- πΊπΈUnited States tr Cascadia
I guess my question is why is rendered HTML content being passed to
vap_num()
?function views_aggregator_get_cell($field_handler, $row_num, $rendered = FALSE)
When we use
vap_num()
, we use it like this:
vap_num(views_aggregator_get_cell($field_handler, $num, FALSE));
That is, we pass the NON-rendered cell content tovap_num()
.So is the problem really with
views_aggregator_get_cell()
?The proposed solution feels like a hack, which just strips HTML comments and not other HTML tags - if comments are coming through shouldn't we be concerned with any other HTML as well?
Regardless, the only argument to
vap_num()
is "A string representatin of a double-precision floating point number.", so the problem really is that some code is passing in invalid data, because HTML comments have no business being passed in the first place.If we want to validate the argument as a double-precision floating point number, then PHP provides i
s_float()
andis_double()
methods. We should validate the argument invap_num()
, but if an invalid argument is passed in that's the fault of the calling code. - π§πͺBelgium seutje Antwerp
Yes, you are correct.
I noticed the issue when using a views_simple_math_field to multiply a price per piece with an amount and then create a sum of this multiplication. The user can create products, which have a price per piece and they can then reference these products in an order, adding an amount. I created an overview table to see the total price per order.
The issue occurs in views_aggregator/src/Plugin/views/style/Table.php on line 653, where!in_array($field_handler->getProvider(), ['views', 'webform_views'])
evaluates toTRUE
. So it seems like it assumes that any field not provided by Views or Webform Views should be rendered before being passed tovap_num
, even when the$rendered
parameter is set toFALSE
, which would seem like a bit of a wild assumption.