[FOLLOWUP][BUGFIX] Correct record title escaping

This patch corrects the IRRE header for sys_file_references. Resolves: #77248 Related: #76399 Related: #76668 Related: #76900 Releases: master, 7.6 Change-Id: Ic0791d71b7ff5aa3e9caf098ea75fa254efa6c4b Reviewed-on: https://review.typo3.org/49206 Reviewed-by: Wouter Wolters <typo3@wouterwolters.nl> Tested-by: Wouter Wolters <typo3@wouterwolters.nl> Tested-by: Bamboo TYPO3com <info@typo3.com> Reviewed-by: Markus Klein <markus.klein@typo3.org> Tested-by: Markus Klein <markus.klein@typo3.org>

[FOLLOWUP][BUGFIX] Correct record title escaping
This patch corrects the IRRE header for sys_file_references. Resolves: #77248 Related: #76399 Related: #76668 Related: #76900 Releases: master, 7.6 Change-Id: Ic0791d71b7ff5aa3e9caf098ea75fa254efa6c4b Reviewed-on: https://review.typo3.org/49206 Reviewed-by: Wouter Wolters <typo3@wouterwolters.nl> Tested-by: Wouter Wolters <typo3@wouterwolters.nl> Tested-by: Bamboo TYPO3com <info@typo3.com> Reviewed-by: Markus Klein <markus.klein@typo3.org> Tested-by: Markus Klein <markus.klein@typo3.org>
58faf135 · Nicole Cordes · Markus Klein · 4134a278 · 58faf135
Commit 58faf135 authored 8 years ago by Nicole Cordes Committed by Markus Klein 8 years ago
--- a/typo3/sysext/backend/Classes/Form/Container/InlineRecordContainer.php
+++ b/typo3/sysext/backend/Classes/Form/Container/InlineRecordContainer.php
@@ -263,7 +263,7 @@ class InlineRecordContainer extends AbstractContainer
            $markup[] = '            </span>';
            $markup[] = '        </div>';
            $markup[] = '        <div class="media-body">';
-            $markup[] = '            <div class="alert-message">' . htmlspecialchars($message) .  '</div>';
+            $markup[] = '            <div class="alert-message">' . htmlspecialchars($message) . '</div>';
            $markup[] = '        </div>';
            $markup[] = '    </div>';
            $markup[] = '</div>';
@@ -306,7 +306,10 @@ class InlineRecordContainer extends AbstractContainer

        $recordTitle = $data['recordTitle'];
        if (!empty($recordTitle)) {
-            $recordTitle = BackendUtility::getRecordTitlePrep($recordTitle);
+            // The user function may return HTML, therefore we can't escape it
+            if (empty($data['processedTca']['ctrl']['formattedLabel_userFunc'])) {
+                $recordTitle = BackendUtility::getRecordTitlePrep($recordTitle);
+            }
        } else {
            $recordTitle = '<em>[' . htmlspecialchars($languageService->sL('LLL:EXT:lang/locallang_core.xlf:labels.no_title')) . ']</em>';
        }