From afc5333bb3aad03367ecfa87080432549e5c3c9e Mon Sep 17 00:00:00 2001 From: vrana Date: Thu, 7 Feb 2013 14:39:04 -0800 Subject: [PATCH] Convert AphrontFormView to safe HTML Summary: Searched for `AphrontFormView` and then for `appendChild()`. Test Plan: /login/ Reviewers: epriestley Reviewed By: epriestley CC: aran, Korvin Maniphest Tasks: T2432 Differential Revision: https://secure.phabricator.com/D4855 --- .../controller/PhabricatorLoginController.php | 32 ++++++------ .../PhabricatorConduitConsoleController.php | 4 +- .../DifferentialDiffCreateController.php | 15 +++--- .../HeraldTestConsoleController.php | 4 +- .../ManiphestBatchEditController.php | 2 +- .../maniphest/view/ManiphestTaskListView.php | 2 +- .../PhabricatorMetaMTAReceiveController.php | 7 ++- .../PhabricatorMetaMTASendController.php | 11 ++-- .../PhabricatorPeopleEditController.php | 24 ++++----- ...habricatorProjectProfileEditController.php | 4 +- .../PhabricatorRepositoryCreateController.php | 4 +- .../PhabricatorRepositoryEditController.php | 14 ++--- .../panel/PhabricatorSettingsPanelConduit.php | 8 +-- ...abricatorSettingsPanelEmailPreferences.php | 4 +- .../panel/PhabricatorSettingsPanelLDAP.php | 11 ++-- .../panel/PhabricatorSettingsPanelOAuth.php | 51 +++++++++++-------- .../panel/PhabricatorSettingsPanelProfile.php | 4 +- .../PhabricatorSlowvoteCreateController.php | 4 +- .../PhabricatorSlowvotePollController.php | 5 +- 19 files changed, 111 insertions(+), 99 deletions(-) diff --git a/src/applications/auth/controller/PhabricatorLoginController.php b/src/applications/auth/controller/PhabricatorLoginController.php index 7918b1cff8..23de5e7f2d 100644 --- a/src/applications/auth/controller/PhabricatorLoginController.php +++ b/src/applications/auth/controller/PhabricatorLoginController.php @@ -243,22 +243,21 @@ final class PhabricatorLoginController // CSRF for logged-out users is vaugely tricky. if ($provider->isProviderRegistrationEnabled()) { - $title = pht("Login or Register with %s", - phutil_escape_html($provider_name)); + $title = pht("Login or Register with %s", $provider_name); $body = pht('Login or register for Phabricator using your %s account.', - phutil_escape_html($provider_name)); + $provider_name); $button = pht("Login or Register with %s", phutil_escape_html($provider_name)); } else { - $title = pht("Login with %s", - phutil_escape_html($provider_name)); - $body = pht('Login to your existing Phabricator account using your '. - '%s account.', phutil_escape_html($provider_name)). - '

'. - ''. - pht('You can not use %s to register a new account.', - phutil_escape_html($provider_name)). - ''; + $title = pht("Login with %s", $provider_name); + $body = hsprintf( + '%s

%s', + pht( + 'Login to your existing Phabricator account using your %s account.', + $provider_name), + pht( + 'You can not use %s to register a new account.', + $provider_name)); $button = pht("Log in with %s", phutil_escape_html($provider_name)); } @@ -276,8 +275,9 @@ final class PhabricatorLoginController $auth_form ->setUser($request->getUser()) ->setMethod('GET') - ->appendChild( - '

'.$body.'

') + ->appendChild(hsprintf( + '

%s

', + $body)) ->appendChild( id(new AphrontFormSubmitControl()) ->setValue("{$button} \xC2\xBB")); @@ -289,9 +289,9 @@ final class PhabricatorLoginController $panel->setWidth(AphrontPanelView::WIDTH_FORM); $panel->setNoBackground(); foreach ($forms as $name => $form) { - $panel->appendChild('

'.$name.'

