Unverified Commit 267186a6 authored by Alex Pott's avatar Alex Pott
Browse files

Issue #2956722 by dww, Prashant.c, vakulrai, imen ch: Exposed sort label is... 

Issue #2956722 by dww, Prashant.c, vakulrai, imen ch: Exposed sort label is double-escaping special characters (apostrophe)
parent 0ef58631

core/modules/views/src/Plugin/views/exposed_form/ExposedFormPluginBase.php

+1 −2
Original line number Diff line number Diff line
@@ -2,7 +2,6 @@ 


namespace Drupal\views\Plugin\views\exposed_form;



use Drupal\Component\Utility\Html;

use Drupal\Core\Cache\Cache;

use Drupal\Core\Cache\CacheableDependencyInterface;

use Drupal\Core\Form\FormState;
@@ -208,7 +207,7 @@ public function exposedFormAlter(&$form, FormStateInterface $form_state) { 
    $exposed_sorts = [];

    foreach ($this->view->sort as $id => $handler) {

      if ($handler->canExpose() && $handler->isExposed()) {

        $exposed_sorts[$id] = Html::escape($handler->options['expose']['label']);

        $exposed_sorts[$id] = $handler->options['expose']['label'];

      }

    }

core/modules/views/tests/src/Functional/Plugin/ExposedFormTest.php

+21 −0
Original line number Diff line number Diff line
@@ -333,6 +333,27 @@ public function testExposedSortAndItemsPerPage() { 
    $this->drupalGet('test_exposed_form_sort_items_per_page', ['query' => ['sort_order' => 'DESC', 'items_per_page' => 25, 'offset' => 10]]);

    $this->assertCacheContexts($contexts);

    $this->assertIds(range(40, 16, 1));



    // Change the label to something with special characters.

    $view = Views::getView('test_exposed_form_sort_items_per_page');

    $view->setDisplay();

    $sorts = $view->display_handler->getOption('sorts');

    $sorts['id']['expose']['label'] = $expected_label = "<script>alert('unsafe&dangerous');</script>";

    $view->display_handler->setOption('sorts', $sorts);

    $view->save();



    $this->drupalGet('test_exposed_form_sort_items_per_page');

    $options = $this->xpath('//select[@id=:id]/option', [':id' => 'edit-sort-by']);

    $this->assertCount(1, $options);

    $this->assertSession()->optionExists('edit-sort-by', $expected_label);

    $escape_1 = Html::escape($expected_label);

    $escape_2 = Html::escape($escape_1);

    // Make sure we see the single-escaped string in the raw output.

    $this->assertRaw($escape_1);

    // But no double-escaped string.

    $this->assertNoRaw($escape_2);

    // And not the raw label, either.

    $this->assertNoRaw($expected_label);

  }



  /**