search

silverstripe / silverstripe-userforms

UserForms module provides a visual form builder for the Silverstripe CMS. No coding required to build forms such as contact pages.
BSD 3-Clause "New" or "Revised" License
134 stars 226 forks source link

SubmittedFormField->getFormattedValue() report display #212

Open prij opened 10 years ago

prij commented 10 years ago

Displays HTML entities in the "Submission" table for each submission because ATT() converts the values as such (ref framework/core/Convert.php, function raw2xml()).

robbieaverill commented 7 years ago

Yes, the result of $this->dbObject('Value') is already XML encoded so we don't need to do it again. It'd be a security risk to avoid this encoding. My inclination would actually be to remote the nl2br altogether and just show encoded HTML.

Reproduced on 4.2.6