Issue #3324210 by robphillips: Validate cancel and delete link URLs. (287a0ada) · Commits · project / entity_form_steps

src/Form/EntityFormSteps.php

+13 −3

Original line number	Diff line number	Diff line
		@@ -3,6 +3,7 @@
		namespace Drupal\entity_form_steps\Form;

		use Drupal\Component\Utility\SortArray;
		use Drupal\Component\Utility\UrlHelper;
		use Drupal\Core\Form\FormStateInterface;
		use Drupal\Core\Render\Markup;
		use Drupal\Core\Url;
		@@ -158,8 +159,13 @@ class EntityFormSteps {
		$url = \Drupal::token()->replace($step['format_settings']['delete_path'], [
		$entity->getEntityTypeId() => $entity,
		]);
		if (UrlHelper::isValid($url, TRUE)) {
		$form['actions']['delete']['#url'] = Url::fromUri($url);
		}
		else {
		$form['actions']['delete']['#url'] = Url::fromUserInput($url);
		}
		}
		if ($step['format_settings']['delete_button']) {
		$form['actions']['delete']['#title'] = $step['format_settings']['delete_button'];
		}
		@@ -235,9 +241,13 @@ class EntityFormSteps {

		// Redirect to specified route if configured.
		if ($step['format_settings']['cancel_path']) {
		return Url::fromUserInput(\Drupal::token()->replace($step['format_settings']['cancel_path'], [
		$url = \Drupal::token()->replace($step['format_settings']['cancel_path'], [
		$entity->getEntityTypeId() => $entity,
		]));
		]);
		if (UrlHelper::isValid($url, TRUE)) {
		return Url::fromUri($url);
		}
		return Url::fromUserInput($url);
		}
		// Redirect to the existing entity canonical route.
		elseif ($entity->id()) {

src/Plugin/field_group/FieldGroupFormatter/Step.php

+21 −0

Original line number	Diff line number	Diff line
		@@ -2,6 +2,8 @@

		namespace Drupal\entity_form_steps\Plugin\field_group\FieldGroupFormatter;

		use Drupal\Component\Utility\UrlHelper;
		use Drupal\Core\Form\FormStateInterface;
		use Drupal\field_group\FieldGroupFormatterBase;

		/**
		@@ -52,6 +54,7 @@ class Step extends FieldGroupFormatterBase {
		'#type' => 'textfield',
		'#title' => $this->t('Cancel button URL'),
		'#description' => $this->t('Override the cancel button link URL. Defaults to the entity canonical route.'),
		'#element_validate' => [[static::class, 'validateUrl']],
		'#default_value' => $this->getSetting('cancel_path'),
		'#group' => 'routes',
		'#states' => [
		@@ -93,6 +96,7 @@ class Step extends FieldGroupFormatterBase {
		$form['delete_path'] = [
		'#type' => 'textfield',
		'#title' => $this->t('Delete button URL'),
		'#element_validate' => [[static::class, 'validateUrl']],
		'#description' => $this->t('Override the delete button link URL. Defaults to the entity delete route.'),
		'#default_value' => $this->getSetting('delete_path'),
		'#group' => 'routes',
		@@ -104,4 +108,21 @@ class Step extends FieldGroupFormatterBase {
		return $form;
		}

		/**
		* Validate proper external or internal URL.
		*/
		public static function validateUrl(array $element, FormStateInterface $form_state): void {
		if ($element['#value']) {
		if ($url = \Drupal::service('path.validator')->getUrlIfValid($element['#value'])) {
		$form_state->setValueForElement($element, $url->toString());
		}
		elseif (!UrlHelper::isValid($element['#value'], TRUE) && !preg_match('/^\//', $element['#value'])) {
		$form_state->setError($element, t('The URL must be begin with a forward slash or be external.'));
		}
		elseif (!UrlHelper::isValid($element['#value'])) {
		$form_state->setError($element, t('The URL does not exist or is invalid.'));
		}
		}
		}

		}