userfrosting / UserFrosting

Modern PHP user login and management framework
https://www.userfrosting.com
Other
1.64k stars 366 forks source link

[V4 & V5] HTML in `page_description` block bleed in the template #1227

Closed lcharette closed 1 year ago

lcharette commented 1 year ago

Chat discussion : https://chat.userfrosting.com/channel/support?msg=s9XotScA52Wc6r2Ja

When HTML is used in the page_description block, text can appear in the template, but only when double quotes are used:

this works as expected

{% extends 'pages/abstract/dashboard.html.twig' %}

{% block page_title %}Some title{% endblock %}

{% block page_description %}
    Some description with links 
    <a href='https://site1.com' target='_blank'>site1.com</a> и <a href='https://site2.com' target='_blank'>site2.com</a>
{% endblock %}

but this puts some part of href attributes at the left upper corner of the page

{% extends 'pages/abstract/dashboard.html.twig' %}

{% block page_title %}Some title{% endblock %}

{% block page_description %}
    Some description with links 
    <a href="https://site1.com" target="_blank">site1.com</a> and <a href="https://site2.com" target="_blank">site2.com</a>
{% endblock %} 

Capture d’écran, le 2023-09-22 à 16 21 48

Cause : HTML is not escapade here: https://github.com/userfrosting/UserFrosting/blob/adb574f378fb0af1c5eaa3be71458869431e7410/app/sprinkles/core/templates/pages/abstract/base.html.twig#L12

Fix:

<meta name="description" content="{{ block('page_description')|e }}">