Fixed pages field escaping issues, needs admin update, too

getgrav · Dec 9, 2020 · db24d3e · db24d3e
1 parent 29bcbf0
commit db24d3e
Show file tree

Hide file tree

Showing 2 changed files with 9 additions and 3 deletions.
diff --git a/CHANGELOG.md b/CHANGELOG.md
@@ -1,3 +1,9 @@
+# v1.6.31
+## mm/dd/2020
+
+1. [](#bugfix)
+    * Fixed `pages` field escaping issues, needs admin update, too [admin#1990](https://github.com/getgrav/grav-plugin-admin/issues/1990)
+
 # v1.6.30
 ## 12/03/2020
 

diff --git a/system/src/Grav/Common/Page/Pages.php b/system/src/Grav/Common/Page/Pages.php
@@ -688,7 +688,7 @@ private static function getParents($rawRoutes)
     }
 
     /**
-     * Get list of route/title of all pages.
+     * Get list of route/title of all pages. Title is in HTML.
      *
      * @param PageInterface $current
      * @param int $level
@@ -721,10 +721,10 @@ public function getList(PageInterface $current = null, $level = 0, $rawRoutes =
             }
 
             if ($showFullpath) {
-                $option = $current->route();
+                $option = htmlspecialchars($current->route());
             } else {
                 $extra  = $showSlug ? '(' . $current->slug() . ') ' : '';
-                $option = str_repeat('&mdash;-', $level). '&rtrif; ' . $extra . $current->title();
+                $option = str_repeat('&mdash;-', $level). '&rtrif; ' . $extra . htmlspecialchars($current->title());
 
 
             }