Enforce escaping for dynamic content in views and templates - #920
Merged
Conversation
Contributor
There was a problem hiding this comment.
Pull request overview
This PR strengthens view/template rendering safety by consistently escaping dynamic output before it is inserted into HTML, reducing the risk of XSS and broken markup across the site, panel, and core error pages.
Changes:
- Escapes dynamic page titles, status strings, headings, and descriptions in multiple layouts and error views using
$this->escape(). - Escapes dynamic content used in HTML attributes (e.g.,
alt,data-*) using$this->escapeAttr(). - Updates debug backtrace rendering to call
CodeDumper::dumpBacktraceFrame()as a statement (matching itsvoid/echoing behavior) rather than echoing a return value.
Reviewed changes
Copilot reviewed 9 out of 9 changed files in this pull request and generated 3 comments.
Show a summary per file
| File | Description |
|---|---|
| site/templates/layouts/site.php | Escapes dynamic page/site titles in the <title> tag. |
| site/templates/blog.php | Switches image alt escaping to attribute context escaping. |
| panel/views/users/profile.php | Escapes user role title in profile display. |
| panel/views/tools/updates.php | Escapes translated strings when placed in data-* attributes. |
| panel/views/layouts/panel.php | Escapes dynamic panel page title segment. |
| panel/views/layouts/login.php | Escapes dynamic login page title segment. |
| panel/views/errors/error.php | Escapes error titles/messages and adjusts debug frame dumping call style. |
| formwork/views/errors/partials/header.php | Escapes dynamic error title/status text in the error header partial. |
| formwork/views/errors/partials/debug.php | Escapes throwable message and adjusts debug frame dumping call style. |
💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
This pull request focuses on improving the security and robustness of the application's views by ensuring that all dynamic content is properly escaped before being rendered. This helps prevent XSS (Cross-Site Scripting) vulnerabilities and ensures that special characters are handled correctly in both HTML and attribute contexts. The main changes are grouped below:
Security and Output Escaping Improvements:
panelandformworkerror and layout views are now escaped using$this->escape()to prevent XSS attacks and ensure correct HTML rendering. (panel/views/errors/error.php,panel/views/layouts/login.php,panel/views/layouts/panel.php,formwork/views/errors/partials/header.php,site/templates/layouts/site.php) [1] [2] [3] [4] [5]panel/views/errors/error.php,formwork/views/errors/partials/debug.php) [1] [2]panel/views/users/profile.php)Attribute Escaping:
altattributes for images anddata-*attributes for update status, is now escaped with$this->escapeAttr()to ensure valid and safe attribute values. (site/templates/blog.php,panel/views/tools/updates.php) [1] [2]Minor Rendering Fixes:
CodeDumper::dumpBacktraceFrameis called in error debug details to use a PHP block rather than outputting the return value directly, aligning with the intended usage. (panel/views/errors/error.php,formwork/views/errors/partials/debug.php) [1] [2]These changes collectively harden the application's frontend against XSS and improve the reliability of rendered output.