@@ -71,30 +71,27 @@ public function getElementHtml()
71
71
{
72
72
$ html = '' ;
73
73
74
- if ((string )$ this ->getValue ()) {
74
+ if ((string )$ this ->getEscapedValue ()) {
75
75
$ url = $ this ->_getUrl ();
76
76
77
77
if (!preg_match ("/^http\:\/\/|https\:\/\// " , $ url )) {
78
78
$ url = $ this ->_urlBuilder ->getBaseUrl (['_type ' => UrlInterface::URL_TYPE_MEDIA ]) . $ url ;
79
79
}
80
80
81
81
$ linkId = 'linkId ' .$ this ->random ->getRandomString (8 );
82
- $ html = '<a previewlinkid=" ' .$ linkId .'" href=" ' .
83
- $ url .
84
- '" ' .
82
+ $ html = '<a previewlinkid=" ' .$ linkId .'" href=" ' .
83
+ $ url . '" ' .
85
84
$ this ->_getUiId (
86
85
'link '
87
86
) .
88
87
'> ' .
89
- '<img src=" ' .
90
- $ url .
91
- '" id=" ' .
88
+ '<img src=" ' . $ url . '" id=" ' .
92
89
$ this ->getHtmlId () .
93
90
'_image" title=" ' .
94
- $ this ->getValue () .
91
+ $ this ->getEscapedValue () .
95
92
'" ' .
96
93
' alt=" ' .
97
- $ this ->getValue () .
94
+ $ this ->getEscapedValue () .
98
95
'" height="22" width="22" class="small-image-preview v-middle" ' .
99
96
$ this ->_getUiId () .
100
97
' /> ' .
@@ -120,7 +117,7 @@ public function getElementHtml()
120
117
protected function _getDeleteCheckbox ()
121
118
{
122
119
$ html = '' ;
123
- if ($ this ->getValue ()) {
120
+ if ($ this ->getEscapedValue ()) {
124
121
$ label = (string )new \Magento \Framework \Phrase ('Delete Image ' );
125
122
$ html .= '<span class="delete-image"> ' ;
126
123
$ html .= '<input type="checkbox" ' .
@@ -153,7 +150,8 @@ protected function _getDeleteCheckbox()
153
150
*/
154
151
protected function _getHiddenInput ()
155
152
{
156
- return '<input type="hidden" name=" ' . parent ::getName () . '[value]" value=" ' . $ this ->getValue () . '" /> ' ;
153
+ return '<input type="hidden" name=" ' . parent ::getName () .
154
+ '[value]" value=" ' . $ this ->getEscapedValue () . '" /> ' ;
157
155
}
158
156
159
157
/**
@@ -163,7 +161,7 @@ protected function _getHiddenInput()
163
161
*/
164
162
protected function _getUrl ()
165
163
{
166
- return $ this ->getValue ();
164
+ return $ this ->getEscapedValue ();
167
165
}
168
166
169
167
/**
0 commit comments