Closed REHvision closed 3 years ago
@REHvision Thanks for report. There is a breaking change here, you need to use like that {< page.subpages >}
Several blueprint options that use the query syntax were updated to escape the placeholder values against raw HTML output that may lead to XSS attacks. HTML code directly in the query (like This is {{ page.important }}) still works as normal. If placeholders need to return HTML, you can use the new {< site.myMethodWithHtml >} syntax. In this case you need to ensure manually that the returned HTML code is safe. With the {{ }} syntax, Kirby performs the escaping for you.
https://getkirby.com/releases/3.6/breaking-changes#panel
Duplicated with #3809 #3804
Thanks for replying and sorry for overlooking this in the release notes :see_no_evil:
Describe the bug: In 3.6 beta-3 Kirby does not render HTML which is returned by a page function (model or method) and only displays it as a String when used in info of pages section or info section/field.
HTML directly added in the blueprint (e.g.
info: "<span class="subpages">{{ page.children.listed.count }}</span>"
gets rendered, but if the function returns HTML (e.g.info: "{{ page.customDetails }}"
it does not anymore.To Reproduce: Steps to reproduce the behavior:
Expected behavior: I would expect it to work as it did up to Kirby 3.6, or is this change intentional maybe?
Screenshots: Info of line 1 is how it looks in 3.6 and info of line 2 is how it looks with HTML directly in the blueprint and also how it looked prior to 3.6 with the method.
Kirby Version: 3.6 beta 3
Console output:
Desktop: