PHP Xss::filterAdmin方法代码示例

 /**
  * Tests the integration.
  */
 public function testIntegration()
 {
     // Remove the watchdog entries added by the potential batch process.
     $this->container->get('database')->truncate('watchdog')->execute();
     $entries = array();
     // Setup a watchdog entry without tokens.
     $entries[] = array('message' => $this->randomMachineName(), 'variables' => array('link' => \Drupal::l('Link', new Url('<front>'))));
     // Setup a watchdog entry with one token.
     $entries[] = array('message' => '@token1', 'variables' => array('@token1' => $this->randomMachineName(), 'link' => \Drupal::l('Link', new Url('<front>'))));
     // Setup a watchdog entry with two tokens.
     $entries[] = array('message' => '@token1 !token2', 'variables' => array('@token1' => $this->randomMachineName(), '!token2' => $this->randomMachineName(), 'link' => \Drupal::l(SafeMarkup::set('<object>Link</object>'), new Url('<front>'))));
     $logger_factory = $this->container->get('logger.factory');
     foreach ($entries as $entry) {
         $entry += array('type' => 'test-views', 'severity' => RfcLogLevel::NOTICE);
         $logger_factory->get($entry['type'])->log($entry['severity'], $entry['message'], $entry['variables']);
     }
     $view = Views::getView('test_dblog');
     $this->executeView($view);
     $view->initStyle();
     foreach ($entries as $index => $entry) {
         $this->assertEqual($view->style_plugin->getField($index, 'message'), SafeMarkup::format($entry['message'], $entry['variables']));
         $this->assertEqual($view->style_plugin->getField($index, 'link'), Xss::filterAdmin($entry['variables']['link']));
     }
     // Disable replacing variables and check that the tokens aren't replaced.
     $view->destroy();
     $view->storage->invalidateCaches();
     $view->initHandlers();
     $this->executeView($view);
     $view->initStyle();
     $view->field['message']->options['replace_variables'] = FALSE;
     foreach ($entries as $index => $entry) {
         $this->assertEqual($view->style_plugin->getField($index, 'message'), $entry['message']);
     }
 }

 /**
  * Tests the generation of all system site information tokens.
  */
 public function testSystemSiteTokenReplacement()
 {
     $url_options = array('absolute' => TRUE, 'language' => $this->interfaceLanguage);
     $slogan = '<blink>Slogan</blink>';
     $safe_slogan = Xss::filterAdmin($slogan);
     // Set a few site variables.
     $config = $this->config('system.site');
     $config->set('name', '<strong>Drupal<strong>')->set('slogan', $slogan)->set('mail', 'simpletest@example.com')->save();
     // Generate and test tokens.
     $tests = array();
     $tests['[site:name]'] = Html::escape($config->get('name'));
     $tests['[site:slogan]'] = $safe_slogan;
     $tests['[site:mail]'] = $config->get('mail');
     $tests['[site:url]'] = \Drupal::url('<front>', [], $url_options);
     $tests['[site:url-brief]'] = preg_replace(array('!^https?://!', '!/$!'), '', \Drupal::url('<front>', [], $url_options));
     $tests['[site:login-url]'] = \Drupal::url('user.page', [], $url_options);
     $base_bubbleable_metadata = new BubbleableMetadata();
     $metadata_tests = [];
     $metadata_tests['[site:name]'] = BubbleableMetadata::createFromObject(\Drupal::config('system.site'));
     $metadata_tests['[site:slogan]'] = BubbleableMetadata::createFromObject(\Drupal::config('system.site'));
     $metadata_tests['[site:mail]'] = BubbleableMetadata::createFromObject(\Drupal::config('system.site'));
     $bubbleable_metadata = clone $base_bubbleable_metadata;
     $metadata_tests['[site:url]'] = $bubbleable_metadata->addCacheContexts(['url.site']);
     $metadata_tests['[site:url-brief]'] = $bubbleable_metadata;
     $metadata_tests['[site:login-url]'] = $bubbleable_metadata;
     // Test to make sure that we generated something for each token.
     $this->assertFalse(in_array(0, array_map('strlen', $tests)), 'No empty tokens generated.');
     foreach ($tests as $input => $expected) {
         $bubbleable_metadata = new BubbleableMetadata();
         $output = $this->tokenService->replace($input, array(), array('langcode' => $this->interfaceLanguage->getId()), $bubbleable_metadata);
         $this->assertEqual($output, $expected, new FormattableMarkup('System site information token %token replaced.', ['%token' => $input]));
         $this->assertEqual($bubbleable_metadata, $metadata_tests[$input]);
     }
 }