'); + $panel->appendChild(phutil_tag('h1', array(), $name)); $panel->appendChild($form); - $panel->appendChild('
'); + $panel->appendChild(phutil_tag('br')); } $login_message = PhabricatorEnv::getEnvConfig('auth.login-message'); diff --git a/src/applications/conduit/controller/PhabricatorConduitConsoleController.php b/src/applications/conduit/controller/PhabricatorConduitConsoleController.php index 43a645e4d1..8e7f2bec39 100644 --- a/src/applications/conduit/controller/PhabricatorConduitConsoleController.php +++ b/src/applications/conduit/controller/PhabricatorConduitConsoleController.php @@ -80,10 +80,10 @@ final class PhabricatorConduitConsoleController id(new AphrontFormMarkupControl()) ->setLabel('Errors') ->setValue($error_description)) - ->appendChild( + ->appendChild(hsprintf( '

Enter parameters using '. 'JSON. For instance, to enter a list, type: '. - '["apple", "banana", "cherry"]'); + '["apple", "banana", "cherry"]')); $params = $method_object->defineParamTypes(); foreach ($params as $param => $desc) { diff --git a/src/applications/differential/controller/DifferentialDiffCreateController.php b/src/applications/differential/controller/DifferentialDiffCreateController.php index 054e69cb90..b141bcb17d 100644 --- a/src/applications/differential/controller/DifferentialDiffCreateController.php +++ b/src/applications/differential/controller/DifferentialDiffCreateController.php @@ -41,12 +41,15 @@ final class DifferentialDiffCreateController extends DifferentialController { ->setAction('/differential/diff/create/') ->setEncType('multipart/form-data') ->setUser($request->getUser()) - ->appendChild( - '

'.pht('The best way to create '. - 'a Differential diff is by using %s, but you '. - 'can also just paste a diff (e.g., from svn diff or '. - 'git diff) into this box or upload it as a file if you '. - 'really want.', $arcanist_link).'

') + ->appendChild(hsprintf( + '

%s

', + pht( + 'The best way to create a Differential diff is by using %s, but you '. + 'can also just paste a diff (e.g., from %s or %s) into this box '. + 'or upload it as a file if you really want.', + $arcanist_link, + phutil_tag('tt', array(), 'svn diff'), + phutil_tag('tt', array(), 'git diff')))) ->appendChild( id(new AphrontFormTextAreaControl()) ->setLabel(pht('Raw Diff')) diff --git a/src/applications/herald/controller/HeraldTestConsoleController.php b/src/applications/herald/controller/HeraldTestConsoleController.php index 8856c879c4..f0225d7081 100644 --- a/src/applications/herald/controller/HeraldTestConsoleController.php +++ b/src/applications/herald/controller/HeraldTestConsoleController.php @@ -96,11 +96,11 @@ final class HeraldTestConsoleController extends HeraldController { $form = id(new AphrontFormView()) ->setUser($user) - ->appendChild( + ->appendChild(hsprintf( '

Enter an object to test rules '. 'for, like a Diffusion commit (e.g., rX123) or a '. 'Differential revision (e.g., D123). You will be shown the '. - 'results of a dry run on the object.

') + 'results of a dry run on the object.

')) ->appendChild( id(new AphrontFormTextControl()) ->setLabel(pht('Object Name')) diff --git a/src/applications/maniphest/controller/ManiphestBatchEditController.php b/src/applications/maniphest/controller/ManiphestBatchEditController.php index 6e1b533e45..7ecd0db24c 100644 --- a/src/applications/maniphest/controller/ManiphestBatchEditController.php +++ b/src/applications/maniphest/controller/ManiphestBatchEditController.php @@ -96,7 +96,7 @@ final class ManiphestBatchEditController extends ManiphestController { 'name' => 'actions', 'id' => 'batch-form-actions', ))); - $form->appendChild('

These tasks will be edited:

'); + $form->appendChild(phutil_tag('p', array(), 'These tasks will be edited:')); $form->appendChild($list); $form->appendChild( id(new AphrontFormInsetView()) diff --git a/src/applications/maniphest/view/ManiphestTaskListView.php b/src/applications/maniphest/view/ManiphestTaskListView.php index b27beeb633..f808ab9104 100644 --- a/src/applications/maniphest/view/ManiphestTaskListView.php +++ b/src/applications/maniphest/view/ManiphestTaskListView.php @@ -45,7 +45,7 @@ final class ManiphestTaskListView extends ManiphestView { $views[] = $view->render(); } - return implode("\n", $views); + return $this->renderHTMLView($views); } } diff --git a/src/applications/metamta/controller/PhabricatorMetaMTAReceiveController.php b/src/applications/metamta/controller/PhabricatorMetaMTAReceiveController.php index ccf1410f39..fde8a1d468 100644 --- a/src/applications/metamta/controller/PhabricatorMetaMTAReceiveController.php +++ b/src/applications/metamta/controller/PhabricatorMetaMTAReceiveController.php @@ -49,10 +49,9 @@ final class PhabricatorMetaMTAReceiveController $form->setUser($request->getUser()); $form->setAction($this->getApplicationURI('/receive/')); $form - ->appendChild( - '

