If a user enters a quotation mark into a custom block admin field, the field does not display in the app frontend.
Here's a stripped down version of my app, haven't tested if this actually works, this is just for demo purposes:
Vue.component('calculator', {
template: '<div class="my-calculator">' +
'<p>{{ introText }}</p>' +
'</div>',
props: ['introTextField', 'instanceId'],
mounted: function () {
// Create Vue variables out of user defined variables.
if (this.introTextField) { this.introText = this.introTextField; }
},
data: function () {
return {
introText: null,
}
},
methods: {
},
});
I followed the documentation to create a custom field in my .info.yml and set it up as a component.
configuration:
introTextField:
type: textarea
title: 'Intro text'
default_value: 'Default value text here.'I'd like to know if there's a way to sanitize the user input to remove quotation marks or convert them to html.
Fixed
Code
Not all content is available!
It's likely this issue predates Contrib.social: some issue and comment data are missing.
Issue #3180985: Sanitize block configuration input
Thanks for pointing this out. The values should now be escaped.
Automatically closed - issue fixed for 2 weeks with no activity.