 /**
  * {@inheritdoc}
  */
 public function buildRow(EntityInterface $entity)
 {
     $row = array();
     $row['title'] = array('data' => $this->getLabel($entity), 'class' => array('menu-label'));
     $row['description'] = Xss::filterAdmin($entity->description);
     return $row + parent::buildRow($entity);
 }

 /**
  * Redirects on 403 Access Denied kernel exceptions.
  *
  * @param \Symfony\Component\HttpKernel\Event\GetResponseEvent $event
  *   The Event to process.
  */
 public function onKernelException(GetResponseEvent $event)
 {
     $exception = $event->getException();
     if (!$exception instanceof AccessDeniedHttpException) {
         return;
     }
     $config = $this->configFactory->get('r4032login.settings');
     $options = array();
     $options['query'] = $this->redirectDestination->getAsArray();
     $options['absolute'] = TRUE;
     $code = $config->get('default_redirect_code');
     if ($this->currentUser->isAnonymous()) {
         // Show custom access denied message if set.
         if ($config->get('display_denied_message')) {
             $message = $config->get('access_denied_message');
             $message_type = $config->get('access_denied_message_type');
             drupal_set_message(Xss::filterAdmin($message), $message_type);
         }
         // Handle redirection to the login form.
         $login_route = $config->get('user_login_route');
         $url = Url::fromRoute($login_route, array(), $options)->toString();
         $response = new RedirectResponse($url, $code);
         $event->setResponse($response);
     } else {
         // Check to see if we are to redirect the user.
         $redirect = $config->get('redirect_authenticated_users_to');
         if ($redirect) {
             // Custom access denied page for logged in users.
             $url = Url::fromUserInput($redirect, $options)->toString();
             $response = new RedirectResponse($url, $code);
             $event->setResponse($response);
         }
     }
 }

 /**
  * Overrides \Drupal\views\Plugin\views\style\StylePluginBase\StylePluginBase::render().
  */
 public function render()
 {
     if (!empty($this->view->live_preview)) {
         return parent::render();
     }
     // Group the rows according to the grouping field, if specified.
     $sets = $this->renderGrouping($this->view->result, $this->options['grouping']);
     // Grab the alias of the 'id' field added by
     // entity_reference_plugin_display.
     $id_field_alias = $this->view->storage->get('base_field');
     // @todo We don't display grouping info for now. Could be useful for select
     // widget, though.
     $results = array();
     $this->view->row_index = 0;
     foreach ($sets as $records) {
         foreach ($records as $values) {
             // Sanitize HTML, remove line breaks and extra whitespace.
             $output = $this->view->rowPlugin->render($values);
             $output = drupal_render($output);
             $results[$values->{$id_field_alias}] = Xss::filterAdmin(preg_replace('/\\s\\s+/', ' ', str_replace("\n", '', $output)));
             $this->view->row_index++;
         }
     }
     unset($this->view->row_index);
     return $results;
 }

 /**
  * {@inheritdoc}
  */
 public function completeSale($order, $login = FALSE)
 {
     // Empty that cart...
     $this->emptyCart();
     // Force the order to load from the DB instead of the entity cache.
     // @todo Remove this once uc_payment_enter() can modify order objects?
     // @todo Should we be overwriting $order with this newly-loaded db_order?
     $db_order = $this->entityManager()->getStorage('uc_order')->loadUnchanged($order->id());
     $order->data = $db_order->data;
     // Ensure that user creation and triggers are only run once.
     if (empty($order->data->complete_sale)) {
         $this->completeSaleAccount($order);
         // Move an order's status from "In checkout" to "Pending".
         if ($order->getStateId() == 'in_checkout') {
             $order->setStatusId(uc_order_state_default('post_checkout'));
         }
         $order->save();
         // Invoke the checkout complete trigger and hook.
         $account = $order->getUser();
         $this->moduleHandler()->invokeAll('uc_checkout_complete', array($order, $account));
         // rules_invoke_event('uc_checkout_complete', $order);
     }
     $type = $order->data->complete_sale;
     // Log in new users, if requested.
     if ($type == 'new_user' && $login && $this->currentUser()->isAnonymous()) {
         $type = 'new_user_logged_in';
         user_login_finalize($order->getUser());
     }
     $message = $this->config('uc_cart.messages')->get($type);
     $message = \Drupal::token()->replace($message, array('uc_order' => $order));
     $variables['!new_username'] = isset($order->data->new_user_name) ? $order->data->new_user_name : '';
     $variables['!new_password'] = isset($order->password) ? $order->password : t('Your password');
     $message = strtr($message, $variables);
     return array('#theme' => 'uc_cart_complete_sale', '#message' => Xss::filterAdmin($message), '#order' => $order);
 }

