arturobernalg opened a new pull request, #560: URL: https://github.com/apache/jspwiki/pull/560
JSPWIKI-1130: with jspwiki.translatorReader.allowHTML=true, a page with a script that calls document.writeln replaces the whole editor page as soon as the preview arrives. Cause: the preview in Wiki.Edit.js is loaded with MooTools Request.HTML, whose evalScripts option is true by default, so the scripts of the preview response are run. The change passes evalScripts false in that request. It is the only place that renders a preview with Request.HTML; the other preview helper, getXHRPreview, sets the response as text. Measured in the browser on a Tomcat 10.1 instance with allowHTML=true and a page with the If plugin around a script that calls document.writeln: Before: opening the page in the editor leaves only the output of the script on screen. After, with the war built from this branch and the scripts reloaded: the editor stays, the text area holds the page text and the preview shows the page without running the script. The browser keeps the old scripts in its cache after a new war is deployed, so the first try after deploying still showed the old behaviour until the scripts were reloaded. Tests: there is no automated test, the scripts have none in this repository and the check above was done by hand. The effect on plugins that rely on scripts in the preview is not measured: they will not run in the preview, as the issue suggests, and they still run on the saved page. The ChangeLog has the entry. -- This is an automated message from the Apache Git Service. To respond to the message, please log on to GitHub and use the URL above to go to the specific comment. To unsubscribe, e-mail: [email protected] For queries about this service, please contact Infrastructure at: [email protected]
