Updated Drupal to 8.6. This goes with the following updates because it's possible...

[yaffs-website] / web / core / modules / contextual / contextual.module

diff --git a/web/core/modules/contextual/contextual.module b/web/core/modules/contextual/contextual.module
index a814c391f110e04a2d1549d40470c0db08b331fa..8b9fc36fd7b1011d14d45d2b3f5b37873efa6372 100644 (file)
--- a/web/core/modules/contextual/contextual.module
+++ b/web/core/modules/contextual/contextual.module
@@ -86,7 +86,7 @@ function contextual_help($route_name, RouteMatchInterface $route_match) {
       $sample_picture = [
         '#theme' => 'image',
         '#uri' => 'core/misc/icons/bebebe/pencil.svg',
-        '#alt' => t('contextual links button')
+        '#alt' => t('contextual links button'),
       ];
       $sample_picture = \Drupal::service('renderer')->render($sample_picture);
       $output .= '<li>' . t('Hovering over the area of interest will temporarily make the contextual links button visible (which looks like a pencil in most themes, and is normally displayed in the upper right corner of the area). The icon typically looks like this: @picture', ['@picture' => $sample_picture]) . '</li>';
@@ -191,13 +191,19 @@ function _contextual_links_to_id($contextual_links) {
 /**
  * Unserializes the result of _contextual_links_to_id().
  *
- * @see _contextual_links_to_id
+ * Note that $id is user input. Before calling this method the ID should be
+ * checked against the token stored in the 'data-contextual-token' attribute
+ * which is passed via the 'tokens' request parameter to
+ * \Drupal\contextual\ContextualController::render().
  *
  * @param string $id
  *   A serialized representation of a #contextual_links property value array.
  *
  * @return array
  *   The value for a #contextual_links property.
+ *
+ * @see _contextual_links_to_id()
+ * @see \Drupal\contextual\ContextualController::render()
  */
 function _contextual_id_to_links($id) {
   $contextual_links = [];