Skip to content

Chore: Captcha - Replace Block Escaping with Escaper #37087

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Closed
wants to merge 1 commit into from
Closed

Chore: Captcha - Replace Block Escaping with Escaper #37087

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
1 commit
Select commit
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
33 changes: 20 additions & 13 deletions app/code/Magento/Captcha/view/adminhtml/templates/default.phtml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -3,30 +3,37 @@
* Copyright © Magento, Inc. All rights reserved.
* See COPYING.txt for license details.
*/
declare(strict_types=1);

/** @var \Magento\Captcha\Block\Captcha\DefaultCaptcha $block */
/** @var \Magento\Captcha\Model\DefaultModel $captcha */
/** @var \Magento\Framework\View\Helper\SecureHtmlRenderer $secureRenderer */
use Magento\Captcha\Block\Captcha\DefaultCaptcha;
use Magento\Captcha\Model\DefaultModel;
use Magento\Framework\Escaper;
use Magento\Framework\View\Helper\SecureHtmlRenderer;

/** @var Escaper $escaper */
/** @var DefaultCaptcha $block */
/** @var DefaultModel $captcha */
/** @var SecureHtmlRenderer $secureRenderer */

$captcha = $block->getCaptchaModel();
/** @var bool $validationEnabled */
$validationEnabled = $block->hasData('frontend_validation') ? $block->getData('frontend_validation') : true;
?>
<div class="admin__field<?php if ($validationEnabled): ?> _required<?php endif; ?>">
<label for="captcha" class="admin__field-label">
<span><?= $block->escapeHtml(__('Please enter the letters and numbers from the image')) ?></span>
<span><?= $escaper->escapeHtml(__('Please enter the letters and numbers from the image')) ?></span>
</label>
<div class="admin__field-control">
<input
id="captcha"
class="admin__control-text"
type="text"
name="<?= $block->escapeHtmlAttr(\Magento\Captcha\Helper\Data::INPUT_NAME_FIELD_VALUE)
?>[<?= $block->escapeHtml($block->getFormId()) ?>]"
name="<?= $escaper->escapeHtmlAttr(\Magento\Captcha\Helper\Data::INPUT_NAME_FIELD_VALUE)
?>[<?= $escaper->escapeHtml($block->getFormId()) ?>]"
<?php if ($validationEnabled): ?>data-validate="{required:true}"<?php endif; ?>/>
<?php if ($captcha->isCaseSensitive()):?>
<div class="admin__field-note">
<span><?= $block->escapeHtml(__('<strong>Attention</strong>: Captcha is case sensitive.'), ['strong'])
<span><?= $escaper->escapeHtml(__('<strong>Attention</strong>: Captcha is case sensitive.'), ['strong'])
?></span>
</div>
<?php endif; ?>
Expand All @@ -36,18 +43,18 @@ $validationEnabled = $block->hasData('frontend_validation') ? $block->getData('f
<img
id="captcha-reload"
class="captcha-reload"
src="<?= $block->escapeUrl($block->getViewFileUrl('Magento_Captcha::reload.png')) ?>"
alt="<?= $block->escapeHtmlAttr(__('Reload captcha')) ?>"/>
src="<?= $escaper->escapeUrl($block->getViewFileUrl('Magento_Captcha::reload.png')) ?>"
alt="<?= $escaper->escapeHtmlAttr(__('Reload captcha')) ?>"/>
<img
id="<?= $block->escapeHtmlAttr($block->getFormId()) ?>"
id="<?= $escaper->escapeHtmlAttr($block->getFormId()) ?>"
width="<?= /* @noEscape */ (float) $block->getImgWidth() ?>"
height="<?= /* @noEscape */ (float) $block->getImgHeight() ?>"
src="<?= $block->escapeUrl($captcha->getImgSrc()) ?>" />
src="<?= $escaper->escapeUrl($captcha->getImgSrc()) ?>" />
</div>

<?php
$url = $block->escapeJs($block->getRefreshUrl());
$formId = $block->escapeJs($block->escapeHtml($block->getFormId()));
$url = $escaper->escapeJs($block->getRefreshUrl());
$formId = $escaper->escapeJs($escaper->escapeHtml($block->getFormId()));
$scriptString = <<<script

require(["prototype", "mage/captcha"], function(){
Expand Down
42 changes: 24 additions & 18 deletions app/code/Magento/Captcha/view/frontend/templates/default.phtml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -3,46 +3,52 @@
* Copyright © Magento, Inc. All rights reserved.
* See COPYING.txt for license details.
*/
declare(strict_types=1);

