Merge pull request #365 from mageplaza/2.4-develop

2.4 develop
mageplaza · Mar 4, 2024 · 69d3225 · 69d3225
2 parents ba71a67 + bf5c1b2
commit 69d3225
Show file tree

Hide file tree

Showing 4 changed files with 32 additions and 4 deletions.
diff --git a/Block/Post/View.php b/Block/Post/View.php
@@ -285,7 +285,7 @@ public function getCommentsTree($comments, $cmtId)
                     . $userName . '</span>
                                 </div>
                                 <div class="cmt-row__cmt-content">
-                                   ' . $this->commentHtml($comment['content']) . '
+                                   ' . $this->escapeHtml($this->commentHtml($comment['content'])) . '
                                 </div>
                                 <div class="cmt-row__cmt-interactions interactions">
                                     <div class="interactions__btn-actions">

diff --git a/Ui/Component/Listing/Columns/CommentContent.php b/Ui/Component/Listing/Columns/CommentContent.php
@@ -21,14 +21,42 @@
 
 namespace Mageplaza\Blog\Ui\Component\Listing\Columns;
 
+use Magento\Framework\View\Element\UiComponent\ContextInterface;
+use Magento\Framework\View\Element\UiComponentFactory;
 use Magento\Ui\Component\Listing\Columns\Column;
+use Magento\Framework\Escaper;
 
 /**
  * Class CommentContent
  * @package Mageplaza\Blog\Ui\Component\Listing\Columns
  */
 class CommentContent extends Column
 {
+    /**
+     * @var Escaper
+     */
+    protected $escaper;
+
+    /**
+     * CommentContent constructor.
+     *
+     * @param ContextInterface $context
+     * @param UiComponentFactory $uiComponentFactory
+     * @param Escaper $escaper
+     * @param array $components
+     * @param array $data
+     */
+    public function __construct(
+        ContextInterface $context,
+        UiComponentFactory $uiComponentFactory,
+        Escaper $escaper,
+        array $components = [],
+        array $data = []
+    ) {
+        $this->escaper = $escaper;
+        parent::__construct($context, $uiComponentFactory, $components, $data);
+    }
+
     /**
      * Prepare Data Source
      *
@@ -42,7 +70,7 @@ public function prepareDataSource(array $dataSource)
         if (isset($dataSource['data']['items'])) {
             foreach ($dataSource['data']['items'] as & $item) {
                 if (isset($item[$this->getData('name')])) {
-                    $content = $item['content'];
+                    $content = $this->escaper->escapeHtml($item['content']);
                     if (strlen($content) > $limitContent) {
                         $content = mb_substr($content, 0, $limitContent, 'UTF-8') . '.....';
                     }

diff --git a/composer.json b/composer.json
@@ -3,7 +3,7 @@
   "description": "Magento 2 Blog extension",
   "require": {
     "mageplaza/module-core": "^1.5.6",
-    "facebook/graph-sdk": "^5.*"
+    "facebook/graph-sdk": "^5.7.0"
   },
   "type": "magento2-module",
   "version": "4.2.0",

diff --git a/view/frontend/layout/mpblog_post_history.xml b/view/frontend/layout/mpblog_post_history.xml
@@ -25,7 +25,7 @@
     <body>
         <referenceContainer name="content">
             <block class="Mageplaza\Blog\Block\Post\AuthorPost" name="mpblog.author.post" as="mpblog_post" template="Mageplaza_Blog::post/author_post.phtml" cacheable="false">
-                <block class="Mageplaza\Blog\Block\Post\ManagePost" name="mpblog.manage.post" as="mpblog_manage_post" template="Mageplaza_Blog::post/manage_post.phtml">
+                <block class="Mageplaza\Blog\Block\Post\ManagePost" name="mpblog.manage.post" as="mpblog_manage_post" template="Mageplaza_Blog::post/managePost.phtml">
                     <block name="field_additional"/>
                 </block>
             </block>