Enforce escaping for dynamic content in views and templates

[giuscris]

This pull request focuses on improving the security and robustness of the application's views by ensuring that all dynamic content is properly escaped before being rendered. This helps prevent XSS (Cross-Site Scripting) vulnerabilities and ensures that special characters are handled correctly in both HTML and attribute contexts. The main changes are grouped below:

Security and Output Escaping Improvements:

• All dynamic page titles and status messages in panel and formwork error and layout views are now escaped using $this->escape() to prevent XSS attacks and ensure correct HTML rendering. (panel/views/errors/error.php, panel/views/layouts/login.php, panel/views/layouts/panel.php, formwork/views/errors/partials/header.php, site/templates/layouts/site.php) [1] [2] [3] [4] [5]
• Error details, headings, descriptions, and action labels in error views are now escaped, including throwable messages, headings, and descriptions, to further prevent the injection of malicious content. (panel/views/errors/error.php, formwork/views/errors/partials/debug.php) [1] [2]
• User role titles in the user profile are now escaped to avoid issues with special characters. (panel/views/users/profile.php)

Attribute Escaping:

• All dynamic content used in HTML attributes, such as alt attributes for images and data-* attributes for update status, is now escaped with $this->escapeAttr() to ensure valid and safe attribute values. (site/templates/blog.php, panel/views/tools/updates.php) [1] [2]

Minor Rendering Fixes:

• Changed how CodeDumper::dumpBacktraceFrame is called in error debug details to use a PHP block rather than outputting the return value directly, aligning with the intended usage. (panel/views/errors/error.php, formwork/views/errors/partials/debug.php) [1] [2]

These changes collectively harden the application's frontend against XSS and improve the reliability of rendered output.

[Copilot]

Pull request overview

This PR strengthens view/template rendering safety by consistently escaping dynamic output before it is inserted into HTML, reducing the risk of XSS and broken markup across the site, panel, and core error pages.

Changes:

• Escapes dynamic page titles, status strings, headings, and descriptions in multiple layouts and error views using $this->escape().
• Escapes dynamic content used in HTML attributes (e.g., alt, data-*) using $this->escapeAttr().
• Updates debug backtrace rendering to call CodeDumper::dumpBacktraceFrame() as a statement (matching its void/echoing behavior) rather than echoing a return value.

Reviewed changes

Copilot reviewed 9 out of 9 changed files in this pull request and generated 3 comments.

Show a summary per file

File	Description
site/templates/layouts/site.php	Escapes dynamic page/site titles in the <title> tag.
site/templates/blog.php	Switches image alt escaping to attribute context escaping.
panel/views/users/profile.php	Escapes user role title in profile display.
panel/views/tools/updates.php	Escapes translated strings when placed in data-* attributes.
panel/views/layouts/panel.php	Escapes dynamic panel page title segment.
panel/views/layouts/login.php	Escapes dynamic login page title segment.
panel/views/errors/error.php	Escapes error titles/messages and adjusts debug frame dumping call style.
formwork/views/errors/partials/header.php	Escapes dynamic error title/status text in the error header partial.
formwork/views/errors/partials/debug.php	Escapes throwable message and adjusts debug frame dumping call style.

---

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.