diff --git a/src/Enhavo/Bundle/ArticleBundle/Resources/views/theme/resource/article/list.html.twig b/src/Enhavo/Bundle/ArticleBundle/Resources/views/theme/resource/article/list.html.twig index 7c0fe728a..fdaa85189 100644 --- a/src/Enhavo/Bundle/ArticleBundle/Resources/views/theme/resource/article/list.html.twig +++ b/src/Enhavo/Bundle/ArticleBundle/Resources/views/theme/resource/article/list.html.twig @@ -7,7 +7,7 @@
{{ resource.publicationDate|date('d.m.y') }}
{{ resource.title }}
-
{{ resource.teaser|raw }}
+
{{ resource.teaser|html_sanitize }}
{# Read more#}
diff --git a/src/Enhavo/Bundle/FormBundle/Tests/Twig/FormatExtensionTest.php b/src/Enhavo/Bundle/FormBundle/Tests/Twig/FormatExtensionTest.php index dc380bb2f..ff37fc53a 100644 --- a/src/Enhavo/Bundle/FormBundle/Tests/Twig/FormatExtensionTest.php +++ b/src/Enhavo/Bundle/FormBundle/Tests/Twig/FormatExtensionTest.php @@ -11,6 +11,10 @@ class HtmlSanitizerTest extends TestCase public function testFormatHeadline() { $sanitizer = $this->getMockBuilder(HtmlSanitizer::class)->disableOriginalConstructor()->getMock(); + $sanitizer->expects($this->atLeast(1))->method('sanitize')->willReturnCallback(function ($value) { + return $value; + }); + $extension = new FormatExtension($sanitizer); $this->assertEquals( diff --git a/src/Enhavo/Bundle/FormBundle/Twig/FormatExtension.php b/src/Enhavo/Bundle/FormBundle/Twig/FormatExtension.php index 35f54b754..9e8d7d67f 100644 --- a/src/Enhavo/Bundle/FormBundle/Twig/FormatExtension.php +++ b/src/Enhavo/Bundle/FormBundle/Twig/FormatExtension.php @@ -78,12 +78,14 @@ public function formatHeadline($value, $class = '', array $attributes = []) $pattern = '/^<([a-zA-Z0-9-]+)>/'; if(preg_match($pattern, $value)) { - return preg_replace_callback($pattern, function($matches) use ($attribute) { + $content = preg_replace_callback($pattern, function($matches) use ($attribute) { return sprintf('<%s%s>', $matches[1], $attribute); }, $value); } else { - return sprintf('%s', $attribute, $value); + $content = sprintf('%s', $attribute, $value); } + + return $this->sanitizer->sanitize($content); } public function sanitizeHtml($value, $options = []) diff --git a/src/Enhavo/Bundle/SearchBundle/Resources/views/admin/search/result.html.twig b/src/Enhavo/Bundle/SearchBundle/Resources/views/admin/search/result.html.twig index 32dda8454..dd02a6927 100644 --- a/src/Enhavo/Bundle/SearchBundle/Resources/views/admin/search/result.html.twig +++ b/src/Enhavo/Bundle/SearchBundle/Resources/views/admin/search/result.html.twig @@ -5,8 +5,8 @@
-

{{ item.resource.title|raw }}

- {{ item.highlightedText|raw }} +

{{ item.resource.title|html_sanitize }}

+ {{ item.highlightedText|html_sanitize }}
diff --git a/src/Enhavo/Bundle/SearchBundle/Resources/views/theme/search/result.html.twig b/src/Enhavo/Bundle/SearchBundle/Resources/views/theme/search/result.html.twig index 80d7c02d8..83b45135e 100644 --- a/src/Enhavo/Bundle/SearchBundle/Resources/views/theme/search/result.html.twig +++ b/src/Enhavo/Bundle/SearchBundle/Resources/views/theme/search/result.html.twig @@ -11,7 +11,7 @@

{{ result.title }}

- {{ result.text|raw }} + {{ result.text|html_sanitize }} {{ result.title }}
diff --git a/src/Enhavo/Bundle/SliderBundle/Resources/views/theme/widget/slider.html.twig b/src/Enhavo/Bundle/SliderBundle/Resources/views/theme/widget/slider.html.twig index 6ae51c81d..dbb4cf597 100644 --- a/src/Enhavo/Bundle/SliderBundle/Resources/views/theme/widget/slider.html.twig +++ b/src/Enhavo/Bundle/SliderBundle/Resources/views/theme/widget/slider.html.twig @@ -8,7 +8,7 @@ {% endif %} -

{{ slide.text|raw }}

+

{{ slide.text|html_sanitize }}

{{ slide.title }}