 /**
  * Tests the integration.
  */
 public function testIntegration()
 {
     // Remove the watchdog entries added by the potential batch process.
     $this->container->get('database')->truncate('watchdog')->execute();
     $entries = array();
     // Setup a watchdog entry without tokens.
     $entries[] = array('message' => $this->randomMachineName(), 'variables' => array(), 'link' => l('Link', 'node/1'));
     // Setup a watchdog entry with one token.
     $entries[] = array('message' => '@token1', 'variables' => array('@token1' => $this->randomMachineName()), 'link' => l('Link', 'node/2'));
     // Setup a watchdog entry with two tokens.
     $entries[] = array('message' => '@token1 !token2', 'variables' => array('@token1' => $this->randomMachineName(), '!token2' => $this->randomMachineName()), 'link' => l('<object>Link</object>', 'node/2', array('html' => TRUE)));
     foreach ($entries as $entry) {
         $entry += array('type' => 'test-views', 'severity' => WATCHDOG_NOTICE);
         watchdog($entry['type'], $entry['message'], $entry['variables'], $entry['severity'], $entry['link']);
     }
     $view = Views::getView('test_dblog');
     $this->executeView($view);
     $view->initStyle();
     foreach ($entries as $index => $entry) {
         $this->assertEqual($view->style_plugin->getField($index, 'message'), String::format($entry['message'], $entry['variables']));
         $this->assertEqual($view->style_plugin->getField($index, 'link'), Xss::filterAdmin($entry['link']));
     }
     // Disable replacing variables and check that the tokens aren't replaced.
     $view->destroy();
     $view->initHandlers();
     $this->executeView($view);
     $view->initStyle();
     $view->field['message']->options['replace_variables'] = FALSE;
     foreach ($entries as $index => $entry) {
         $this->assertEqual($view->style_plugin->getField($index, 'message'), $entry['message']);
     }
 }

 /**
  * {@inheritdoc}
  */
 public function execute($entity = NULL)
 {
     if (empty($this->configuration['node'])) {
         $this->configuration['node'] = $entity;
     }
     $message = $this->token->replace(Xss::filterAdmin($this->configuration['message']), $this->configuration);
     drupal_set_message($message);
 }

 /**
  * {@inheritdoc}
  */
 public function view(OrderInterface $order, array $form, FormStateInterface $form_state)
 {
     $contents['#description'] = Xss::filterAdmin(\Drupal::config('uc_quote.settings')->get('pane_description'));
     $contents['#attached']['library'][] = 'uc_quote/uc_quote.styles';
     $contents['uid'] = array('#type' => 'hidden', '#value' => \Drupal::currentUser()->id());
     $contents['quote_button'] = array('#type' => 'submit', '#value' => t('Click to calculate shipping'), '#submit' => [[$this, 'paneSubmit']], '#weight' => 0, '#ajax' => array('effect' => 'slide', 'progress' => array('type' => 'bar', 'message' => t('Receiving quotes...'))), '#limit_validation_errors' => array());
     $contents['quotes'] = array('#tree' => TRUE, '#prefix' => '<div id="quote">', '#suffix' => '</div>', '#weight' => 1);
     $contents['quotes'] += $order->quote_form;
     $form_state->set(['uc_ajax', 'uc_quote', 'panes][quotes][quote_button'], array('payment-pane' => 'uc_ajax_replace_checkout_pane', 'quotes-pane' => 'uc_ajax_replace_checkout_pane'));
     $form_state->set(['uc_ajax', 'uc_quote', 'panes][quotes][quotes][quote_option'], array('payment-pane' => 'uc_ajax_replace_checkout_pane'));
     return $contents;
 }

