Upgrade to 3.5.7

kirby/src/Form/OptionsQuery.php

@@ -6,6 +6,7 @@ use Kirby\Cms\Field;
 use Kirby\Exception\InvalidArgumentException;
 use Kirby\Exception\NotFoundException;
 use Kirby\Toolkit\Collection;
+use Kirby\Toolkit\Escape;
 use Kirby\Toolkit\Obj;
 use Kirby\Toolkit\Properties;
 use Kirby\Toolkit\Query;
@@ -102,7 +103,26 @@ class OptionsQuery
             $value = $value[$object];
         }
 
-        return Str::template($value, $data);
+        $result = Str::template($value, $data);
+
+        // escape the default queries for the `text` field
+        // TODO: remove after default escape implemented for query templates in 3.6
+        if ($field === 'text') {
+            $defaults = [
+                'arrayItem'     => '{{ arrayItem.value }}',
+                'block'         => '{{ block.type }}: {{ block.id }}',
+                'file'          => '{{ file.filename }}',
+                'page'          => '{{ page.title }}',
+                'structureItem' => '{{ structureItem.title }}',
+                'user'          => '{{ user.username }}',
+            ];
+
+            if (isset($defaults[$object]) && $value === $defaults[$object]) {
+                $result = Escape::html($result);
+            }
+        }
+
+        return $result;
     }
 
     /**