Test 48066: Fix Unescaped HTML In Kiosk View - #11880
Merged
Merged
Conversation
See: https://mantis.ilias.de/view.php?id=48066 The participant name in the test kiosk title was inserted as raw HTML, which could break rendering when the name contained special characters. The value is now escaped and passed via a legacy UI component.
Contributor
Author
|
Hello @kergomard , could you please take a look at the changes and review them? Thank you in advance. Best regards |
kergomard
approved these changes
Aug 10, 2026
Contributor
|
Merged and picked to ILIAS 11 and trunk. |
Contributor
|
Thanks for your work on this! Though, pardon me, but has this code ever been tested? See #11918 for a suggested addition to the fix. |
phntxx
pushed a commit
to ur-campus-it/ILIAS
that referenced
this pull request
Aug 14, 2026
The commit with the fix for <https://mantis.ilias.de/view.php?id=48066> contains an issue: it misses a method call in the chain, thereby passing a string to a factory getter (which is ignored as it is not expected), and passing that factory on instead of a UI component that should be used. Properly obtain the Legacy factory. Then call the appropriate method on it which converts an HTML snippet (as string) to a UI component which can be included in the UI component for the title. See the API documentation for method “content” in ILIAS\UI\Component\Legacy\Factory for why this is chosen. Fixes-Mantis-Issue: https://mantis.ilias.de/view.php?id=48066 Fixes-Mantis-Issue: https://mantis.ilias.de/view.php?id=48174 Fixes-Pull-Request: ILIAS-eLearning#11880 Fixes-Commit: 76f84ae Fixes-Commit: d2b2b7e
kergomard
pushed a commit
that referenced
this pull request
Aug 17, 2026
The commit with the fix for <https://mantis.ilias.de/view.php?id=48066> contains an issue: it misses a method call in the chain, thereby passing a string to a factory getter (which is ignored as it is not expected), and passing that factory on instead of a UI component that should be used. Properly obtain the Legacy factory. Then call the appropriate method on it which converts an HTML snippet (as string) to a UI component which can be included in the UI component for the title. See the API documentation for method “content” in ILIAS\UI\Component\Legacy\Factory for why this is chosen. Fixes-Mantis-Issue: https://mantis.ilias.de/view.php?id=48066 Fixes-Mantis-Issue: https://mantis.ilias.de/view.php?id=48174 Fixes-Pull-Request: #11880 Fixes-Commit: 76f84ae Fixes-Commit: d2b2b7e
kergomard
pushed a commit
that referenced
this pull request
Aug 17, 2026
The commit with the fix for <https://mantis.ilias.de/view.php?id=48066> contains an issue: it misses a method call in the chain, thereby passing a string to a factory getter (which is ignored as it is not expected), and passing that factory on instead of a UI component that should be used. Properly obtain the Legacy factory. Then call the appropriate method on it which converts an HTML snippet (as string) to a UI component which can be included in the UI component for the title. See the API documentation for method “content” in ILIAS\UI\Component\Legacy\Factory for why this is chosen. Fixes-Mantis-Issue: https://mantis.ilias.de/view.php?id=48066 Fixes-Mantis-Issue: https://mantis.ilias.de/view.php?id=48174 Fixes-Pull-Request: #11880 Fixes-Commit: 76f84ae Fixes-Commit: d2b2b7e
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
5 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
See: https://mantis.ilias.de/view.php?id=48066
The participant name in the test kiosk title was inserted as raw HTML, which could break rendering when the name contained special characters. The value is now escaped and passed via a legacy UI component.
/cc @thojou