AdvertParameterEditorHtmlTrait
Sanitizes HTML values of editor parameters (`useEditor`) of an advert in the Api layer.
IMPORTANT: it runs in the one place all advert write paths go through (front form, admin form and
the external :Api:Bazaar|Comcat:Advert:save where the owner may write parameterRels). Sanitizing
only in the form mode would let an external client store <p onmouseover=…>, which the advert
detail prints with |noescape to every visitor. See also
MessageManager::beforeSave().
Values of parameters without an editor are deliberately not sanitized: they are plain text and
templates print them escaped (parameter.useEditor decides, not the presence of tags in the text).
Called in beforeSave() after hydration (the parameterRels collection is already merged with the
submitted values) and before the flush. Shared by the Bazaar and Comcat AdvertManager.
Table of Contents
Methods
- purifyEditorParameterRels() : void
Methods
purifyEditorParameterRels()
private
purifyEditorParameterRels(object $advert) : void
Parameters
- $advert : object