{"action":"created","issue":{"url":"https://api.github.com/repos/FrozenNode/Laravel-Administrator/issues/891","labels_url":"https://api.github.com/repos/FrozenNode/Laravel-Administrator/issues/891/labels{/name}","comments_url":"https://api.github.com/repos/FrozenNode/Laravel-Administrator/issues/891/comments","events_url":"https://api.github.com/repos/FrozenNode/Laravel-Administrator/issues/891/events","html_url":"https://github.com/FrozenNode/Laravel-Administrator/issues/891","id":92679374,"number":891,"title":"HTML is rendered in text fields in item listings","user":{"login":"judgej","id":395934,"avatar_url":"https://avatars.githubusercontent.com/u/395934?v=3","gravatar_id":"","url":"https://api.github.com/users/judgej","html_url":"https://github.com/judgej","followers_url":"https://api.github.com/users/judgej/followers","following_url":"https://api.github.com/users/judgej/following{/other_user}","gists_url":"https://api.github.com/users/judgej/gists{/gist_id}","starred_url":"https://api.github.com/users/judgej/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/judgej/subscriptions","organizations_url":"https://api.github.com/users/judgej/orgs","repos_url":"https://api.github.com/users/judgej/repos","events_url":"https://api.github.com/users/judgej/events{/privacy}","received_events_url":"https://api.github.com/users/judgej/received_events","type":"User","site_admin":false},"labels":[],"state":"open","locked":false,"assignee":null,"milestone":null,"comments":2,"created_at":"2015-07-02T16:30:25Z","updated_at":"2015-07-03T23:31:56Z","closed_at":null,"body":"If a text field contains any HTML special characters (< > &) then if that text field is displayed as a column (i.e. in the item listings) then those HTML special characters are not escaped/encoded.\r\n\r\nSo a person named \"Bobby \\<strong\\> Strong\" will be displayed as:\r\n\r\n> Bobby **Strong**\r\n\r\nThat's a bit dangerous. The listings should never display raw HTML straight from the database, expecting that data to display as simple strings and for there to be no formatting issues.\r\n\r\nIs there a workaround for this, maybe an option to add to the columns to pass it through a filter like {{...}} does in blade?"},"comment":{"url":"https://api.github.com/repos/FrozenNode/Laravel-Administrator/issues/comments/118437654","html_url":"https://github.com/FrozenNode/Laravel-Administrator/issues/891#issuecomment-118437654","issue_url":"https://api.github.com/repos/FrozenNode/Laravel-Administrator/issues/891","id":118437654,"user":{"login":"judgej","id":395934,"avatar_url":"https://avatars.githubusercontent.com/u/395934?v=3","gravatar_id":"","url":"https://api.github.com/users/judgej","html_url":"https://github.com/judgej","followers_url":"https://api.github.com/users/judgej/followers","following_url":"https://api.github.com/users/judgej/following{/other_user}","gists_url":"https://api.github.com/users/judgej/gists{/gist_id}","starred_url":"https://api.github.com/users/judgej/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/judgej/subscriptions","organizations_url":"https://api.github.com/users/judgej/orgs","repos_url":"https://api.github.com/users/judgej/repos","events_url":"https://api.github.com/users/judgej/events{/privacy}","received_events_url":"https://api.github.com/users/judgej/received_events","type":"User","site_admin":false},"created_at":"2015-07-03T23:31:56Z","updated_at":"2015-07-03T23:31:56Z","body":"A workaround is to do this on the `columns` entry:\r\n\r\n~~~php\r\n'output' => function($value) {return htmlentities($value, ENT_QUOTES, 'UTF-8', false);};\r\n~~~\r\n\r\nor if you have the HTML module installed:\r\n\r\n~~~php\r\n'output' => function($value) {return HTML::entities($value);};\r\n~~~\r\n"}}