Update to Drupal 8.0.0-beta15. For more information, see: https://www.drupal.org/node/2563023

core/modules/contact/src/ContactFormAccessControlHandler.php

@@ -22,7 +22,7 @@ class ContactFormAccessControlHandler extends EntityAccessControlHandler {
   /**
    * {@inheritdoc}
    */
-  public function checkAccess(EntityInterface $entity, $operation, $langcode, AccountInterface $account) {
+  protected function checkAccess(EntityInterface $entity, $operation, $langcode, AccountInterface $account) {
     if ($operation == 'view') {
       // Do not allow access personal form via site-wide route.
       return AccessResult::allowedIf($account->hasPermission('access site-wide contact form') && $entity->id() !== 'personal')->cachePerPermissions();

core/modules/contact/src/ContactFormListBuilder.php

@@ -35,13 +35,17 @@ class ContactFormListBuilder extends ConfigEntityListBuilder {
   public function buildRow(EntityInterface $entity) {
     // Special case the personal form.
     if ($entity->id() == 'personal') {
-      $row['form'] = $this->getLabel($entity);
+      $row['form'] = $entity->label();
       $row['recipients'] = t('Selected user');
       $row['selected'] = t('No');
     }
     else {
       $row['form'] = $entity->link(NULL, 'canonical');
-      $row['recipients'] = SafeMarkup::checkPlain(implode(', ', $entity->getRecipients()));
+      $row['recipients']['data'] = [
+        '#theme' => 'item_list',
+        '#items' => $entity->getRecipients(),
+        '#context' => ['list_style' => 'comma-list'],
+      ];
       $default_form = \Drupal::config('contact.settings')->get('default_form');
       $row['selected'] = ($default_form == $entity->id() ? t('Yes') : t('No'));
     }

core/modules/contact/src/Controller/ContactController.php

@@ -11,7 +11,6 @@ use Drupal\Core\Controller\ControllerBase;
 use Drupal\contact\ContactFormInterface;
 use Drupal\Core\Render\RendererInterface;
 use Drupal\user\UserInterface;
-use Drupal\Component\Utility\SafeMarkup;
 use Symfony\Component\DependencyInjection\ContainerInterface;
 use Symfony\Component\HttpKernel\Exception\NotFoundHttpException;
 
@@ -87,7 +86,7 @@ class ContactController extends ControllerBase {
       ));
 
     $form = $this->entityFormBuilder()->getForm($message);
-    $form['#title'] = SafeMarkup::checkPlain($contact_form->label());
+    $form['#title'] = $contact_form->label();
     $form['#cache']['contexts'][] = 'user.permissions';
     $this->renderer->addCacheableDependency($form, $config);
     return $form;

core/modules/contact/src/Entity/Message.php

@@ -29,7 +29,8 @@ use Drupal\Core\Field\BaseFieldDefinition;
  *   admin_permission = "administer contact forms",
  *   entity_keys = {
  *     "bundle" = "contact_form",
- *     "uuid" = "uuid"
+ *     "uuid" = "uuid",
+ *     "langcode" = "langcode"
  *   },
  *   bundle_entity_type = "contact_form",
  *   field_ui_base_route = "entity.contact_form.edit_form",

core/modules/contact/src/MessageForm.php

@@ -130,12 +130,12 @@ class MessageForm extends ContentEntityForm {
       $form['name']['#type'] = 'item';
       $form['name']['#value'] = $user->getUsername();
       $form['name']['#required'] = FALSE;
-      $form['name']['#markup'] = SafeMarkup::checkPlain($user->getUsername());
+      $form['name']['#plain_text'] = $user->getUsername();
 
       $form['mail']['#type'] = 'item';
       $form['mail']['#value'] = $user->getEmail();
       $form['mail']['#required'] = FALSE;
-      $form['mail']['#markup'] = SafeMarkup::checkPlain($user->getEmail());
+      $form['mail']['#plain_text'] = $user->getEmail();
     }
 
     // The user contact form has a preset recipient.

core/modules/contact/src/MessageViewBuilder.php

@@ -9,7 +9,6 @@ namespace Drupal\contact;
 
 use Drupal\Core\Entity\EntityInterface;
 use Drupal\Core\Entity\EntityViewBuilder;
-use Drupal\Component\Utility\SafeMarkup;
 use Drupal\Core\Mail\MailFormatHelper;
 use Drupal\Core\Render\Element;
 
