drupal_set_breadcrumb($breadcrumb);
- drupal_set_title(check_plain($title));
+ drupal_set_title($title);
if ($variables['forums_defined'] = count($variables['forums']) || count($variables['parents'])) {
// Format the "post new content" links listing.
@@ -784,7 +784,7 @@ function template_preprocess_forums(&$variables) {
}
else {
- drupal_set_title(t('No forums defined'));
+ drupal_set_title(t('No forums defined'), PASS_THROUGH);
$variables['links'] = array();
$variables['forums'] = '';
$variables['topics'] = '';
diff --git a/modules/node/node.module b/modules/node/node.module
index 176804062b49..48e75a3be13f 100644
--- a/modules/node/node.module
+++ b/modules/node/node.module
@@ -1142,7 +1142,7 @@ function node_build_content($node, $teaser = FALSE, $page = FALSE) {
*/
function node_show($node, $cid, $message = FALSE) {
if ($message) {
- drupal_set_title(t('Revision of %title from %date', array('%title' => $node->title, '%date' => format_date($node->revision_timestamp))));
+ drupal_set_title(t('Revision of %title from %date', array('%title' => $node->title, '%date' => format_date($node->revision_timestamp))), PASS_THROUGH);
}
$output = node_view($node, FALSE, TRUE);
@@ -1857,7 +1857,7 @@ function node_page_default() {
* Menu callback; view a single node.
*/
function node_page_view($node, $cid = NULL) {
- drupal_set_title(check_plain($node->title));
+ drupal_set_title($node->title);
return node_show($node, $cid);
}
diff --git a/modules/node/node.pages.inc b/modules/node/node.pages.inc
index 3868fd51a99e..452f3f8537b9 100644
--- a/modules/node/node.pages.inc
+++ b/modules/node/node.pages.inc
@@ -11,7 +11,7 @@
* Menu callback; presents the node editing form, or redirects to delete confirmation.
*/
function node_page_edit($node) {
- drupal_set_title(check_plain($node->title));
+ drupal_set_title($node->title);
return drupal_get_form($node->type . '_node_form', $node);
}
@@ -59,7 +59,7 @@ function node_add($type) {
// Initialize settings:
$node = array('uid' => $user->uid, 'name' => (isset($user->name) ? $user->name : ''), 'type' => $type, 'language' => '');
- drupal_set_title(t('Create @name', array('@name' => $types[$type]->name)));
+ drupal_set_title(t('Create @name', array('@name' => $types[$type]->name)), PASS_THROUGH);
$output = drupal_get_form($type . '_node_form', $node);
}
@@ -381,7 +381,7 @@ function node_preview($node) {
$cloned_node->build_mode = NODE_BUILD_PREVIEW;
$output = theme('node_preview', $cloned_node);
}
- drupal_set_title(t('Preview'));
+ drupal_set_title(t('Preview'), PASS_THROUGH);
return $output;
}
@@ -504,7 +504,7 @@ function node_delete_confirm_submit($form, &$form_state) {
* Generate an overview table of older revisions of a node.
*/
function node_revision_overview($node) {
- drupal_set_title(t('Revisions for %title', array('%title' => $node->title)));
+ drupal_set_title(t('Revisions for %title', array('%title' => $node->title)), PASS_THROUGH);
$header = array(t('Revision'), array('data' => t('Operations'), 'colspan' => 2));
diff --git a/modules/openid/openid.pages.inc b/modules/openid/openid.pages.inc
index 6d8ba2d6092c..efd7684eee2a 100644
--- a/modules/openid/openid.pages.inc
+++ b/modules/openid/openid.pages.inc
@@ -28,7 +28,7 @@ function openid_authentication_page() {
* Menu callback; Manage OpenID identities for the specified user.
