Unverified Commit 28050a29 authored by alexpott's avatar alexpott
Browse files

Issue #2633752 by Lendude, dww, alexpott, AdamBernstein, turpentyne, garryh:...

Issue #2633752 by Lendude, dww, alexpott, AdamBernstein, turpentyne, garryh: Views inline field separator renders HTML as plain text
parent 7681f14c
<?php
namespace Drupal\Tests\views\Kernel\Plugin;
use Drupal\Tests\views\Kernel\ViewsKernelTestBase;
use Drupal\views\Views;
/**
* Tests fields style functionality.
*
* @group views
*
* @see \Drupal\views\Plugin\views\row\Fields.
*/
class StyleFieldsTest extends ViewsKernelTestBase {
/**
* {@inheritdoc}
*/
public static $testViews = ['test_view'];
/**
* Tests inline fields and separator.
*/
public function testInlineFields() {
$renderer = $this->container->get('renderer');
$view = Views::getView('test_view');
$view->setDisplay();
// Test using an HTML separator.
$row = $view->display_handler->getOption('row');
$row['options'] = [
'inline' => [
'age' => 'age',
'id' => 'id',
'name' => 'name',
],
'separator' => '<br />',
];
$view->display_handler->setOption('row', $row);
$view->initDisplay();
$view->initStyle();
$output = $view->preview();
$output = $renderer->renderRoot($output);
$this->assertContains('<div class="views-row"><span class="views-field views-field-age"><span class="field-content">25</span></span><br /><span class="views-field views-field-id"><span class="field-content">1</span></span><br /><span class="views-field views-field-name"><span class="field-content">John</span></span></div>', (string) $output);
$view->destroy();
// Check that unsafe separators are stripped.
$view->setDisplay();
$row = $view->display_handler->getOption('row');
$row['options'] = [
'inline' => [
'age' => 'age',
'id' => 'id',
'name' => 'name',
],
'separator' => '<script>alert("escape me!")</script>',
];
$view->display_handler->setOption('row', $row);
$view->initDisplay();
$view->initStyle();
$output = $view->preview();
$output = $renderer->renderRoot($output);
$this->assertNotContains('<script>', (string) $output);
$this->assertContains('alert("escape me!")', (string) $output);
}
}
......@@ -139,7 +139,9 @@ function template_preprocess_views_view_fields(&$variables) {
}
if (!empty($variables['options']['separator']) && $previous_inline && $object->inline && $object->content) {
$object->separator = Xss::filterAdmin($variables['options']['separator']);
$object->separator = [
'#markup' => $variables['options']['separator'],
];
}
$object->class = Html::cleanCssIdentifier($id);
......
Markdown is supported
0% or .
You are about to add 0 people to the discussion. Proceed with caution.
Finish editing this message first!
Please register or to comment