'. - pht('This form will simulate sending mail to an object.'). - '

') + ->appendChild(hsprintf( + '

%s

', + pht('This form will simulate sending mail to an object.'))) ->appendChild( id(new AphrontFormTextControl()) ->setLabel(pht('To')) diff --git a/src/applications/metamta/controller/PhabricatorMetaMTASendController.php b/src/applications/metamta/controller/PhabricatorMetaMTASendController.php index bd423186cd..0540ff189f 100644 --- a/src/applications/metamta/controller/PhabricatorMetaMTASendController.php +++ b/src/applications/metamta/controller/PhabricatorMetaMTASendController.php @@ -55,11 +55,12 @@ final class PhabricatorMetaMTASendController 'target' => '_blank', ), pht('Configuring Outbound Email')); - $instructions = - '

'. - pht('This form will send a normal email using the settings you have '. - 'configured for Phabricator. For more information, see %s.', $doclink). - '

'; + $instructions = hsprintf( + '

%s

', + pht( + 'This form will send a normal email using the settings you have '. + 'configured for Phabricator. For more information, see %s.', + $doclink)); $adapter = PhabricatorEnv::getEnvConfig('metamta.mail-adapter'); $warning = null; diff --git a/src/applications/people/controller/PhabricatorPeopleEditController.php b/src/applications/people/controller/PhabricatorPeopleEditController.php index bedf1b43fa..78100bf21d 100644 --- a/src/applications/people/controller/PhabricatorPeopleEditController.php +++ b/src/applications/people/controller/PhabricatorPeopleEditController.php @@ -393,9 +393,9 @@ final class PhabricatorPeopleEditController ->setAction($request->getRequestURI()->alter('saved', null)); if ($is_self) { - $form->appendChild( + $form->appendChild(hsprintf( '

NOTE: You can not edit your own '. - 'role.

'); + 'role.

')); } $form @@ -448,10 +448,10 @@ final class PhabricatorPeopleEditController $form ->setUser($admin) ->setAction($request->getRequestURI()) - ->appendChild( + ->appendChild(hsprintf( '

You can use this certificate '. 'to write scripts or bots which interface with Phabricator over '. - 'Conduit.

'); + 'Conduit.

')); if ($user->getIsSystemAgent()) { $form @@ -530,7 +530,7 @@ final class PhabricatorPeopleEditController $form ->setUser($admin) ->setAction($request->getRequestURI()) - ->appendChild( + ->appendChild(hsprintf( '

'. 'Be careful when renaming users! '. 'The old username will no longer be tied to the user, so anything '. @@ -549,7 +549,7 @@ final class PhabricatorPeopleEditController 'after their username is changed (their username is part of the '. 'salt in the password hash). They will receive an email with '. 'instructions on how to do this.'. - '

') + '

')) ->appendChild( id(new AphrontFormStaticControl()) ->setLabel('Old Username') @@ -622,7 +622,7 @@ final class PhabricatorPeopleEditController $form ->setUser($admin) ->setAction($request->getRequestURI()) - ->appendChild( + ->appendChild(hsprintf( '

'. 'Be careful when deleting users! '. 'If this user interacted with anything, it is generally better '. @@ -636,7 +636,7 @@ final class PhabricatorPeopleEditController 'It is generally safe to delete newly created users (and test users '. 'and so on), but less safe to delete established users. If '. 'possible, disable them instead.'. - '

') + '

')) ->appendChild( id(new AphrontFormStaticControl()) ->setLabel('Username') @@ -670,11 +670,11 @@ final class PhabricatorPeopleEditController ), 'User Guide: Account Roles'); - return + return hsprintf( '

'. - 'For a detailed explanation of account roles, see '. - $roles_link.'.'. - '

'; + 'For a detailed explanation of account roles, see %s.'. + '

', + $roles_link); } } diff --git a/src/applications/project/controller/PhabricatorProjectProfileEditController.php b/src/applications/project/controller/PhabricatorProjectProfileEditController.php index fcdcb34942..83bdf90a59 100644 --- a/src/applications/project/controller/PhabricatorProjectProfileEditController.php +++ b/src/applications/project/controller/PhabricatorProjectProfileEditController.php @@ -168,10 +168,10 @@ final class PhabricatorProjectProfileEditController ->setLabel('Blurb') ->setName('blurb') ->setValue($profile->getBlurb())) - ->appendChild( + ->appendChild(hsprintf( '

NOTE: Policy settings are not '. 'yet fully implemented. Some interfaces still ignore these settings, '. - 'particularly "Visible To".

