Merge branch 'v3' of https://github.com/craftcms/cms into develop

# Conflicts:
#	src/fields/Table.php

CHANGELOG.md

@@ -4,8 +4,10 @@
 
 - Input autofocussing has been reintroduced thorughout the control panel. ([#12921](https://github.com/craftcms/cms/discussions/12921))
 - The `|json_encode` Twig filter now calls `craft\helpers\Json::encode()` internally, improving error handling. ([#12919](https://github.com/craftcms/cms/issues/12919))
+- `craft\helpers\Json::encode()` no longer sets the `JSON_UNESCAPED_SLASHES` flag by default.
 - Fixed a JavaScript error that occurred when resolving an asset move conflict. ([#12920](https://github.com/craftcms/cms/issues/12920))
 - Fixed an error that could occur when rebuilding the project config, if there were any custom source definitions for element types that weren’t Composer-installed. ([#12881](https://github.com/craftcms/cms/issues/12881))
+- Fixed an XSS vulnerability.
 
 ## 4.4.3 - 2023-03-16
 

src/fields/Matrix.php

@@ -399,8 +399,8 @@ public function getSettingsHtml(): ?string
         $placeholderKey = StringHelper::randomString(10);
         $view->registerJs(
             'new Craft.MatrixConfigurator(' .
-            Json::encode($fieldTypeInfo, JSON_UNESCAPED_UNICODE) . ', ' .
-            Json::encode($view->getNamespace(), JSON_UNESCAPED_UNICODE) . ', ' .
+            Json::encode($fieldTypeInfo) . ', ' .
+            Json::encode($view->getNamespace()) . ', ' .
             Json::encode($view->namespaceInputName("blockTypes[__BLOCK_TYPE_{$placeholderKey}__][fields][__FIELD_{$placeholderKey}__][typesettings]")) . ', ' .
             Json::encode($placeholderKey) .
             ');'
@@ -721,7 +721,7 @@ protected function inputHtml(mixed $value, ?ElementInterface $element = null): s
 
         $js = 'var matrixInput = new Craft.MatrixInput(' .
             '"' . $view->namespaceInputId($id) . '", ' .
-            Json::encode($blockTypeInfo, JSON_UNESCAPED_UNICODE) . ', ' .
+            Json::encode($blockTypeInfo) . ', ' .
             '"' . $view->namespaceInputName($this->handle) . '", ' .
             Json::encode($settings) .
             ');';

src/fields/Table.php

@@ -310,13 +310,13 @@ public function getSettingsHtml(): ?string
         $view->registerAssetBundle(TimepickerAsset::class);
         $view->registerAssetBundle(TableSettingsAsset::class);
         $view->registerJs('new Craft.TableFieldSettings(' .
-            Json::encode($view->namespaceInputName('columns'), JSON_UNESCAPED_UNICODE) . ', ' .
-            Json::encode($view->namespaceInputName('defaults'), JSON_UNESCAPED_UNICODE) . ', ' .
-            Json::encode($this->columns, JSON_UNESCAPED_UNICODE) . ', ' .
-            Json::encode($this->defaults ?? [], JSON_UNESCAPED_UNICODE) . ', ' .
-            Json::encode($columnSettings, JSON_UNESCAPED_UNICODE) . ', ' .
-            Json::encode($dropdownSettingsHtml, JSON_UNESCAPED_UNICODE) . ', ' .
-            Json::encode($dropdownSettingsCols, JSON_UNESCAPED_UNICODE) .
+            Json::encode($view->namespaceInputName('columns')) . ', ' .
+            Json::encode($view->namespaceInputName('defaults')) . ', ' .
+            Json::encode($this->columns) . ', ' .
+            Json::encode($this->defaults ?? []) . ', ' .
+            Json::encode($columnSettings) . ', ' .
+            Json::encode($dropdownSettingsHtml) . ', ' .
+            Json::encode($dropdownSettingsCols) .
             ');');
 
         $columnsField = $view->renderTemplate('_components/fieldtypes/Table/columntable.twig', [

src/helpers/Json.php

@@ -30,6 +30,15 @@ public static function isJsonObject(string $str): bool
         return (bool)preg_match('/^(?:\{.*\}|\[.*\])$/s', $str);
     }
 
+    /**
+     * @inheritdoc
+     * @param int $options The encoding options. `JSON_UNESCAPED_UNICODE` is used by default.
+     */
+    public static function encode($value, $options = JSON_UNESCAPED_UNICODE)
+    {
+        return parent::encode($value, $options);
+    }
+
     /**
      * Decodes the given JSON string into a PHP data structure, only if the string is valid JSON.
      *

src/web/assets/cp/CpAsset.php

@@ -101,7 +101,7 @@ public function registerAssetFiles($view): void
         }
 
         // Define the Craft object
-        $craftJson = Json::encode($this->_craftData(), JSON_UNESCAPED_UNICODE);
+        $craftJson = Json::encode($this->_craftData());
         $js = <<<JS
 window.Craft = $craftJson;
 JS;