Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

remove script tag #25418

Merged
merged 4 commits into from
Nov 14, 2019
Merged

remove script tag #25418

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
4 commits
Select commit Hold shift + click to select a range
e422942
remove script tag
torhoehn Oct 31, 2019
4b432f8
initialize tooltip for order items
torhoehn Nov 4, 2019
d4cae50
fix functional tests
torhoehn Nov 4, 2019
6e36d5e
Merge branch '2.3-develop' into feature/additional-product-options
torhoehn Nov 7, 2019
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
2 changes: 1 addition & 1 deletion app/code/Magento/Sales/Block/Order/Item/Renderer/DefaultRenderer.php
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -182,7 +182,7 @@ public function getFormatedOptionValue($optionValue)

if ($this->string->strlen($optionValue) > 55) {
$result['value'] = $result['value']
. ' <a href="#" class="dots tooltip toggle" onclick="return false">...</a>';
. ' ...';
$optionValue = nl2br($optionValue);
$result = array_merge($result, ['full_view' => $optionValue]);
}
Expand Down
2 changes: 1 addition & 1 deletion app/code/Magento/Sales/view/frontend/templates/order/creditmemo/items/renderer/default.phtml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -17,7 +17,7 @@
<?php if (!$block->getPrintStatus()) : ?>
<?php $_formatedOptionValue = $block->getFormatedOptionValue($_option) ?>
<dd<?= (isset($_formatedOptionValue['full_view']) ? ' class="tooltip wrapper"' : '') ?>>
<?= $block->escapeHtml($_formatedOptionValue['value']) ?>
<?= $block->escapeHtml($_formatedOptionValue['value'], ['a', 'img']) ?>
Copy link

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

img tag is not allowed in the html Escaper class:
https://github.com/magento/magento2/blob/2.4-develop/lib/internal/Magento/Framework/Escaper.php#L40

This generates an error The following tag(s) are not allowed: img when go to the Order page in My Account
The line in the Escaper:
https://github.com/magento/magento2/blob/2.4-develop/lib/internal/Magento/Framework/Escaper.php#L457

Probably removing the img from allowed tags passed as the second parameter should be enough.

Copy link

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

I created pull request, that fixed critical error
#29863

<?php if (isset($_formatedOptionValue['full_view'])) : ?>
<div class="tooltip content">
<dl class="item options">
Expand Down
2 changes: 1 addition & 1 deletion app/code/Magento/Sales/view/frontend/templates/order/invoice/items/renderer/default.phtml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -17,7 +17,7 @@
<?php if (!$block->getPrintStatus()) : ?>
<?php $_formatedOptionValue = $block->getFormatedOptionValue($_option) ?>
<dd<?= (isset($_formatedOptionValue['full_view']) ? ' class="tooltip wrapper"' : '') ?>>
<?= $block->escapeHtml($_formatedOptionValue['value']) ?>
<?= $block->escapeHtml($_formatedOptionValue['value'], ['a', 'img']) ?>
<?php if (isset($_formatedOptionValue['full_view'])) : ?>
<div class="tooltip content">
<dl class="item options">
Expand Down
16 changes: 9 additions & 7 deletions app/code/Magento/Sales/view/frontend/templates/order/items/renderer/default.phtml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -16,17 +16,19 @@ $_item = $block->getItem();
<dt><?= $block->escapeHtml($_option['label']) ?></dt>
<?php if (!$block->getPrintStatus()) : ?>
<?php $_formatedOptionValue = $block->getFormatedOptionValue($_option) ?>
<dd>
<dd<?= (isset($_formatedOptionValue['full_view']) ? ' class="tooltip wrapper"' : '') ?>>
<?= $block->escapeHtml($_formatedOptionValue['value'], ['a', 'img']) ?>
<?php if (isset($_formatedOptionValue['full_view'])) : ?>
<?= $block->escapeHtml($_formatedOptionValue['full_view'], ['a']) ?>
<?php else : ?>
<?=$block->escapeHtml($_formatedOptionValue['value'], ['a']) ?>
<div class="tooltip content">
<dl class="item options">
<dt><?= $block->escapeHtml($_option['label']) ?></dt>
<dd><?= $block->escapeHtml($_formatedOptionValue['full_view']) ?></dd>
</dl>
</div>
<?php endif; ?>
</dd>
<?php else : ?>
<dd>
<?= /* @noEscape */ nl2br($block->escapeHtml($_option['print_value'] ?? $_option['value'])) ?>
</dd>
<dd><?= $block->escapeHtml((isset($_option['print_value']) ? $_option['print_value'] : $_option['value'])) ?></dd>
<?php endif; ?>
<?php endforeach; ?>
</dl>
Expand Down
2 changes: 1 addition & 1 deletion app/code/Magento/Sales/view/frontend/templates/order/shipment/items/renderer/default.phtml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -16,7 +16,7 @@
<?php if (!$block->getPrintStatus()) : ?>
<?php $_formatedOptionValue = $block->getFormatedOptionValue($_option) ?>
<dd<?= (isset($_formatedOptionValue['full_view']) ? ' class="tooltip wrapper"' : '') ?>>
<?= $block->escapeHtml($_formatedOptionValue['value']) ?>
<?= $block->escapeHtml($_formatedOptionValue['value'], ['a', 'img']) ?>
<?php if (isset($_formatedOptionValue['full_view'])) : ?>
<div class="tooltip content">
<dl class="item options">
Expand Down