*/
function openid_user_identities($account) {
- drupal_set_title(check_plain($account->name));
+ drupal_set_title($account->name);
drupal_add_css(drupal_get_path('module', 'openid') . '/openid.css', 'module');
// Check to see if we got a response
diff --git a/modules/path/path.admin.inc b/modules/path/path.admin.inc
index 9960f3471529..6e2a440afa5b 100644
--- a/modules/path/path.admin.inc
+++ b/modules/path/path.admin.inc
@@ -66,7 +66,7 @@ function path_admin_overview($keys = NULL) {
function path_admin_edit($pid = 0) {
if ($pid) {
$alias = path_load($pid);
- drupal_set_title(check_plain($alias['dst']));
+ drupal_set_title($alias['dst']);
$output = drupal_get_form('path_admin_form', $alias);
}
else {
diff --git a/modules/poll/poll.pages.inc b/modules/poll/poll.pages.inc
index 39d4563983ba..61f3bf6c2eeb 100644
--- a/modules/poll/poll.pages.inc
+++ b/modules/poll/poll.pages.inc
@@ -28,7 +28,7 @@ function poll_page() {
* Callback for the 'votes' tab for polls you can see other votes on
*/
function poll_votes($node) {
- drupal_set_title(check_plain($node->title));
+ drupal_set_title($node->title);
$output = t('This table lists all the recorded votes for this poll. If anonymous users are allowed to vote, they will be identified by the IP address of the computer they used when they voted.');
$header[] = array('data' => t('Visitor'), 'field' => 'u.name');
@@ -51,7 +51,7 @@ function poll_votes($node) {
* Callback for the 'results' tab for polls you can vote on
*/
function poll_results($node) {
- drupal_set_title(check_plain($node->title));
+ drupal_set_title($node->title);
$node->show_results = TRUE;
return node_show($node, 0);
}
diff --git a/modules/profile/profile.admin.inc b/modules/profile/profile.admin.inc
index 912378852b16..5219dffed73f 100644
--- a/modules/profile/profile.admin.inc
+++ b/modules/profile/profile.admin.inc
@@ -175,7 +175,7 @@ function profile_field_form(&$form_state, $arg = NULL) {
drupal_not_found();
return;
}
- drupal_set_title(t('edit %title', array('%title' => $edit['title'])));
+ drupal_set_title(t('edit %title', array('%title' => $edit['title'])), PASS_THROUGH);
$form['fid'] = array('#type' => 'value',
'#value' => $fid,
);
@@ -193,7 +193,7 @@ function profile_field_form(&$form_state, $arg = NULL) {
return;
}
$type = $arg;
- drupal_set_title(t('add new %type', array('%type' => $types[$type])));
+ drupal_set_title(t('add new %type', array('%type' => $types[$type])), PASS_THROUGH);
$edit = array('name' => 'profile_');
$form['type'] = array('#type' => 'value', '#value' => $type);
}
diff --git a/modules/profile/profile.pages.inc b/modules/profile/profile.pages.inc
index 275a9d4632b9..52946376bb2d 100644
--- a/modules/profile/profile.pages.inc
+++ b/modules/profile/profile.pages.inc
@@ -73,7 +73,7 @@ function profile_browse() {
$title = check_plain($field->page);
}
- drupal_set_title($title);
+ drupal_set_title($title, PASS_THROUGH);
return $output;
}
else if ($name && !$field->fid) {
@@ -99,7 +99,7 @@ function profile_browse() {
$output = theme('profile_wrapper', $content);
$output .= theme('pager', NULL, 20);
- drupal_set_title(t('User list'));
+ drupal_set_title(t('User list'), PASS_THROUGH);
return $output;
}
}
diff --git a/modules/statistics/statistics.admin.inc b/modules/statistics/statistics.admin.inc
index 7295083e7a32..38733c1f5a96 100644
--- a/modules/statistics/statistics.admin.inc
+++ b/modules/statistics/statistics.admin.inc
@@ -64,7 +64,7 @@ function statistics_top_pages() {
$rows[] = array(array('data' => t('No statistics available.'), 'colspan' => 4));
}
- drupal_set_title(t('Top pages in the past %interval', array('%interval' => format_interval(variable_get('statistics_flush_accesslog_timer', 259200)))));
+ drupal_set_title(t('Top pages in the past %interval', array('%interval' => format_interval(variable_get('statistics_flush_accesslog_timer', 259200)))), PASS_THROUGH);
$output = theme('table', $header, $rows);
$output .= theme('pager', NULL, 30, 0);
return $output;
@@ -97,7 +97,7 @@ function statistics_top_visitors() {
$rows[] = array(array('data' => t('No statistics available.'), 'colspan' => 4));
}
- drupal_set_title(t('Top visitors in the past %interval', array('%interval' => format_interval(variable_get('statistics_flush_accesslog_timer', 259200)))));
+ drupal_set_title(t('Top visitors in the past %interval', array('%interval' => format_interval(variable_get('statistics_flush_accesslog_timer', 259200)))), PASS_THROUGH);