') + 'particularly "Visible To".

')) ->appendChild( id(new AphrontFormPolicyControl()) ->setUser($user) diff --git a/src/applications/repository/controller/PhabricatorRepositoryCreateController.php b/src/applications/repository/controller/PhabricatorRepositoryCreateController.php index 698e3105c7..179ad55f41 100644 --- a/src/applications/repository/controller/PhabricatorRepositoryCreateController.php +++ b/src/applications/repository/controller/PhabricatorRepositoryCreateController.php @@ -78,11 +78,11 @@ final class PhabricatorRepositoryCreateController ->setValue($repository->getName()) ->setError($e_name) ->setCaption('Human-readable repository name.')) - ->appendChild( + ->appendChild(hsprintf( '

Select a "Callsign" — a '. 'short, uppercase string to identify revisions in this repository. If '. 'you choose "EX", revisions in this repository will be identified '. - 'with the prefix "rEX".

') + 'with the prefix "rEX".

')) ->appendChild( id(new AphrontFormTextControl()) ->setLabel('Callsign') diff --git a/src/applications/repository/controller/PhabricatorRepositoryEditController.php b/src/applications/repository/controller/PhabricatorRepositoryEditController.php index f995c97229..0a1a0ca364 100644 --- a/src/applications/repository/controller/PhabricatorRepositoryEditController.php +++ b/src/applications/repository/controller/PhabricatorRepositoryEditController.php @@ -122,16 +122,15 @@ final class PhabricatorRepositoryEditController ->setLabel('Callsign') ->setName('callsign') ->setValue($repository->getCallsign())) - ->appendChild(' + ->appendChild(hsprintf('

'. 'If source code in this repository uses a character '. 'encoding other than UTF-8 (for example, ISO-8859-1), '. 'specify it here. You can usually leave this field blank. '. 'See User Guide: '. - ''. - 'UTF-8 and Character Encoding'. - ' for more information.'. - '

') + 'UTF-8 and Character Encoding for more information.'. + '

', + $encoding_doc_link)) ->appendChild( id(new AphrontFormTextControl()) ->setLabel('Encoding') @@ -358,13 +357,14 @@ final class PhabricatorRepositoryEditController $form ->setUser($user) ->setAction('/repository/edit/'.$repository->getID().'/tracking/') - ->appendChild( + ->appendChild(hsprintf( '

Phabricator can track '. 'repositories, importing commits as they happen and notifying '. 'Differential, Diffusion, Herald, and other services. To enable '. 'tracking for a repository, configure it here and then start (or '. 'restart) the daemons. More information is available in the '. - ''.$user_guide_link.'.

'); + '%s.

', + $user_guide_link)); $form ->appendChild( diff --git a/src/applications/settings/panel/PhabricatorSettingsPanelConduit.php b/src/applications/settings/panel/PhabricatorSettingsPanelConduit.php index a80a32d222..d4ccec4194 100644 --- a/src/applications/settings/panel/PhabricatorSettingsPanelConduit.php +++ b/src/applications/settings/panel/PhabricatorSettingsPanelConduit.php @@ -67,10 +67,10 @@ final class PhabricatorSettingsPanelConduit $cert_form = new AphrontFormView(); $cert_form ->setUser($user) - ->appendChild( + ->appendChild(hsprintf( '

This certificate allows you to '. 'authenticate over Conduit, the Phabricator API. Normally, you just '. - 'run arc install-certificate to install it.') + 'run arc install-certificate to install it.')) ->appendChild( id(new AphrontFormTextAreaControl()) ->setLabel('Certificate') @@ -87,10 +87,10 @@ final class PhabricatorSettingsPanelConduit ->setUser($user) ->setAction($this->getPanelURI()) ->setWorkflow(true) - ->appendChild( + ->appendChild(hsprintf( '

You can regenerate this '. 'certificate, which will invalidate the old certificate and create '. - 'a new one.

