[
https://issues.apache.org/jira/browse/WW-5774?focusedWorklogId=1051180&page=com.atlassian.jira.plugin.system.issuetabpanels:worklog-tabpanel#worklog-1051180
]
ASF GitHub Bot logged work on WW-5774:
--------------------------------------
Author: ASF GitHub Bot
Created on: 29/Oct/26 12:57
Start Date: 29/Oct/26 12:57
Worklog Time Spent: 10m
Work Description: emilhuseyn opened a new pull request, #2074:
URL: https://github.com/apache/struts/pull/2074
Fixes [WW-5774](https://issues.apache.org/jira/browse/WW-5774)
After WW-5772 the transfer selects bind their buttons from a static script,
but the combobox still emitted two inline script blocks per instance: an
`autoPopulate_<id>` function and a block that bound every select marked with
`data-struts-combobox`. A CSP based on script hashes or static scripts only
still blocked it, the block was duplicated in the `simple` and `html5` themes,
and N comboboxes in an iterator emitted N blocks.
This follows the ticket's proposal and the WW-5772 pattern:
- New `static/combobox.js` registers one delegated `change` listener per
page, in the capture phase, guarded by `window.strutsComboboxListener`.
- The select carries its settings in data attributes:
`data-struts-combobox-target` (name of the text field),
`data-struts-header-key` (only when `headerKey` and `headerValue` are set) and
`data-struts-empty-option` (only when `emptyOption` is true). The listener
skips the header and empty options exactly as `autoPopulate_<id>` did.
- `template/simple/combobox.ftl` and `template/html5/combobox.ftl` include
the script with `<@s.script src=...>` and emit no per-instance inline script.
`data-struts-combobox` stays on the select.
One visible change: the page no longer defines `autoPopulate_<id>`. It was
only ever called from the framework's own binding block.
`ComboBoxTest` fixtures (`ComboBox-1.txt` to `ComboBox-4.txt`) are updated.
`ComboBoxTest` passes (12/12), and so does the full `core` suite locally on JDK
21.
🤖 Generated with [Claude Code](https://claude.com/claude-code)
Issue Time Tracking
-------------------
Worklog Id: (was: 1051180)
Remaining Estimate: 0h
Time Spent: 10m
> Move combobox change handling into a static script with a delegated listener
> ----------------------------------------------------------------------------
>
> Key: WW-5774
> URL: https://issues.apache.org/jira/browse/WW-5774
> Project: Struts 2
> Issue Type: Improvement
> Components: Core Tags
> Reporter: Lukasz Lenart
> Priority: Major
> Fix For: 7.5.0
>
> Time Spent: 10m
> Remaining Estimate: 0h
>
> h2. Problem
> After WW-5772 the transfer-select and updownselect tags bind their buttons
> from a static script through one delegated listener. The combobox tag removes
> its inline {{onChange}} too, but it does so by emitting a per-instance inline
> script block (through the {{s.script}} directive, so it carries the nonce)
> that binds every select marked with {{data-struts-combobox}}.
> That leaves three issues:
> * A Content-Security-Policy based on script hashes or on static scripts only
> still blocks the combobox, while the transfer selects work under it.
> * The binding block is duplicated verbatim in
> {{template/simple/combobox.ftl}} and {{template/html5/combobox.ftl}}, so any
> change has to be made twice.
> * N comboboxes rendered in an iterator emit N script blocks, each scanning
> the page with {{querySelectorAll}}, plus N redefinitions of the
> {{autoPopulate_}} function.
> h2. Proposal
> Add a static {{combobox.js}} with a single delegated {{change}} listener that
> reads the target field from data attributes on the select, matching the
> approach WW-5772 uses for the transfer selects. The templates then emit no
> per-instance inline script.
> Related: WW-5772
--
This message was sent by Atlassian Jira
(v10.3.26#10030026)