$output = theme('table', $header, $rows);
$output .= theme('pager', NULL, 30, 0);
return $output;
@@ -109,7 +109,7 @@ function statistics_top_visitors() {
function statistics_top_referrers() {
$query = "SELECT url, COUNT(url) AS hits, MAX(timestamp) AS last FROM {accesslog} WHERE url NOT LIKE :host AND url <> '' GROUP BY url";
$query_cnt = "SELECT COUNT(DISTINCT(url)) FROM {accesslog} WHERE url <> '' AND url NOT LIKE :host";
- drupal_set_title(t('Top referrers in the past %interval', array('%interval' => format_interval(variable_get('statistics_flush_accesslog_timer', 259200)))));
+ drupal_set_title(t('Top referrers in the past %interval', array('%interval' => format_interval(variable_get('statistics_flush_accesslog_timer', 259200)))), PASS_THROUGH);
$header = array(
array('data' => t('Hits'), 'field' => 'hits', 'sort' => 'desc'),
diff --git a/modules/statistics/statistics.pages.inc b/modules/statistics/statistics.pages.inc
index 69286b515805..612a03f347e0 100644
--- a/modules/statistics/statistics.pages.inc
+++ b/modules/statistics/statistics.pages.inc
@@ -29,7 +29,7 @@ function statistics_node_tracker() {
$rows[] = array(array('data' => t('No statistics available.'), 'colspan' => 4));
}
- drupal_set_title(check_plain($node->title));
+ drupal_set_title($node->title);
$output = theme('table', $header, $rows);
$output .= theme('pager', NULL, 30, 0);
return $output;
@@ -60,7 +60,7 @@ function statistics_user_tracker() {
$rows[] = array(array('data' => t('No statistics available.'), 'colspan' => 3));
}
- drupal_set_title(check_plain($account->name));
+ drupal_set_title($account->name);
$output = theme('table', $header, $rows);
$output .= theme('pager', NULL, 30, 0);
return $output;
diff --git a/modules/system/system.module b/modules/system/system.module
index 2ccdbc01ad0e..448dcec1fa5a 100644
--- a/modules/system/system.module
+++ b/modules/system/system.module
@@ -1296,6 +1296,11 @@ function system_node_type($op, $info) {
* confirmed the action. You should never directly inspect $_POST to see if an
* action was confirmed.
*
+ * Note - if the parameters $question, $description, $yes, or $no could contain
+ * any user input (such as node titles or taxonomy terms), it is the
+ * responsibility of the code calling confirm_form() to sanitize them first with
+ * a function like check_plain() or filter_xss().
+ *
* @ingroup forms
* @param $form
* Additional elements to inject into the form, for example hidden elements.
@@ -1329,7 +1334,7 @@ function confirm_form($form, $question, $path, $description = NULL, $yes = NULL,
}
$cancel = l($no ? $no : t('Cancel'), $path, array('query' => $query, 'fragment' => $fragment));
- drupal_set_title($question);
+ drupal_set_title($question, PASS_THROUGH);
// Confirm form fails duplication check, as the form values rarely change -- so skip it.
$form['#skip_duplicate_check'] = TRUE;
diff --git a/modules/system/system.test b/modules/system/system.test
index 18bb36c63540..dbf6c0dbd65f 100644
--- a/modules/system/system.test
+++ b/modules/system/system.test
@@ -457,3 +457,68 @@ class PageNotFoundTestCase extends DrupalWebTestCase {
$this->assertNoText(t('User login'), t('Blocks are not shown on the default 404 page'));
}
}
+
+class PageTitleFiltering extends DrupalWebTestCase {
+ protected $content_user;
+ protected $saved_title;
+
+ /**
+ * Implementation of getInfo().
+ */
+ function getInfo() {
+ return array(
+ 'name' => t('HTML in page titles'),
+ 'description' => t('Tests correct handling or conversion by drupal_set_title() and drupal_get_title().'),
+ 'group' => t('System')
+ );
+ }
+
+ /**
+ * Implementation of setUp().
+ */
+ function setUp() {
+ parent::setUp();
+
+ $this->content_user = $this->drupalCreateUser(array('create page content', 'access content'));
+ $this->drupalLogin($this->content_user);
+ $this->saved_title = drupal_get_title();
+ }
+
+ /**
+ * Reset page title.
+ */
+ function tearDown() {
+ // Restore the page title.
+ drupal_set_title($this->saved_title, PASS_THROUGH);
+
+ parent::tearDown();
+ }
+
+ /**
+ * Tests the handling of HTML by drupal_set_title() and drupal_get_title()
+ */
+ function testTitleTags() {
+ $title = "string with <em>HTML</em>";
+ // drupal_set_title's $filter is CHECK_PLAIN by default, so the title should be
+ // returned with check_plain().