/**
 * Pre-processes variables for the "bootstrap_panel" theme hook.
 *
 * See template for list of available variables.
 *
 * @see bootstrap-panel.html.twig
 *
 * @ingroup theme_preprocess
 */
function bootstrap_preprocess_bootstrap_panel(&$variables)
{
    $element = $variables['element'];
    Element::setAttributes($element, array('id'));
    Element\RenderElement::setAttributes($element);
    $variables['attributes'] = $element['#attributes'];
    $variables['prefix'] = isset($element['#field_prefix']) ? $element['#field_prefix'] : NULL;
    $variables['suffix'] = isset($element['#field_suffix']) ? $element['#field_suffix'] : NULL;
    $variables['title_display'] = isset($element['#title_display']) ? $element['#title_display'] : NULL;
    $variables['children'] = $element['#children'];
    $variables['required'] = !empty($element['#required']) ? $element['#required'] : NULL;
    $variables['legend']['title'] = !empty($element['#title']) ? Xss::filterAdmin($element['#title']) : '';
    $variables['legend']['attributes'] = new Attribute();
    $variables['legend_span']['attributes'] = new Attribute();
    if (!empty($element['#description'])) {
        $description_id = $element['#attributes']['id'] . '--description';
        $description_attributes['id'] = $description_id;
        $variables['description']['attributes'] = new Attribute($description_attributes);
        $variables['description']['content'] = $element['#description'];
        // Add the description's id to the fieldset aria attributes.
        $variables['attributes']['aria-describedby'] = $description_id;
    }
    $variables['collapsible'] = FALSE;
    if (isset($element['#collapsible'])) {
        $variables['collapsible'] = $element['#collapsible'];
        $variables['attributes']['class'][] = 'collapsible';
    }
    $variables['collapsed'] = FALSE;
    if (isset($element['#collapsed'])) {
        $variables['collapsed'] = $element['#collapsed'];
    }
    // Force grouped fieldsets to not be collapsible (for vertical tabs).
    if (!empty($element['#group'])) {
        $variables['collapsible'] = FALSE;
        $variables['collapsed'] = FALSE;
    }
    if (!isset($element['#id']) && $variables['collapsible']) {
        $element['#id'] = \Drupal\Component\Utility\Html::getUniqueId('bootstrap-panel');
    }
    $variables['target'] = NULL;
    if (isset($element['#id'])) {
        if (!isset($variables['attributes']['id'])) {
            $variables['attributes']['id'] = $element['#id'];
        }
        $variables['target'] = '#' . $element['#id'] . ' > .collapse';
    }
    // Iterate over optional variables.
    $keys = array('description', 'prefix', 'suffix', 'title', 'value');
    foreach ($keys as $key) {
        $variables[$key] = !empty($element["#{$key}"]) ? $element["#{$key}"] : FALSE;
    }
}

 /**
  * Tests the generation of all system site information tokens.
  */
 public function testSystemSiteTokenReplacement()
 {
     // The use of the \Drupal::url() method requires the url_alias table to exist.
     $this->installSchema('system', 'url_alias');
     $url_options = array('absolute' => TRUE, 'language' => $this->interfaceLanguage);
     $slogan = '<blink>Slogan</blink>';
     $safe_slogan = Xss::filterAdmin($slogan);
     // Set a few site variables.
     $config = $this->config('system.site');
     $config->set('name', '<strong>Drupal<strong>')->set('slogan', $slogan)->set('mail', 'simpletest@example.com')->save();
     // Generate and test sanitized tokens.
     $tests = array();
     $tests['[site:name]'] = SafeMarkup::checkPlain($config->get('name'));
     $tests['[site:slogan]'] = $safe_slogan;
     $tests['[site:mail]'] = $config->get('mail');
     $tests['[site:url]'] = \Drupal::url('<front>', [], $url_options);
     $tests['[site:url-brief]'] = preg_replace(array('!^https?://!', '!/$!'), '', \Drupal::url('<front>', [], $url_options));
     $tests['[site:login-url]'] = \Drupal::url('user.page', [], $url_options);
     $base_bubbleable_metadata = new BubbleableMetadata();
     $metadata_tests = [];
     $metadata_tests['[site:name]'] = BubbleableMetadata::createFromObject(\Drupal::config('system.site'));
     $metadata_tests['[site:slogan]'] = BubbleableMetadata::createFromObject(\Drupal::config('system.site'));
     $metadata_tests['[site:mail]'] = BubbleableMetadata::createFromObject(\Drupal::config('system.site'));
     $bubbleable_metadata = clone $base_bubbleable_metadata;
     $metadata_tests['[site:url]'] = $bubbleable_metadata->addCacheContexts(['url.site']);
     $metadata_tests['[site:url-brief]'] = $bubbleable_metadata;
     $metadata_tests['[site:login-url]'] = $bubbleable_metadata;
     // Test to make sure that we generated something for each token.
     $this->assertFalse(in_array(0, array_map('strlen', $tests)), 'No empty tokens generated.');
     foreach ($tests as $input => $expected) {
         $bubbleable_metadata = new BubbleableMetadata();
         $output = $this->tokenService->replace($input, array(), array('langcode' => $this->interfaceLanguage->getId()), $bubbleable_metadata);
         $this->assertEqual($output, $expected, format_string('Sanitized system site information token %token replaced.', array('%token' => $input)));
         $this->assertEqual($bubbleable_metadata, $metadata_tests[$input]);
     }
     // Generate and test unsanitized tokens.
     $tests['[site:name]'] = $config->get('name');
     $tests['[site:slogan]'] = $config->get('slogan');
     foreach ($tests as $input => $expected) {
         $output = $this->tokenService->replace($input, array(), array('langcode' => $this->interfaceLanguage->getId(), 'sanitize' => FALSE), $bubbleable_metadata);
         $this->assertEqual($output, $expected, format_string('Unsanitized system site information token %token replaced.', array('%token' => $input)));
     }
     // Check that the results of Token::generate are sanitized properly. This
     // does NOT test the cleanliness of every token -- just that the $sanitize
     // flag is being passed properly through the call stack and being handled
     // correctly by a 'known' token, [site:slogan].
     $raw_tokens = array('slogan' => '[site:slogan]');
     $generated = $this->tokenService->generate('site', $raw_tokens, [], [], $bubbleable_metadata);
     $this->assertEqual($generated['[site:slogan]'], $safe_slogan, 'Token sanitized.');
     $generated = $this->tokenService->generate('site', $raw_tokens, array(), array('sanitize' => FALSE), $bubbleable_metadata);
     $this->assertEqual($generated['[site:slogan]'], $slogan, 'Unsanitized token generated properly.');
 }

