?
avatar buechner-4m
buechner-4m
6 Nov 2017

When I use the component view for the joomla backend I get some JSON Output including the csrf token. This is wrapped and automatically added in a <script type="application/json">-tag in the output.

This script tag is added in HeadRenderer-Class in //librarires/src/Document/Renderer/HtmlHeadRenderer.php on line 246++. So whenever there is data in the variable die script-tag is rendered.

JQuery doesn't bother about the application/json but MooTools Core tries to parse this content as common javascript. Which fails in all browsers as the content is as followed:

'<script type="application/json" class="joomla-script-options new">{"csrf.token":"56XXXXXXXXXXXXXXXXXXXXXXXXXXXXXX76","system.paths":{"root":"","base":"/administrator"}}</script>'

Steps to reproduce the issue

Use the component parameter in a backend request: '&tmpl=component'. (I did this by requesting the output with ajax and then render the content in a popup overlay.) Open the console and you should see an error like: 'SyntaxError: missing ; before statement'. So all the javascript is stopped from execution. Or add my example 'applicaion/json'-line code manually on a template file and look into browser's console.

Expected result

Mootools should ignore the script-tag with type application/json and should only take care of application/javascript tags

Actual result

All javascript code is stopped. (jQuery, inline, etc..)

System information (as much as possible)

Joomla 3.8.1 logged in into backend as administrator.

Additional comments

Update - or more likely - get rid of MooTools. Or - at least - use only one library p.e. jQuery

Votes

# of Users Experiencing Issue
1/1
Average Importance Score
5.00

avatar buechner-4m buechner-4m - open - 6 Nov 2017
avatar joomla-cms-bot joomla-cms-bot - labeled - 6 Nov 2017
avatar franz-wohlkoenig franz-wohlkoenig - change - 6 Nov 2017
Category JavaScript
avatar joomla-cms-bot joomla-cms-bot - edited - 6 Nov 2017
avatar franz-wohlkoenig
franz-wohlkoenig - comment - 7 Nov 2017

Comment by @dgt41?

avatar franz-wohlkoenig franz-wohlkoenig - change - 7 Nov 2017
Status New Information Required
avatar C-Lodder
C-Lodder - comment - 7 Nov 2017

Try downloading the latest version of Mootools. Joomla is quite far behind on this library

Joomla = 1.4.5
Latest = 1.6.0

avatar buechner-4m
buechner-4m - comment - 7 Nov 2017

I just tried to update mootools core which creates a lot more errors in javascipt.

Even when I upgrade mootools more as well, there are still more errors than before.

I didn't expect that a heavily used javascript library can be upgraded so easily. Easiest solution would be to stop the printing of the '<script type="application/json">' by default in the document header section. Or make it possible to disable or reset it manually. As I don't know why this feature is in the core.

avatar franz-wohlkoenig franz-wohlkoenig - change - 7 Nov 2017
Status Information Required Discussion
avatar mbabker
mbabker - comment - 7 Nov 2017

MooTools can't be easily updated because they made major breaks in the 1.5 releases.

Said script tag provides various functionality for our JavaScript API and cannot just be removed.

avatar buechner-4m
buechner-4m - comment - 7 Nov 2017

Maybe you can add a function to manually disable or unset the default output of the json data?

This won't be a breaking change as this is a new function. And It can be called whenever necessary - and only in these cases. So the default behaviour remaines as is.

avatar mbabker
mbabker - comment - 7 Nov 2017

That too would be a bad idea because it would explicitly break scripts and functions relying on the data to be passed in that manner.

As much as I don't want to encourage this, I feel like the only "good" option is to suggest developers write a plugin for the onAfterRender event to remove the element from the rendered page if they really run into cases that they need to remove it, because such a removal is majorly a "do at own risk" thing and because of how easily it can and will break things I couldn't in good faith encourage us to have a new API method which breaks this.

avatar brianteeman
brianteeman - comment - 18 Nov 2017

The real question is why is mootools even being loaded - i thought we had removed all instances

avatar brianteeman
brianteeman - comment - 24 Dec 2017

Closed for the reasons stated by @mbabker above

avatar brianteeman brianteeman - change - 24 Dec 2017
Status Discussion Closed
Closed_Date 0000-00-00 00:00:00 2017-12-24 10:38:40
Closed_By brianteeman
avatar brianteeman brianteeman - close - 24 Dec 2017
avatar dgt41
dgt41 - comment - 24 Dec 2017

i thought we had removed all instances

Unfortunately there is no easy way to remove the mootools modal that is used in xtd-buttons (without breaking a lot of 3rd pd buttons)

Add a Comment

Login with GitHub to post a comment