@@ -42,7 +41,7 @@ class MessageViewBuilder extends EntityViewBuilder {
         $build[$id]['message'] = array(
           '#type' => 'item',
           '#title' => t('Message'),
-          '#markup' => SafeMarkup::checkPlain($entity->getMessage()),
+          '#plain_text' => $entity->getMessage(),
         );
       }
     }

core/modules/contact/src/Plugin/migrate/source/d6/ContactCategory.php

@@ -43,6 +43,7 @@ class ContactCategory extends DrupalSqlBase {
    */
   public function prepareRow(Row $row) {
     $row->setSourceProperty('recipients', explode(',', $row->getSourceProperty('recipients')));
+    return parent::prepareRow($row);
   }
 
   /**

core/modules/contact/src/Tests/ContactLanguageTest.php

@@ -0,0 +1,69 @@
+<?php
+
+/**
+ * @file
+ * Contains \Drupal\contact\Tests\ContactLanguageTest.
+ */
+
+namespace Drupal\contact\Tests;
+
+use Drupal\simpletest\WebTestBase;
+
+/**
+ * Tests contact messages with language module.
+ *
+ * This is to ensure that a contact form by default does not show the language
+ * select, but it does so when it's enabled from the content language settings
+ * page.
+ *
+ * @group contact
+ */
+class ContactLanguageTest extends WebTestBase {
+
+  /**
+   * Modules to enable.
+   *
+   * @var array
+   */
+  public static $modules = array(
+    'contact',
+    'language',
+    'contact_test',
+  );
+
+  /**
+   * {@inheritdoc}
+   */
+  protected function setUp() {
+    parent::setUp();
+
+    // Create and login administrative user.
+    $admin_user = $this->drupalCreateUser(array(
+      'access site-wide contact form',
+      'administer languages',
+    ));
+    $this->drupalLogin($admin_user);
+  }
+
+  /**
+   * Tests configuration options with language enabled.
+   */
+  public function testContactLanguage() {
+    // Ensure that contact form by default does not show the language select.
+    $this->drupalGet('contact');
+    $this->assertResponse(200, 'The page exists');
+    $this->assertNoField('edit-langcode-0-value');
+
+    // Enable language select from content language settings page.
+    $settings_path = 'admin/config/regional/content-language';
+    $edit['entity_types[contact_message]'] = TRUE;
+    $edit['settings[contact_message][feedback][settings][language][language_alterable]'] = TRUE;
+    $this->drupalPostForm($settings_path, $edit, t('Save configuration'));
+
+    // Ensure that contact form now shows the language select.
+    $this->drupalGet('contact');
+    $this->assertResponse(200, 'The page exists');
+    $this->assertField('edit-langcode-0-value');
+  }
+
+}

core/modules/contact/src/Tests/ContactPersonalTest.php

@@ -63,8 +63,13 @@ class ContactPersonalTest extends WebTestBase {
    * Tests that mails for contact messages are correctly sent.
    */
   function testSendPersonalContactMessage() {
+    // Ensure that the web user's email needs escaping.
+    $mail = $this->webUser->getUsername() . '&escaped@example.com';
+    $this->webUser->setEmail($mail)->save();
     $this->drupalLogin($this->webUser);
 
+    $this->drupalGet('user/' . $this->contactUser->id() . '/contact');
+    $this->assertEscaped($mail);
     $message = $this->submitPersonalContact($this->contactUser);
     $mails = $this->drupalGetMails();
     $this->assertEqual(1, count($mails));
@@ -79,7 +84,7 @@ class ContactPersonalTest extends WebTestBase {
       '!recipient-name' => $this->contactUser->getUsername(),
     );
     $this->assertEqual($mail['subject'], t('[!site-name] !subject', $variables), 'Subject is in sent message.');
-    $this->assertTrue(strpos($mail['body'], t('Hello !recipient-name,', $variables)) !== FALSE, 'Recipient name is in sent message.');
+    $this->assertTrue(strpos($mail['body'], 'Hello ' . $variables['!recipient-name']) !== FALSE, 'Recipient name is in sent message.');
     $this->assertTrue(strpos($mail['body'], $this->webUser->getUsername()) !== FALSE, 'Sender name is in sent message.');
     $this->assertTrue(strpos($mail['body'], $message['message[0][value]']) !== FALSE, 'Message body is in sent message.');
 
