Uploaded image for project: 'In-Portal CMS'
  1. In-Portal CMS
  2. INP-1022

Don't use "javascript:" protocol in "href" attribute of links, that open item selectors

    XMLWordPrintable

    Details

      Description

      In Admin Console In-Portal uses "env" request variable to pass important information (usually a set of unit config prefixes and IDs associated with them) across all pages, e.g. /admin/index.php?env=index:m01s:u----- ("m" and "u" are unit config prefixes).

      As you can see from example above a dash ("") is used as a separator between different IDs. But in case if ID contains a dash itself, then this dash is escaped like this /admin/index.php?env=-index:m01s:user-prefix-----.

      When such url is used by JavaScript it removes all "\" from it (since it's an escape character in JavaScript too). After that parsing that "env" request parameter becomes impossible because of single prefix would interpreted as 2 different prefixes resulting in Fatal Error on prefix existence checking code.

      Below are examples how to property pass such urls to openSelector function:

      [b]How not to do it:[/b]
      javascript:openSelector('conf', '<inp2:adm_SelectorLink prefix="conf" selection_mode="single" tab_prefixes="none"/>', 'ModuleRootCategory', '950x600');

      [b]How to do it:[/b]
      <inp2:adm_SelectorLink prefix='conf' selection_mode='single' tab_prefixes='none'/>" onclick="openSelector('conf', this.href, 'ModuleRootCategory', '950x600'); return false;

      [b]How it was fixed:[/b]
      1. 2nd parameter (url) of openSelector function moved into "href" attribute of A html tag
      2. former "href" attribute of A html tag was renamed to "onclick" attribute and "return false;" was added
      3. this.href is used instead of url in a string, which keeps "\" intact even without a need for "js_escape" tag parameter

        Attachments

          Issue Links

            Activity

              People

              • Assignee:
                alex Alex
                Reporter:
                alex Alex
                Developer:
                Alex
              • Votes:
                0 Vote for this issue
                Watchers:
                0 Start watching this issue

                Dates

                • Created:
                  Updated:
                  Resolved: