fix(packages): render Markdown on provider View Details

_build/templates/default/sass/_package-management.scss

@@ -98,7 +98,10 @@
   overflow: auto;
   padding: 15px;
   word-wrap: break-word;
+}
 
+.meta-wrapper,
+#modx-package-browser-details-main {
   code {
     @include code-highlight(false);
     font-family: $codefonts;
@@ -122,7 +125,6 @@
   img {
     max-width: 100%;
   }
-
 }
 
 #modx-package-browser-details-main {

_build/test/Tests/Model/Transport/PackageMarkdownTest.php

@@ -0,0 +1,75 @@
+<?php
+
+/*
+ * This file is part of the MODX Revolution package.
+ *
+ * Copyright (c) MODX, LLC
+ *
+ * For complete copyright and license information, see the COPYRIGHT and LICENSE
+ * files found in the top-level directory of this distribution.
+ *
+ * @package modx-test
+ */
+namespace MODX\Revolution\Tests\Model\Transport;
+
+use MODX\Revolution\MODxTestCase;
+use MODX\Revolution\Transport\PackageMarkdown;
+
+/**
+ * Tests for PackageMarkdown helper used by package manager details.
+ *
+ * @package modx-test
+ * @subpackage modx
+ * @group Model
+ * @group Transport
+ * @group PackageMarkdown
+ */
+class PackageMarkdownTest extends MODxTestCase
+{
+    public function testParseRendersMarkdownLinksAndHeadings(): void
+    {
+        $html = PackageMarkdown::parse(
+            "[Omise](https://www.omise.co) is a gateway.\n\n## Setup\n\nEnable the module."
+        );
+
+        $this->assertStringContainsString('<a href="https://www.omise.co">Omise</a>', $html);
+        $this->assertStringContainsString('<h2>Setup</h2>', $html);
+        $this->assertStringContainsString('<p>Enable the module.</p>', $html);
+    }
+
+    public function testParseFieldsOnlyTouchesKnownStringFields(): void
+    {
+        $parsed = PackageMarkdown::parseFields([
+            'name' => 'Omise Payment Gateway for Commerce',
+            'description' => 'See [Omise](https://www.omise.co).',
+            'instructions' => "## Setup\n\nDo this.",
+            'changelog' => '- Added 3D Secure',
+            'downloads' => 412,
+            'signature' => 'commerce_omise-1.1.0-pl',
+        ]);
+
+        $this->assertSame('Omise Payment Gateway for Commerce', $parsed['name']);
+        $this->assertSame(412, $parsed['downloads']);
+        $this->assertSame('commerce_omise-1.1.0-pl', $parsed['signature']);
+        $this->assertStringContainsString('<a href="https://www.omise.co">Omise</a>', $parsed['description']);
+        $this->assertStringContainsString('<h2>Setup</h2>', $parsed['instructions']);
+        $this->assertStringContainsString('<li>Added 3D Secure</li>', $parsed['changelog']);
+    }
+
+    public function testProviderFieldsLeaveLicensePlain(): void
+    {
+        $parsed = PackageMarkdown::parseFields([
+            'description' => 'See [Omise](https://www.omise.co).',
+            'license' => 'GPLv2',
+        ], PackageMarkdown::PROVIDER_FIELDS);
+
+        $this->assertStringContainsString('<a href="https://www.omise.co">Omise</a>', $parsed['description']);
+        $this->assertSame('GPLv2', $parsed['license']);
+    }
+
+    public function testSafeModeEscapesRawHtml(): void
+    {
+        $html = PackageMarkdown::parse('Hello <script>alert(1)</script>');
+        $this->assertStringNotContainsString('<script>', $html);
+    }
+}

core/src/Revolution/Processors/Workspace/Packages/GetAttribute.php

@@ -13,7 +13,7 @@
 
 use MODX\Revolution\Processors\Processor;
 use MODX\Revolution\Transport\modTransportPackage;
-use Parsedown;
+use MODX\Revolution\Transport\PackageMarkdown;
 use xPDO\Transport\xPDOTransport;
 
 /**
@@ -74,21 +74,22 @@ public function process()
     {
         $attributes = [];
         $attributesToGet = explode(',', $this->getProperty('attributes', ''));
-        $parseDown = new Parsedown();
-        $parseDown->setSafeMode(true);
         foreach ($attributesToGet as $attribute) {
-            $data = $this->transport->getAttribute($attribute);
-            $attributes[$attribute] = in_array(
-                $attribute,
-                ['changelog', 'license', 'readme']
-            ) ? $parseDown->text($data ?? '') : $data;
+            $attributes[$attribute] = $this->transport->getAttribute($attribute);
 
             /* if setup options, include setup file */
             if ($attribute === 'setup-options') {
                 @ob_start();
                 $options = $this->package->toArray();
-                $options[xPDOTransport::PACKAGE_ACTION] = $this->package->previousVersionInstalled() ? xPDOTransport::ACTION_UPGRADE : xPDOTransport::ACTION_INSTALL;
-                $attributeFile = $this->modx->getOption('core_path') . 'packages/' . $this->package->signature . '/' . $attribute . '.php';
+                $options[xPDOTransport::PACKAGE_ACTION] = $this->package->previousVersionInstalled()
+                    ? xPDOTransport::ACTION_UPGRADE
+                    : xPDOTransport::ACTION_INSTALL;
+                $attributeFile = $this->modx->getOption('core_path')
+                    . 'packages/'
+                    . $this->package->signature
+                    . '/'
+                    . $attribute
+                    . '.php';
                 if ($attribute !== '' && file_exists($attributeFile)) {
                     $modx =& $this->modx;
                     $attributes['setup-options'] = include $attributeFile;
@@ -97,6 +98,6 @@ public function process()
             }
         }
 
-        return $this->success('', $attributes);
+        return $this->success('', PackageMarkdown::parseFields($attributes));
     }
 }

core/src/Revolution/Processors/Workspace/Packages/Rest/GetList.php

@@ -1,4 +1,5 @@
 <?php
+
 /*
  * This file is part of MODX Revolution.
  *
@@ -12,6 +13,7 @@
 
 use MODX\Revolution\Processors\Processor;
 use MODX\Revolution\Transport\modTransportProvider;
+use MODX\Revolution\Transport\PackageMarkdown;
 
 /**
  * @package MODX\Revolution\Processors\Workspace\Packages\Rest
@@ -73,7 +75,7 @@ public function process()
     {
         $data = $this->provider->find($this->getProperties());
 
-        if (is_string($data)){
+        if (is_string($data)) {
             return $this->failure($data);
         } elseif (!(is_array($data) && count($data) === 2)) {
             return $this->failure($this->modx->lexicon('provider_err_connect'));
@@ -84,7 +86,7 @@ public function process()
             if ((string)$package['name'] === '') {
                 continue;
             }
-            $list[] = $package;
+            $list[] = PackageMarkdown::parseFields($package, PackageMarkdown::PROVIDER_FIELDS);
         }
 
         return $this->outputArray($list, (int)$data[0]);

core/src/Revolution/Transport/PackageMarkdown.php

@@ -0,0 +1,74 @@
+<?php
+
+/*
+ * This file is part of MODX Revolution.
+ *
+ * Copyright (c) MODX, LLC. All Rights Reserved.
+ *
+ * For complete copyright and license information, see the COPYRIGHT and LICENSE
+ * files found in the top-level directory of this distribution.
+ */
+
+namespace MODX\Revolution\Transport;
+
+use Parsedown;
+
+/**
+ * Parses package text attributes that may contain Markdown (provider + local).
+ */
+class PackageMarkdown
+{
+    /** Full transport attributes (GetAttribute / install meta tabs). */
+    public const FIELDS = [
+        'changelog',
+        'description',
+        'instructions',
+        'license',
+        'readme',
+    ];
+
+    /**
+     * Provider list/details payload fields rendered as HTML bodies.
+     * Excludes short meta values like license shown as plain text in the aside.
+     */
+    public const PROVIDER_FIELDS = [
+        'changelog',
+        'description',
+        'instructions',
+    ];
+
+    /**
+     * @param string $text Raw markdown or plain text
+     * @return string Safe HTML
+     */
+    public static function parse(string $text): string
+    {
+        $parser = new Parsedown();
+        $parser->setSafeMode(true);
+
+        return $parser->text($text);
+    }
+
+    /**
+     * Parse markdown fields present on a package payload.
+     *
+     * @param array $data Package row / attributes
+     * @param array $fields Field names to parse
+     * @return array
+     */
+    public static function parseFields(array $data, array $fields = self::FIELDS): array
+    {
+        foreach ($fields as $field) {
+            if (!array_key_exists($field, $data)) {
+                continue;
+            }
+            $value = $data[$field];
+            if ($value !== null && !is_string($value)) {
+                continue;
+            }
+            $data[$field] = self::parse($value ?? '');
+        }
+
+        return $data;
+    }
+}