+ drupal_set_title($title, CHECK_PLAIN);
+ $this->assertTrue(strpos(drupal_get_title(), '<em>') === FALSE, t('Tags in title converted to entities when $output is CHECK_PLAIN.'));
+ // drupal_set_title's $filter is passed as PASS_THROUGH, so the title should be
+ // returned with HTML.
+ drupal_set_title($title, PASS_THROUGH);
+ $this->assertTrue(strpos(drupal_get_title(), '<em>') !== FALSE, t('Tags in title are not converted to entities when $output is PASS_THROUGH.'));
+ // Generate node content.
+ $edit = array(
+ 'title' => '!SimpleTest! ' . $title . $this->randomName(20),
+ 'body' => '!SimpleTest! test body' . $this->randomName(200),
+ );
+ // Create the node with HTML in the title.
+ $this->drupalPost('node/add/page', $edit, t('Save'));
+
+ $node = node_load(array('title' => $edit['title']));
+ $this->assertNotNull($node, 'Node created and found in database');
+ $this->drupalGet("node/" . $node->nid);
+ $this->assertText(check_plain($edit['title']), 'Check to make sure tags in the node title are converted.');
+ }
+}
+
diff --git a/modules/taxonomy/taxonomy.pages.inc b/modules/taxonomy/taxonomy.pages.inc
index 6e6b9af2b91d..e72c8a2078b6 100644
--- a/modules/taxonomy/taxonomy.pages.inc
+++ b/modules/taxonomy/taxonomy.pages.inc
@@ -112,7 +112,7 @@ function theme_taxonomy_term_page($tids, $result) {
*/
function taxonomy_term_edit($term) {
if (isset($term)) {
- drupal_set_title(check_plain($term->name));
+ drupal_set_title($term->name);
return drupal_get_form('taxonomy_form_term', taxonomy_vocabulary_load($term->vid), (array)$term);
}
return drupal_not_found();
diff --git a/modules/tracker/tracker.pages.inc b/modules/tracker/tracker.pages.inc
index 97d9489925da..027b39419285 100644
--- a/modules/tracker/tracker.pages.inc
+++ b/modules/tracker/tracker.pages.inc
@@ -19,7 +19,7 @@ function tracker_page($account = NULL, $set_title = FALSE) {
// When viewed from user/%user/track, display the name of the user
// as page title -- the tab title remains Track so this needs to be done
// here and not in the menu definiton.
- drupal_set_title(check_plain($account->name));
+ drupal_set_title($account->name);
}
// TODO: These queries are very expensive, see http://drupal.org/node/105639
$sql = 'SELECT DISTINCT(n.nid), n.title, n.type, n.changed, n.uid, u.name, GREATEST(n.changed, l.last_comment_timestamp) AS last_updated, l.comment_count FROM {node} n INNER JOIN {node_comment_statistics} l ON n.nid = l.nid INNER JOIN {users} u ON n.uid = u.uid LEFT JOIN {comments} c ON n.nid = c.nid AND (c.status = %d OR c.status IS NULL) WHERE n.status = 1 AND (n.uid = %d OR c.uid = %d) ORDER BY last_updated DESC';
diff --git a/modules/translation/translation.pages.inc b/modules/translation/translation.pages.inc
index 095b581b5a87..09c82800f381 100644
--- a/modules/translation/translation.pages.inc
+++ b/modules/translation/translation.pages.inc
@@ -54,6 +54,6 @@ function translation_node_overview($node) {
$rows[] = array($language_name, $title, $status, implode(" | ", $options));
}
- drupal_set_title(t('Translations of %title', array('%title' => $node->title)));
+ drupal_set_title(t('Translations of %title', array('%title' => $node->title)), PASS_THROUGH);
return theme('table', $header, $rows);
}
diff --git a/modules/user/user.pages.inc b/modules/user/user.pages.inc
index 5050f45e2177..24eb3d6c507e 100644
--- a/modules/user/user.pages.inc
+++ b/modules/user/user.pages.inc
@@ -147,7 +147,7 @@ function user_logout() {
* Menu callback; Displays a user or user profile page.
*/
function user_view($account) {
- drupal_set_title(check_plain($account->name));
+ drupal_set_title($account->name);
// Retrieve all profile fields and attach to $account->content.
user_build_content($account);
@@ -218,7 +218,7 @@ function template_preprocess_user_profile_category(&$variables) {
* @see user_edit_submit()
*/
function user_edit($account, $category = 'account') {
- drupal_set_title(check_plain($account->name));
+ drupal_set_title($account->name);
return drupal_get_form('user_profile_form', $account, $category);
}
--
GitLab