/** @var \Magento\Captcha\Block\Captcha\DefaultCaptcha $block */
use Magento\Captcha\Block\Captcha\DefaultCaptcha;
use Magento\Captcha\Model\DefaultModel;
use Magento\Framework\Escaper;

/** @var \Magento\Captcha\Model\DefaultModel $captcha */
/** @var Escaper $escaper */
/** @var DefaultCaptcha $block */
/** @var DefaultModel $captcha */
$captcha = $block->getCaptchaModel();

/** @var bool $validationEnabled */
$validationEnabled = $block->hasData('frontend_validation') ? $block->getData('frontend_validation') : true;
$inputName = $block->escapeHtmlAttr(\Magento\Captcha\Helper\Data::INPUT_NAME_FIELD_VALUE);
$loaderUrl = $block->escapeUrl($block->getViewFileUrl('images/loader-2.gif'));
$note = $block->escapeHtml(__('<strong>Attention</strong>: Captcha is case sensitive.'), ['strong']);
$inputName = $escaper->escapeHtmlAttr(\Magento\Captcha\Helper\Data::INPUT_NAME_FIELD_VALUE);
$loaderUrl = $escaper->escapeUrl($block->getViewFileUrl('images/loader-2.gif'));
$note = $escaper->escapeHtml(__('<strong>Attention</strong>: Captcha is case sensitive.'), ['strong']);
?>
<div class="field captcha<?php if ($validationEnabled): ?> required<?php endif; ?>"
role="<?= $block->escapeHtmlAttr($block->getFormId()) ?>">
<label for="captcha_<?= $block->escapeHtmlAttr($block->getFormId()) ?>" class="label">
<span><?= $block->escapeHtml(__('Please type the letters and numbers below')) ?></span>
role="<?= $escaper->escapeHtmlAttr($block->getFormId()) ?>">
<label for="captcha_<?= $escaper->escapeHtmlAttr($block->getFormId()) ?>" class="label">
<span><?= $escaper->escapeHtml(__('Please type the letters and numbers below')) ?></span>
</label>
<div class="control captcha">
<input
name="<?= /* @noEscape */ $inputName ?>[<?= $block->escapeHtmlAttr($block->getFormId()) ?>]"
name="<?= /* @noEscape */ $inputName ?>[<?= $escaper->escapeHtmlAttr($block->getFormId()) ?>]"
type="text"
class="input-text<?php if ($validationEnabled): ?> required-entry<?php endif; ?>"
<?php if ($validationEnabled): ?>data-validate="{required:true}"<?php endif; ?>
id="captcha_<?= $block->escapeHtmlAttr($block->getFormId()) ?>"
id="captcha_<?= $escaper->escapeHtmlAttr($block->getFormId()) ?>"
autocomplete="off"/>
<div class="nested">
<div class="field captcha no-label"
data-captcha="<?= $block->escapeHtmlAttr($block->getFormId()) ?>"
id="captcha-container-<?= $block->escapeHtmlAttr($block->getFormId()) ?>"
data-mage-init='{"captcha":{"url": "<?= $block->escapeUrl($block->getRefreshUrl()) ?>",
data-captcha="<?= $escaper->escapeHtmlAttr($block->getFormId()) ?>"
id="captcha-container-<?= $escaper->escapeHtmlAttr($block->getFormId()) ?>"
data-mage-init='{"captcha":{"url": "<?= $escaper->escapeUrl($block->getRefreshUrl()) ?>",
"imageLoader": "<?= /* @noEscape */ $loaderUrl ?>",
"type": "<?= $block->escapeHtmlAttr($block->getFormId()) ?>"}}'>
"type": "<?= $escaper->escapeHtmlAttr($block->getFormId()) ?>"}}'>
<div class="control captcha-image">
<img alt="<?= $block->escapeHtmlAttr(__('Please type the letters and numbers below')) ?>"
<img alt="<?= $escaper->escapeHtmlAttr(__('Please type the letters and numbers below')) ?>"
class="captcha-img"
height="<?= /* @noEscape */ (float) $block->getImgHeight() ?>"
src="<?= $block->escapeUrl($captcha->getImgSrc()) ?>"/>
src="<?= $escaper->escapeUrl($captcha->getImgSrc()) ?>"/>
<button type="button"
class="action reload captcha-reload"
title="<?= $block->escapeHtmlAttr(__('Reload captcha')) ?>">
<span><?= $block->escapeHtml(__('Reload captcha')) ?></span>
title="<?= $escaper->escapeHtmlAttr(__('Reload captcha')) ?>">
<span><?= $escaper->escapeHtml(__('Reload captcha')) ?></span>
</button>
</div>
</div>
Expand Down