') + 'a new one.

')) ->appendChild( id(new AphrontFormSubmitControl()) ->setValue('Regenerate Certificate')); diff --git a/src/applications/settings/panel/PhabricatorSettingsPanelEmailPreferences.php b/src/applications/settings/panel/PhabricatorSettingsPanelEmailPreferences.php index f3e3c55c2a..58d913db95 100644 --- a/src/applications/settings/panel/PhabricatorSettingsPanelEmailPreferences.php +++ b/src/applications/settings/panel/PhabricatorSettingsPanelEmailPreferences.php @@ -165,7 +165,7 @@ final class PhabricatorSettingsPanelEmailPreferences 'break threading in some clients.')); $form - ->appendChild( + ->appendChild(hsprintf( '
'. '

'. 'You can customize what mail you receive from Phabricator here.'. @@ -176,7 +176,7 @@ final class PhabricatorSettingsPanelEmailPreferences 'still receive an email as long as at least one of the changes '. 'is set to notify you.'. '

' - ); + )); $mailtags = $preferences->getPreference('mailtags', array()); diff --git a/src/applications/settings/panel/PhabricatorSettingsPanelLDAP.php b/src/applications/settings/panel/PhabricatorSettingsPanelLDAP.php index ebff08540a..25df530fdb 100644 --- a/src/applications/settings/panel/PhabricatorSettingsPanelLDAP.php +++ b/src/applications/settings/panel/PhabricatorSettingsPanelLDAP.php @@ -35,10 +35,11 @@ final class PhabricatorSettingsPanelLDAP $unlink_form ->setUser($user) ->setAction('/ldap/login/') - ->appendChild( + ->appendChild(hsprintf( '

There is currently no '. - 'LDAP account linked to your Phabricator account. You can link an ' . - 'account, which will allow you to use it to log into Phabricator

') + 'LDAP account linked to your Phabricator account. You can link an '. + 'account, which will allow you to use it to log into Phabricator.'. + '

')) ->appendChild( id(new AphrontFormTextControl()) ->setLabel('LDAP username') @@ -57,10 +58,10 @@ final class PhabricatorSettingsPanelLDAP $unlink_form = new AphrontFormView(); $unlink_form ->setUser($user) - ->appendChild( + ->appendChild(hsprintf( '

You may unlink this account '. 'from your LDAP account. This will prevent you from logging in with '. - 'your LDAP credentials.

') + 'your LDAP credentials.

')) ->appendChild( id(new AphrontFormSubmitControl()) ->addCancelButton('/ldap/unlink/', $unlink)); diff --git a/src/applications/settings/panel/PhabricatorSettingsPanelOAuth.php b/src/applications/settings/panel/PhabricatorSettingsPanelOAuth.php index 41565afbdb..b95640ba48 100644 --- a/src/applications/settings/panel/PhabricatorSettingsPanelOAuth.php +++ b/src/applications/settings/panel/PhabricatorSettingsPanelOAuth.php @@ -84,11 +84,12 @@ final class PhabricatorSettingsPanelOAuth $forms[] = $form; if (!$oauth_info) { $form - ->appendChild( - '

There is currently no '. - phutil_escape_html($provider_name).' account linked to your '. - 'Phabricator account. You can link an account, which will allow you '. - 'to use it to log into Phabricator.

'); + ->appendChild(hsprintf( + '

There is currently no %s '. + 'account linked to your Phabricator account. You can link an '. + 'account, which will allow you to use it to log into Phabricator.'. + '

', + $provider_name)); $this->prepareAuthForm($form); @@ -100,11 +101,12 @@ final class PhabricatorSettingsPanelOAuth $expires = $oauth_info->getTokenExpires(); $form - ->appendChild( + ->appendChild(hsprintf( '

Your account is linked with '. - 'a '.phutil_escape_html($provider_name).' account. You may use your '. - phutil_escape_html($provider_name).' credentials to log into '. - 'Phabricator.

') + 'a %s account. You may use your %s credentials to log into '. + 'Phabricator.

', + $provider_name, + $provider_name)) ->appendChild( id(new AphrontFormStaticControl()) ->setLabel($provider_name.' ID') @@ -133,11 +135,12 @@ final class PhabricatorSettingsPanelOAuth $unlink_form = new AphrontFormView(); $unlink_form ->setUser($user) - ->appendChild( + ->appendChild(hsprintf( '

You may unlink this account '. - 'from your '.phutil_escape_html($provider_name).' account. This '. - 'will prevent you from logging in with your '. - phutil_escape_html($provider_name).' credentials.

