Repository navigation
JSPWIKI-1130 Do not run the scripts of the page in the preview of the… - #560
Conversation
There was a problem hiding this comment.
I tested this in Firefox, and it works only if the comment on that line is removed. Otherwise, a JavaScript error occurs.
There was a problem hiding this comment.
It's strange, now I can no longer reproduce the earlier problem, with or without the comment. Regardless, this commit works fine now. Sorry about the confusion.
|
Thanks for testing in Firefox, Ulf. I removed the comment, the line is now just evalScripts: false. I could not reproduce the error here: the script with the comment compiles without errors in Firefox 158 and in Node, so I do not know what failed on your side. Could you try the new commit, and if something still fails, tell me the error message from the console and how you built the war (with or without minimize)? |
… editor The preview is loaded with Request.HTML, which runs the scripts of the response by default. With jspwiki.translatorReader.allowHTML=true a script that calls document.writeln replaced the whole editor page once the preview arrived. The preview is now loaded with evalScripts set to false.
bdd6512 to
398b48a
Compare
# Conflicts: # ChangeLog.md
JSPWIKI-1130: with jspwiki.translatorReader.allowHTML=true, a page with a script that calls document.writeln replaces the whole editor page as soon as the preview arrives.
Cause: the preview in Wiki.Edit.js is loaded with MooTools Request.HTML, whose evalScripts option is true by default, so the scripts of the preview response are run. The change passes evalScripts false in that request. It is the only place that renders a preview with Request.HTML; the other preview helper, getXHRPreview, sets the response as text.
Measured in the browser on a Tomcat 10.1 instance with allowHTML=true and a page with the If plugin around a script that calls document.writeln:
Before: opening the page in the editor leaves only the output of the script on screen.
After, with the war built from this branch and the scripts reloaded: the editor stays, the text area holds the page text and the preview shows the page without running the script.
The browser keeps the old scripts in its cache after a new war is deployed, so the first try after deploying still showed the old behaviour until the scripts were reloaded.
Tests: there is no automated test, the scripts have none in this repository and the check above was done by hand. The effect on plugins that rely on scripts in the preview is not measured: they will not run in the preview, as the issue suggests, and they still run on the saved page. The ChangeLog has the entry.