Upgrade to 3.5.7

kirby/src/Form/Field/BlocksField.php

@@ -181,6 +181,13 @@ class BlocksField extends FieldClass
     public function store($value)
     {
         $blocks = $this->blocksToValues((array)$value, 'content');
+
+        // returns empty string to avoid storing empty array as string `[]`
+        // and to consistency work with `$field->isEmpty()`
+        if (empty($blocks) === true) {
+            return '';
+        }
+
         return $this->valueToJson($blocks, $this->pretty());
     }
 

kirby/src/Form/Field/LayoutField.php

@@ -146,6 +146,12 @@ class LayoutField extends BlocksField
     {
         $value = Layouts::factory($value, ['parent' => $this->model])->toArray();
 
+        // returns empty string to avoid storing empty array as string `[]`
+        // and to consistency work with `$field->isEmpty()`
+        if (empty($value) === true) {
+            return '';
+        }
+
         foreach ($value as $layoutIndex => $layout) {
             if ($this->settings !== null) {
                 $value[$layoutIndex]['attrs'] = $this->attrsForm($layout['attrs'])->content();

kirby/src/Form/OptionsApi.php

@@ -7,6 +7,7 @@ use Kirby\Exception\Exception;
 use Kirby\Exception\InvalidArgumentException;
 use Kirby\Http\Remote;
 use Kirby\Http\Url;
+use Kirby\Toolkit\Escape;
 use Kirby\Toolkit\Properties;
 use Kirby\Toolkit\Query;
 use Kirby\Toolkit\Str;
@@ -86,10 +87,14 @@ class OptionsApi
      * @param array $data
      * @return string
      */
-    protected function field(string $field, array $data)
+    protected function field(string $field, array $data): string
     {
         $value = $this->$field();
-        return Str::template($value, $data);
+        return Str::template($value, $data, [
+            'callback' => function ($result) {
+                return Escape::html($result);
+            }
+        ]);
     }
 
     /**

kirby/src/Form/OptionsQuery.php

@@ -6,6 +6,7 @@ use Kirby\Cms\Field;
 use Kirby\Exception\InvalidArgumentException;
 use Kirby\Exception\NotFoundException;
 use Kirby\Toolkit\Collection;
+use Kirby\Toolkit\Escape;
 use Kirby\Toolkit\Obj;
 use Kirby\Toolkit\Properties;
 use Kirby\Toolkit\Query;
@@ -102,7 +103,26 @@ class OptionsQuery
             $value = $value[$object];
         }
 
-        return Str::template($value, $data);
+        $result = Str::template($value, $data);
+
+        // escape the default queries for the `text` field
+        // TODO: remove after default escape implemented for query templates in 3.6
+        if ($field === 'text') {
+            $defaults = [
+                'arrayItem'     => '{{ arrayItem.value }}',
+                'block'         => '{{ block.type }}: {{ block.id }}',
+                'file'          => '{{ file.filename }}',
+                'page'          => '{{ page.title }}',
+                'structureItem' => '{{ structureItem.title }}',
+                'user'          => '{{ user.username }}',
+            ];
+
+            if (isset($defaults[$object]) && $value === $defaults[$object]) {
+                $result = Escape::html($result);
+            }
+        }
+
+        return $result;
     }
 
     /**