diff --git a/modules/block/block.module b/modules/block/block.module index 72c3c5c5684644e3a3c1ab438a90c49b66fe3f81..5cb0447d66af0f30d1f78a0c9f08a11609817f98 100644 --- a/modules/block/block.module +++ b/modules/block/block.module @@ -240,9 +240,28 @@ function block_block_save($delta = 0, $edit = array()) { * * Generates the administrator-defined blocks for display. */ -function block_block_view($delta = 0, $edit = array()) { - $block = db_query('SELECT body, format FROM {block_custom} WHERE bid = :bid', array(':bid' => $delta))->fetchObject(); - $data['content'] = check_markup($block->body, $block->format, '', TRUE); +function block_block_view($delta = '') { + $query = db_select('block_custom', 'bc'); + $query->join('block', 'b', 'bc.bid = b.delta'); + $block = $query + ->addTag('translatable') + ->addTag('block_load') + ->fields('b', array('title')) + ->fields('bc', array('body', 'format')) + ->condition('bc.bid', $delta) + ->range(0, 1) + ->execute() + ->fetchObject(); + + $data = array( + // Only module-generated block titles are allowed to output any HTML markup. + // Custom block titles are always user input and therefore always escaped. + // @see _block_render_blocks() + 'subject' => $block->title == '<none>' ? '' : check_plain($block->title), + 'content' => array( + '#markup' => check_markup($block->body, $block->format), + ), + ); return $data; } diff --git a/modules/block/block.test b/modules/block/block.test index 1a52cb23bdfcbd979fe0cb8d68fd9ef11d770b7f..7c92a357db5f362a9961cf3f2d75ab6ac7dcde78 100644 --- a/modules/block/block.test +++ b/modules/block/block.test @@ -75,9 +75,15 @@ class BlockTestCase extends DrupalWebTestCase { $this->assertText(t('The block has been created.'), t('Custom block successfully created.')); $bid = db_query("SELECT bid FROM {block_custom} WHERE info = :info", array(':info' => $custom_block['info']))->fetchField(); - // Check to see if the custom block was created by checking that it's in the database.. + // Check to see if the custom block was created by checking that it's in the database. $this->assertNotNull($bid, t('Custom block found in database')); + // Check that block_block_view() returns the correct title and content. + $data = block_block_view($bid); + $format = db_query("SELECT format FROM {block_custom} WHERE bid = :bid", array(':bid' => $bid))->fetchField(); + $this->assertEqual($custom_block['title'], $data['subject'], t('block_block_view() provides correct block title.')); + $this->assertEqual(check_markup($custom_block['body[value]'], $format), $data['content']['#markup'], t('block_block_view() provides correct block content.')); + // Check if the block can be moved to all availble regions. $custom_block['module'] = 'block'; $custom_block['delta'] = $bid;