? ? Pending

User tests: Successful: Unsuccessful:

avatar andrepereiradasilva
andrepereiradasilva
30 Dec 2016

Pull Request for New Issue.

Summary of Changes

Fix improper js escaping in toolbar buttons.

Testing Instructions

  1. Add a language override like test "test" 'test'" for admin en-GB JLIB_HTML_PLEASE_MAKE_A_SELECTION_FROM_THE_LIST language var
  2. Go to any list view and try to click any button that requires you to use the checkbox (ex: edit button). Javascript error...
  3. Apply patch and repeat test.

Documentation Changes Required

None.

avatar andrepereiradasilva andrepereiradasilva - open - 30 Dec 2016
avatar andrepereiradasilva andrepereiradasilva - change - 30 Dec 2016
Status New Pending
avatar joomla-cms-bot joomla-cms-bot - change - 30 Dec 2016
Category Libraries
avatar andrepereiradasilva
andrepereiradasilva - comment - 30 Dec 2016

@infograf768 please test

avatar andrepereiradasilva andrepereiradasilva - change - 30 Dec 2016
Title
Proper escaping in toolbar button strings
Proper escaping in toolbar button js strings
avatar andrepereiradasilva andrepereiradasilva - edited - 30 Dec 2016
avatar andrepereiradasilva andrepereiradasilva - change - 30 Dec 2016
Title
Proper escaping in toolbar button strings
Proper escaping in toolbar button js strings
avatar andrepereiradasilva andrepereiradasilva - change - 30 Dec 2016
Labels Added: ?
avatar joomla-cms-bot joomla-cms-bot - change - 30 Dec 2016
Category Libraries Libraries Unit Tests
avatar andrepereiradasilva andrepereiradasilva - change - 30 Dec 2016
Labels Added: ?
avatar yvesh
yvesh - comment - 30 Dec 2016

@andrepereiradasilva Can't you move that inline JavaScript into a script tag / file at all? ;) *duck

avatar dgt41
dgt41 - comment - 30 Dec 2016

@yvesh I'll do that!

avatar andrepereiradasilva
andrepereiradasilva - comment - 30 Dec 2016

ok @dgt41 thanks, with vanilla flavour please ?

avatar dgt41
dgt41 - comment - 30 Dec 2016

@andrepereiradasilva here is my approach (batch button):

<?php
/**
 * @package     Joomla.Site
 * @subpackage  Layout
 *
 * @copyright   Copyright (C) 2005 - 2016 Open Source Matters, Inc. All rights reserved.
 * @license     GNU General Public License version 2 or later; see LICENSE.txt
 */

defined('JPATH_BASE') or die;

JHtml::_('behavior.core');

$title = $displayData['title'];
$message = JText::script('JLIB_HTML_PLEASE_MAKE_A_SELECTION_FROM_THE_LIST');

JFactory::getDocument()->addScriptDeclaration(
<<<JS
document.addEventListener("DOMContentLoaded", function() {
	var toolbarButtons = document.querySelectorAll("button.js-toolbar");
	for (var i = 0, j = toolbarButtons.length; i < j; i++) {
		toolbarButtons[i].addEventListener('click', function(e) {
			if (e.target.getAttribute('data-button') === "batch") {
				if (document.adminForm.boxchecked.value === 0) {
					alert(Joomla.JText._("JLIB_HTML_PLEASE_MAKE_A_SELECTION_FROM_THE_LIST"));
				} else{
					jQuery('#collapseModal' ).modal('show');
					return true;
				}
			}
		})
	}
});
JS
)
?>
<button class="btn btn-small js-toolbar" data-button="batch" data-toggle="modal">
	<span class="icon-checkbox-partial" title="<?php echo $title; ?>"></span>
	<?php echo $title; ?>
</button>

Don't mind the inline script, this would be one static toolbar.js file that will cover all the buttons

@andrepereiradasilva @yvesh do you approve the approach?

avatar infograf768
infograf768 - comment - 2 Jan 2017

We have other similar issues in other places than toolbar, where adding a simple true solves the double quotes.
Example: https://github.com/joomla/joomla-cms/blob/staging/plugins/installer/packageinstaller/tmpl/default.php#L22

alert("' . JText::_('PLG_INSTALLER_PACKAGEINSTALLER_NO_PACKAGE', true) . '");

avatar andrepereiradasilva
andrepereiradasilva - comment - 2 Jan 2017

@andrepereiradasilva @yvesh do you approve the approach?

as long toolbar B/C is preserved for me is ok.
Also if you use DOMContentLoaded you need to add the event polyfill for ie8. BTW what do you think of convert the alert in a joomla error message?

We have other similar issues in other places than toolbar, where adding a simple true solves the double quotes.

yes, a quick fix would be set that to "true", because JText::_() has that option exactly for when dump text string from php directly to inline JS code
See https://github.com/joomla/joomla-cms/blob/staging/libraries/joomla/language/text.php#L44

JText::script() AFAIK already escapes the js strings because in 3.7.0 it uses the JDocument::addScriptOptions method which is rendered with json_encode and IMHO is the most correct way to send text vars to js, in that case no need to escape them.
See https://github.com/joomla/joomla-cms/blob/staging/libraries/joomla/language/text.php#L404
And https://github.com/joomla/joomla-cms/blob/staging/libraries/joomla/document/renderer/html/head.php#L239

avatar yvesh
yvesh - comment - 2 Jan 2017

Also if you use DOMContentLoaded you need to add the event polyfill for ie8. BTW what do you think of convert the alert in a joomla error message?

+1! We should get rid of all alerts if possible.

@dgt41 good work! Only a bit code style (missing space after else etc).

http://php.net/manual/de/language.types.string.php#language.types.string.syntax.nowdoc

avatar franz-wohlkoenig
franz-wohlkoenig - comment - 2 Jan 2017

I have tested this item successfully on 62276ea

Test 2 times (on "Articles" and "Menu").


This comment was created with the J!Tracker Application at issues.joomla.org/tracker/joomla-cms/13425.

avatar franz-wohlkoenig franz-wohlkoenig - test_item - 2 Jan 2017 - Tested successfully
avatar infograf768
infograf768 - comment - 3 Jan 2017

@andrepereiradasilva Batch should be added in this PR.
I will make now a PR for other instances of alert

avatar infograf768
infograf768 - comment - 3 Jan 2017

Please also test these
#13455

avatar anibalsanchez
anibalsanchez - comment - 4 Jan 2017

I have tested this item successfully on 62276ea

Test OK


This comment was created with the J!Tracker Application at issues.joomla.org/tracker/joomla-cms/13425.

avatar anibalsanchez anibalsanchez - test_item - 4 Jan 2017 - Tested successfully
avatar jeckodevelopment jeckodevelopment - change - 4 Jan 2017
Status Pending Ready to Commit
Labels
avatar jeckodevelopment
jeckodevelopment - comment - 4 Jan 2017

RTC


This comment was created with the J!Tracker Application at issues.joomla.org/tracker/joomla-cms/13425.

avatar infograf768
infograf768 - comment - 5 Jan 2017

This should not be RTCed. It misses the code for toolbar batch button.
Please @andrepereiradasilva complete this patch.

avatar infograf768
infograf768 - comment - 5 Jan 2017
avatar joomla-cms-bot joomla-cms-bot - change - 5 Jan 2017
Category Libraries Unit Tests Layout Libraries Unit Tests
avatar andrepereiradasilva
andrepereiradasilva - comment - 5 Jan 2017

patch added

avatar infograf768
infograf768 - comment - 5 Jan 2017

I have tested this item successfully on b29be08


This comment was created with the J!Tracker Application at issues.joomla.org/tracker/joomla-cms/13425.

avatar infograf768 infograf768 - test_item - 5 Jan 2017 - Tested successfully
avatar rdeutz rdeutz - close - 5 Jan 2017
avatar rdeutz rdeutz - merge - 5 Jan 2017
avatar rdeutz rdeutz - change - 5 Jan 2017
Status Ready to Commit Fixed in Code Base
Closed_Date 0000-00-00 00:00:00 2017-01-05 12:28:11
Closed_By rdeutz

Add a Comment

Login with GitHub to post a comment