Summaries should not be decoded with Html::decodeEntities

Added issue fork, the current approach also allows it to work if the third party module happens to return a simple string rather than markup.

The module's implementation changed in the meantime:
$data['conditions'][$condition_id] = is_string($summary) ? Html::decodeEntities($summary) : Html::decodeEntities($summary->render());

Could the maintainer eventually explain why Html::decodeEntities() is used here at all?

I also can't really see a benefit, theoretically it's even more a risk:

Be careful when using this function, as it will revert previous sanitization efforts (<script> will become

).

There was a reason when the code was first written. I think it was something to do with the summary provided by one of the condition plugins not being compatible.

Looking at the git blame brings up this issue: 🐛 Calling ->render()on string throws errors Fixed .

But now looking at it, that is an issue with the condition_path module, not this module. However, it's doesn't appear to need to be decoded and leaving the summary un-rendered works fine.

So this seems appropriate to me.

Now that this issue is closed, please review the contribution record.

As a contributor, attribute any organization helped you, or if you volunteered your own time.

Maintainers, please credit people who helped resolve this issue.