Resolve #9 by purifying label of entity reference values

civicrm · Feb 19, 2019 · dbf86a7 · dbf86a7
1 parent 047faf6
commit dbf86a7
Showing 1 changed file with 8 additions and 0 deletions.
diff --git a/CRM/Core/Form/Renderer.php b/CRM/Core/Form/Renderer.php
@@ -248,6 +248,14 @@ public static function preProcessEntityRef($field) {
       $params = $field->getAttribute('data-api-params');
       $params = $params ? json_decode($params, TRUE) : array();
       $result = civicrm_api3($entity, 'getlist', array('id' => $val) + $params);
+      // Purify label output of entityreference fields
+      if (!empty($result['values'])) {
+        foreach ($result['values'] as &$res) {
+          if (!empty($res['label'])) {
+            $res['label'] = CRM_Utils_String::purifyHTML($res['label']);
+          }
+        }
+      }
       if ($field->isFrozen()) {
         // Prevent js from treating frozen entityRef as a "live" field
         $field->removeAttribute('class');