Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom

[Grid] Escape values of the string field type #4910

Merged
merged 1 commit into from Apr 29, 2016
Merged

[Grid] Escape values of the string field type #4910

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
1 commit
Select commit
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Jump to
Jump to file
Failed to load files.
Diff view
Diff view
4 changes: 3 additions & 1 deletion src/Sylius/Component/Grid/FieldTypes/StringFieldType.php
View file
Open in desktop
Expand Up @@ -37,7 +37,9 @@ public function __construct(DataExtractorInterface $dataExtractor)
*/
public function render(Field $field, $data)
{
return $this->dataExtractor->get($field, $data);
$value = $this->dataExtractor->get($field, $data);

return is_string($value) ? htmlspecialchars($value) : $value;
}

/**
Expand Down
16 changes: 15 additions & 1 deletion src/Sylius/Component/Grid/spec/FieldTypes/StringFieldTypeSpec.php
View file
Open in desktop
Expand Up @@ -45,7 +45,21 @@ function it_uses_data_extractor_to_obtain_data_and_renders_it(DataExtractorInter
$dataExtractor->get($field, ['foo' => 'bar'])->willReturn('Value');
$this->render($field, ['foo' => 'bar'])->shouldReturn('Value');
}


function it_escapes_string_values(DataExtractorInterface $dataExtractor, Field $field)
{
$dataExtractor->get($field, ['foo' => 'bar'])->willReturn('<i class="book icon"></i>');
$this->render($field, ['foo' => 'bar'])->shouldReturn('&lt;i class=&quot;book icon&quot;&gt;&lt;/i&gt;');
}

function it_does_not_escape_non_string_values(DataExtractorInterface $dataExtractor, Field $field)
{
$data = new \stdClass();

$dataExtractor->get($field, ['foo' => 'bar'])->willReturn($data);
$this->render($field, ['foo' => 'bar'])->shouldReturn($data);
}

function it_has_name()
{
$this->getName()->shouldReturn('string');
Expand Down