 /**
  * {@inheritdoc}
  */
 public function render(ResultRow $values)
 {
     $value = $this->getValue($values);
     if (!empty($this->options['not'])) {
         $value = !$value;
     }
     if ($this->options['type'] == 'custom') {
         return $value ? UtilityXss::filterAdmin($this->options['type_custom_true']) : UtilityXss::filterAdmin($this->options['type_custom_false']);
     } elseif (isset($this->formats[$this->options['type']])) {
         return $value ? $this->formats[$this->options['type']][0] : $this->formats[$this->options['type']][1];
     } else {
         return $value ? $this->formats['yes-no'][0] : $this->formats['yes-no'][1];
     }
 }

 /**
  * Displays a list of product classes.
  */
 public function classOverview()
 {
     $classes = \Drupal::entityManager()->getStorage('node_type')->loadByProperties(array('third_party_settings.uc_product.product' => TRUE));
     $header = array($this->t('Class ID'), $this->t('Name'), $this->t('Description'), $this->t('Operations'));
     $rows = [];
     foreach ($classes as $class) {
         $links = [];
         $links['edit'] = array('title' => $this->t('Edit'), 'url' => Url::fromRoute('entity.node_type.edit_form', ['node_type' => $class->id()]), 'query' => array('destination' => 'admin/store/products/classes'));
         if (!$class->isLocked()) {
             $links['delete'] = array('title' => $this->t('Delete'), 'url' => Url::fromRoute('entity.node_type.delete_form', ['node_type' => $class->id()]), 'query' => array('destination' => 'admin/store/products/classes'));
         }
         $rows[] = array(SafeMarkup::checkPlain($class->id()), SafeMarkup::checkPlain($class->label()), Xss::filterAdmin($class->getDescription()), array('data' => array('#type' => 'operations', '#links' => $links)));
     }
     return array('#theme' => 'table', '#header' => $header, '#rows' => $rows, '#empty' => $this->t('No product classes have been defined yet.'));
 }

 /**
  * {@inheritdoc}
  */
 public function build()
 {
     $this->view->display_handler->preBlockBuild($this);
     if ($output = $this->view->executeDisplay($this->displayID)) {
         // Override the label to the dynamic title configured in the view.
         if (empty($this->configuration['views_label']) && $this->view->getTitle()) {
             $output['#title'] = Xss::filterAdmin($this->view->getTitle());
         }
         // Before returning the block output, convert it to a renderable array
         // with contextual links.
         $this->addContextualLinks($output);
         return $output;
     }
     return array();
 }

 /**
  * {@inheritdoc}
  */
 public function render(ResultRow $values)
 {
     $value = $this->getValue($values);
     if (!empty($this->options['not'])) {
         $value = !$value;
     }
     if ($this->options['type'] == 'custom') {
         $custom_value = $value ? $this->options['type_custom_true'] : $this->options['type_custom_false'];
         return ViewsRenderPipelineMarkup::create(UtilityXss::filterAdmin($custom_value));
     } elseif (isset($this->formats[$this->options['type']])) {
         return $value ? $this->formats[$this->options['type']][0] : $this->formats[$this->options['type']][1];
     } else {
         return $value ? $this->formats['yes-no'][0] : $this->formats['yes-no'][1];
     }
 }