-
Notifications
You must be signed in to change notification settings - Fork 9.3k
New issue
Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.
By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.
Already on GitHub? Sign in to your account
Update Options.php #8130
Update Options.php #8130
Conversation
Prevent special charachters (like ü or ß) from being inserted as HTML encoded entities (like ü or ß) in widget input fields.
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
Can you accompany pull request with the unit tests, please?
@@ -163,6 +163,8 @@ protected function _addField($parameter) | |||
} | |||
} | |||
|
|||
$data['value'] = html_entity_decode( $data['value'] ); |
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
- Please use \Magento\Framework\Escaper::escapeHtmlAttr instead of native PHP library
- there is extra space after "(", please remove
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
The \Magento\Framework\Escaper::escapeHtmlAttr
function doesn't give the desired result. html_entity_decode
is used by Magento core elsewhere. See https://github.com/magento/magento2/search?utf8=✓&q=html_entity_decode&type=Code. I have removed the extra spaces.
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
Thank you, looks good
@redelschaap Thank you for the contribution! Left couple comments in the code review. |
Removed spaces
@redelschaap merged! Appreciate your support. |
Great! Thanks! |
@vrann @redelschaap |
Than that value is serialized, so it will be a string on that point. Right @vrann? |
L3 Bugfix delivery
Prevent special charachters (like ü or ß) from being inserted as HTML encoded entities (like ü or ß) in widget input fields.