TYPO3 Core

As this is going back and forth, this should be discussed properly before creating patches (changes of changes of changes again) IMHO. I do understand the use case, of course, but just saying...

Benni Mack wrote:

As this is going back and forth, this should be discussed properly before creating patches (changes of changes of changes again) IMHO. I do understand the use case, of course, but just saying...

I am in for a discussion. And let me emphasize again. It's not about reverting the changes. I am ok with safety first but I pretty much dislike when the core changes things and my only chance to get back previous features is to xclass while it's quite easy to make things configurable. If I can choose the escaping and the renderer in the view, maybe as arguments of the flash message view helper, I am totally ok with sane, secure defaults. But the current approach is a big no go, UX-wise.

By the way: I had the exact same Problem in Image Captions where I want to place a link.
https://forge.typo3.org/issues/67679

We had a use case where we wanted to have a link inside our Flash Message. We solved this as follows:
1. We created a Custom Renderer "ListHtmlRenderer" which extends the "ListRenderer", doing the same except not htmlspecialcharing.
2. We created a custom flashMessageViewHelper which extends the Core one, registering an argument "allowHtml" which defaults to false. If set to true, it uses our ListHtmlRenderer instead of the ListRenderer.

(Btw., we did not have to extend/replace the FlashMessageRendererResolver because we only use our custom flashMessageViewhelper in the frontend context. Else, it would have been an even greater effort).

What I woud like to propose is to add such an argument like "allowHtml" to the core FlashMessageViewhelper who could then pass this option on to the respecive renderer which deals with it. For the argument description, we could add some kind of warning that one has to properly clean the input. So I'm - like Alexander - in favor of making this configurable.