@@ -93,7 +98,9 @@ class ContactPersonalTest extends WebTestBase {
       '@sender_email' => $this->webUser->getEmail(),
       '@recipient_name' => $this->contactUser->getUsername()
     );
-    $this->assertText(SafeMarkup::format('@sender_name (@sender_email) sent @recipient_name an email.', $placeholders));
+    $this->assertRaw(SafeMarkup::format('@sender_name (@sender_email) sent @recipient_name an email.', $placeholders));
+    // Ensure an unescaped version of the email does not exist anywhere.
+    $this->assertNoRaw($this->webUser->getEmail());
   }
 
   /**

core/modules/contact/src/Tests/ContactSitewideTest.php

@@ -39,6 +39,7 @@ class ContactSitewideTest extends WebTestBase {
   protected function setUp() {
     parent::setUp();
     $this->drupalPlaceBlock('system_breadcrumb_block');
+    $this->drupalPlaceBlock('local_actions_block');
   }
 
   /**
@@ -124,7 +125,7 @@ class ContactSitewideTest extends WebTestBase {
     $this->assertText(t('Recipients field is required.'));
 
     // Test validation of max_length machine name.
-    $recipients = array('simpletest@example.com', 'simpletest2@example.com', 'simpletest3@example.com');
+    $recipients = array('simpletest&@example.com', 'simpletest2@example.com', 'simpletest3@example.com');
     $max_length = EntityTypeInterface::BUNDLE_MAX_LENGTH;
     $max_length_exceeded = $max_length + 1;
     $this->addContactForm($id = Unicode::strtolower($this->randomMachineName($max_length_exceeded)), $label = $this->randomMachineName($max_length_exceeded), implode(',', array($recipients[0])), '', TRUE);
@@ -144,6 +145,10 @@ class ContactSitewideTest extends WebTestBase {
     // Make sure the newly created form is included in the list of forms.
     $this->assertNoUniqueText($label, 'New form included in forms list.');
 
+    // Ensure that the recipient email is escaped on the listing.
+    $this->drupalGet('admin/structure/contact');
+    $this->assertEscaped($recipients[0]);
+
     // Test update contact form.
     $this->updateContactForm($id, $label = $this->randomMachineName(16), $recipients_str = implode(',', array($recipients[0], $recipients[1])), $reply = $this->randomMachineName(30), FALSE);
     $config = $this->config('contact.form.' . $id)->get();

core/modules/contact/src/Tests/ContactStorageTest.php

@@ -28,13 +28,14 @@ class ContactStorageTest extends ContactSitewideTest {
    *
    * @var array
    */
-  public static $modules = array(
+  public static $modules = [
+    'block',
     'text',
     'contact',
     'field_ui',
     'contact_storage_test',
     'contact_test',
-  );
+  ];
 
   /**
    * Tests configuration options and the site-wide contact form.

core/modules/contact/src/Tests/Migrate/d6/MigrateContactCategoryTest.php

@@ -13,7 +13,7 @@ use Drupal\migrate_drupal\Tests\d6\MigrateDrupal6TestBase;
 /**
  * Migrate contact categories to contact.form.*.yml.
  *
- * @group contact
+ * @group migrate_drupal_6
  */
 class MigrateContactCategoryTest extends MigrateDrupal6TestBase {
 
@@ -29,7 +29,6 @@ class MigrateContactCategoryTest extends MigrateDrupal6TestBase {
    */
   protected function setUp() {
     parent::setUp();
-    $this->loadDumps(['Contact.php']);
     $this->executeMigration('d6_contact_category');
   }
 

core/modules/contact/src/Tests/Migrate/d6/MigrateContactConfigsTest.php

@@ -13,7 +13,7 @@ use Drupal\migrate_drupal\Tests\d6\MigrateDrupal6TestBase;
 /**
  * Upgrade variables to contact.settings.yml.
  *
- * @group contact
+ * @group migrate_drupal_6
  */
 class MigrateContactConfigsTest extends MigrateDrupal6TestBase {
 
@@ -39,7 +39,6 @@ class MigrateContactConfigsTest extends MigrateDrupal6TestBase {
       ),
     );
     $this->prepareMigrations($id_mappings);
-    $this->loadDumps(['Variable.php', 'Contact.php']);
     $this->executeMigration('d6_contact_settings');
   }
 

core/modules/contact/tests/src/Unit/Plugin/migrate/source/d6/ContactCategoryTest.php

@@ -20,7 +20,6 @@ class ContactCategoryTest extends MigrateSqlSourceTestCase {
 
   protected $migrationConfiguration = array(
     'id' => 'test',
-    'idlist' => array(),
     'source' => array(
       'plugin' => 'd6_contact_category',
     ),