Views allow to add some HTML tags in their titles.
To avoid security flaws, they are using the following during their execution :

drupal_set_title(filter_xss_admin($this->view->get_title()), PASS_THROUGH);

But TVI uses this instead

drupal_set_title($view->get_title());

Here is a patch to fit to Views usages.

CommentFileSizeAuthor
tvi-html-titles.patch502 bytesduaelfr

Comments

markhalliwell’s picture

markhalliwell
Primary language English
commented
Title: Views titles including HTML are sanitized » Page titles are santitized, double encoding HTML entities (& to &)
Priority: Normal » Major
Status: Needs review » Needs work

Marked #1535590: view -> get_title is rendering ampersand (&) as & as dup of this issue. This issues is going down more of the right path.

This was a very annoying bug and took a while to figure out this module was the culprit. Views already sanitizes the title, which converts & to &.

drupal_set_title() by default runs the text through check_plain() if the PASS_THROUGH isn't used.

This all being said, while the patch technically works, it's using filter_xss_admin() when it should probably really be using filter_xss($title, array()). I don't think that any HTML tags should be allowed in the title and should be stripped, non-tag HTML entities will be left alone. I think this is a more acceptable approach when setting the page title.

  drupal_set_title(filter_xss($view->get_title(), array()), PASS_THROUGH);
duaelfr’s picture

duaelfr
he/him
Primary language French
Location Montpellier, France
commented

I have many use case where HTML is actually needed in the view titles (for theming purpose in most cases).
Plus, Views is exactly using the code line I proposed and I think this module should be as close as possible to the defaut views behavior to avoid the site builders to search for hours why they do not get the same result in the view preview and in their page. I totally trust Views developpers so if they used filter_xss_admin to sanitize the frontend title, we can do it too.

Any other opinion ?

duaelfr’s picture

duaelfr
he/him
Primary language French
Location Montpellier, France
commented
Status: Needs work » Reviewed & tested by the community

As Mark said it works and as it is currently working on a few of my productions, I turn it to RTBC.

If you think TVI might handle titles differently than Views itself to disallow all HTML, argue and turn this issue back to "Need work".

duaelfr’s picture

duaelfr
he/him
Primary language French
Location Montpellier, France
commented
Status: Reviewed & tested by the community » Closed (fixed)

This has been pushed to the 7.x branch.
It will be available in the next dev release.

markhalliwell’s picture

markhalliwell
Primary language English
commented
Status: Closed (fixed) » Fixed

Status: Fixed » Closed (fixed)

Automatically closed -- issue fixed for 2 weeks with no activity.

capfive’s picture

capfive commented
Issue summary: View changes

I am having this issue and I can't find the code or apply the patch, my Ampersand ('&') is displaying as & in the page title when TVI is turned on, anyone able to help? I am using the following version 7.x-1.0-beta5+1-dev

capfive’s picture

capfive commented

FYI anyone looking to find the updated patch can look in https://www.drupal.org/node/2361065#comment-9936414