dereuromark/cakephp-tools 3.14.1

on PHP Packagist

Fixes

• ObfuscateHelper::encodeEmailUrl() HTML-escapes link attributes by default and writes every chunk into the inline script as an encoded JavaScript string, so attribute values such as a title can no longer inject markup or script. Mailto query keys are URL-encoded like the values. #356
• ObfuscateHelper::encodeText() escapes characters it leaves unencoded, so < no longer reaches the page raw, and multibyte characters produce correct entities. #356
• The pagination element and the ObfuscateHelper scripts carry the CSP nonce. They read cspScriptNonce, set by CakePHP's CspMiddleware, and fall back to cspNonce. #353

Upgrade notes

• encodeEmailUrl() no longer defaults to 'escape' => false. If you passed pre-encoded HTML entities in attributes, pass 'escape' => false explicitly.

Full Changelog: 3.14.0...3.14.1