Closed (fixed)
Project:
Panelizer (obsolete)
Version:
7.x-3.x-dev
Component:
Code
Priority:
Normal
Category:
Bug report
Assigned:
Unassigned
Reporter:
Created:
16 Jun 2014 at 23:27 UTC
Updated:
9 Mar 2016 at 13:52 UTC
Jump to comment: Most recent, Most recent file
Comments
Comment #1
tom friedhof commentedThis isn't the most elegant fix for this, but solves the problem.
Comment #2
damienmckennaI would if check_plain would be sufficient?
Comment #3
damienmckennaNo, check_plain() would not be sufficient. I'm also not sure I like this change either, I think instead we should work on patching CTools to not strip multiple dashes and leverage that API change, rather than removing any string security we have from the string replacement.
This patch leverages a new option I submitted as a patch for CTools: #2287399: Allow ctools_cleanstring to retain multiple separator values
Comment #4
tom friedhof commentedHere is another patch that makes more sense, using a core function to sanitize the css class.
Comment #5
damienmckennaMaybe use drupal_html_class() instead?
Comment #7
tom friedhof commentedI guess it couldn't hurt to use drupal_html_class() instead, to ensure the same string isn't sanitized multiple times.
Comment #8
tom friedhof commentedComment #9
mglamanPatch works great, fixes big issue when using BEM/SMACSS workflow. Updated patch to remove unneeded include to call
ctools_include('cleanstring');Comment #11
damienmckennaCommitted. Thanks everyone!
Comment #13
crizUnfortunately using drupal_html_class() doesn't work for double underscores (element).
See #2009584: Allow double underscores to pass through drupal_clean_css_identifier as per new CSS standards.