Commit 0af67776 authored by alexpott's avatar alexpott

Issue #2346209 by keopx, Zekvyrin, subhojit777, cburschka, pguillard, dimaro,...

Issue #2346209 by keopx, Zekvyrin, subhojit777, cburschka, pguillard, dimaro, realityloop, m4olivei, joelpittet, rteijeiro, idebr: /filter/tips improperly escaped
parent 6b91f524
......@@ -469,6 +469,7 @@ function template_preprocess_filter_tips(&$variables) {
foreach ($variables['tips'] as $name => $tiplist) {
foreach ($tiplist as $tip_key => $tip) {
$tiplist[$tip_key]['attributes'] = new Attribute();
$tiplist[$tip_key]['tip'] = Xss::filterAdmin($tiplist[$tip_key]['tip']);
}
$variables['tips'][$name] = array(
......
......@@ -144,8 +144,8 @@ public function tips($long = FALSE) {
if (!empty($tips[$tag])) {
$rows[] = array(
array('data' => $tips[$tag][0], 'class' => array('description')),
array('data' => '<code>' . SafeMarkup::checkPlain($tips[$tag][1]) . '</code>', 'class' => array('type')),
array('data' => $tips[$tag][1], 'class' => array('get'))
array('data' => SafeMarkup::format('<code>@var</code>', array('@var' => $tips[$tag][1])), 'class' => array('type')),
array('data' => SafeMarkup::format($tips[$tag][1]), 'class' => array('get'))
);
}
else {
......@@ -175,8 +175,8 @@ public function tips($long = FALSE) {
foreach ($entities as $entity) {
$rows[] = array(
array('data' => $entity[0], 'class' => array('description')),
array('data' => '<code>' . SafeMarkup::checkPlain($entity[1]) . '</code>', 'class' => array('type')),
array('data' => $entity[1], 'class' => array('get'))
array('data' => SafeMarkup::format('<code>@var</code>', array('@var' => $entity[1])), 'class' => array('type')),
array('data' => SafeMarkup::format($entity[1]), 'class' => array('get'))
);
}
$table = array(
......
......@@ -361,4 +361,26 @@ function testUrlFilterAdmin() {
$this->assertNoRaw(t('The text format %format has been updated.', array('%format' => 'Basic HTML')));
}
/**
* Tests whether filter tips page is not HTML escaped.
*/
function testFilterTipHtmlEscape() {
$this->drupalLogin($this->adminUser);
global $base_url;
// It is not possible to test the whole filter tip page.
// Therefore we test only some parts.
$link = '<a href="' . $base_url . '">' . SafeMarkup::checkPlain(\Drupal::config('system.site')->get('name')) . '</a>';
$ampersand = '&amp;';
$link_as_code = '<code>' . $link . '</code>';
$ampersand_as_code = '<code>' . $ampersand . '</code>';
$this->drupalGet('filter/tips');
$this->assertRaw('<td class="type">' . $link_as_code . '</td>');
$this->assertRaw('<td class="get">' . $link . '</td>');
$this->assertRaw('<td class="type">' . $ampersand_as_code . '</td>');
$this->assertRaw('<td class="get">' . $ampersand . '</td>');
}
}
Markdown is supported
0% or
You are about to add 0 people to the discussion. Proceed with caution.
Finish editing this message first!
Please register or to comment