') + 'from your %s account. This will prevent you from logging in '. + 'with your %s credentials.

', + $provider_name, + $provider_name)) ->appendChild( id(new AphrontFormSubmitControl()) ->addCancelButton('/oauth/'.$provider_key.'/unlink/', $unlink)); @@ -165,18 +168,22 @@ final class PhabricatorSettingsPanelOAuth $rappable_status = PhabricatorUserOAuthInfo::getRappableTokenStatus( $status); $beat = self::getBeat(); - $rap = $beat . "Yo yo yo
". + $rap = hsprintf( + "%s Yo yo yo
". 'My name\'s DJ Token and I\'m here to say
'. // pronounce as "dollar rappable status" for meter to work - "$rappable_status, hey hey hey hey
". + "%s, hey hey hey hey
". 'I rap \'bout tokens, that might be why
'. - 'I\'m such a cool and popular guy'; + 'I\'m such a cool and popular guy', + $beat, + $rappable_status); $token_form = new AphrontFormView(); $token_form ->setUser($user) - ->appendChild( - '

'.$rap.'

') + ->appendChild(hsprintf( + '

%s

', + $rap)) ->appendChild( id(new AphrontFormStaticControl()) ->setLabel('Token Status') @@ -282,12 +289,12 @@ final class PhabricatorSettingsPanelOAuth private static function getBeat() { // Gangsta's Paradise (karaoke version). // Chosen because it's the only thing I listen to. - $song_id = "Gangsta\\'s Paradise"; + $song_id = "Gangsta's Paradise"; // Make a musical note which you can click for the beat. - $beat = '♫ '; + $beat = hsprintf( + '♫', + jsprintf('alert(%s); return 0;', "Think about {$song_id}.")); return $beat; } } diff --git a/src/applications/settings/panel/PhabricatorSettingsPanelProfile.php b/src/applications/settings/panel/PhabricatorSettingsPanelProfile.php index d78cbbcd6a..a668967dba 100644 --- a/src/applications/settings/panel/PhabricatorSettingsPanelProfile.php +++ b/src/applications/settings/panel/PhabricatorSettingsPanelProfile.php @@ -182,10 +182,10 @@ final class PhabricatorSettingsPanelProfile 'href' => $profile_uri, ), $profile_uri))) - ->appendChild( + ->appendChild(hsprintf( '

Write something about yourself! '. 'Make sure to include important information like '. - 'your favorite Pokemon and which Starcraft race you play.

') + 'your favorite Pokemon and which Starcraft race you play.

')) ->appendChild( id(new AphrontFormTextAreaControl()) ->setLabel('Blurb') diff --git a/src/applications/slowvote/controller/PhabricatorSlowvoteCreateController.php b/src/applications/slowvote/controller/PhabricatorSlowvoteCreateController.php index 3f3d5f1b6d..9ffa72245f 100644 --- a/src/applications/slowvote/controller/PhabricatorSlowvoteCreateController.php +++ b/src/applications/slowvote/controller/PhabricatorSlowvoteCreateController.php @@ -65,9 +65,9 @@ final class PhabricatorSlowvoteCreateController $form = id(new AphrontFormView()) ->setUser($user) - ->appendChild( + ->appendChild(hsprintf( '

Resolve issues and build '. - 'consensus through protracted deliberation.

') + 'consensus through protracted deliberation.

')) ->appendChild( id(new AphrontFormTextControl()) ->setLabel('Question') diff --git a/src/applications/slowvote/controller/PhabricatorSlowvotePollController.php b/src/applications/slowvote/controller/PhabricatorSlowvotePollController.php index 9440e476b4..95938fa958 100644 --- a/src/applications/slowvote/controller/PhabricatorSlowvotePollController.php +++ b/src/applications/slowvote/controller/PhabricatorSlowvotePollController.php @@ -158,8 +158,9 @@ final class PhabricatorSlowvotePollController $form = id(new AphrontFormView()) ->setUser($user) - ->appendChild( - '

'.$instructions.'

') + ->appendChild(hsprintf( + '

%s

', + $instructions)) ->appendChild( id(new AphrontFormMarkupControl()) ->setLabel('Vote')