e107inc#4572: e_form: No htmlspecialchars() on "other" attributes

Fixes: e107inc#4572 Discussion: e107inc#4554 (comment)
Deltik · Sep 23, 2021 · 45bce2a · 45bce2a
1 parent 171cac8
commit 45bce2a
Show file tree

Hide file tree

Showing 2 changed files with 21 additions and 2 deletions.
diff --git a/e107_handlers/form_handler.php b/e107_handlers/form_handler.php
@@ -3907,7 +3907,10 @@ public function get_attributes($options, $name = '', $value = '')
 		//
 		foreach ($options as $option => $optval)
 		{
-			$optval = htmlspecialchars(trim((string) $optval),  ENT_COMPAT | ENT_HTML401, 'UTF-8', false);
+			if ($option !== 'other')
+			{
+				$optval = htmlspecialchars(trim((string) $optval),  ENT_COMPAT | ENT_HTML401, 'UTF-8', false);
+			}
 			switch ($option)
 			{
 

diff --git a/e107_tests/tests/unit/e_formTest.php b/e107_tests/tests/unit/e_formTest.php
@@ -867,6 +867,22 @@ public function testGet_attributes()
 
 				$this->assertSame($expected, $actual);
 			}
+
+			/**
+			 * @link https://github.com/e107inc/e107/issues/4572
+			 */
+			public function testGet_attributesOther()
+			{
+				$options = array(
+					'size'  => '300px',
+					'other' => 'v-bind:class="{ active: isActive }"',
+				);
+
+				$actual = $this->_frm->get_attributes($options);
+				$expected = ' size=\'300px\' v-bind:class="{ active: isActive }"';
+
+				$this->assertSame($expected, $actual);
+			}
 /*
 			public function test_format_id()
 			{
@@ -879,7 +895,7 @@ public function testName2id()
 				$expected   = 'something-hello-there-and-test';
 
 				$result = $this->_frm->name2id($text);
-				
+
 				$this->assertEquals($expected, $result);
 			}
 /*