[
https://issues.apache.org/jira/browse/WW-5774?focusedWorklogId=1051702&page=com.atlassian.jira.plugin.system.issuetabpanels:worklog-tabpanel#worklog-1051702
]
ASF GitHub Bot logged work on WW-5774:
--------------------------------------
Author: ASF GitHub Bot
Created on: 01/Nov/26 07:37
Start Date: 01/Nov/26 07:37
Worklog Time Spent: 10m
Work Description: emilhuseyn commented on PR #2074:
URL: https://github.com/apache/struts/pull/2074#issuecomment-6555048282
Thanks for the detailed pass. Addressed the three before-merge items:
- **RadioNodeList.** `combobox.js` now resolves the first text `INPUT` when
`form.elements[target]` is a `RadioNodeList` (two controls in the form share
the name), instead of assigning `value` to the list, which silently did nothing.
- **html5 fixture.** Added `testHtml5ThemeRendersDataAttributes` with a
`ComboBox-5` html5-theme fixture asserting `data-struts-combobox-target` /
`data-struts-header-key` / `data-struts-empty-option`, which the `xhtml ->
simple` fixtures never exercised.
- **Migration (7.5.0 notes).** The page-global
`autoPopulate_<escapedId>(element)` function is gone; the text field is now
updated by a single delegated `change` listener on the document, driven by the
`data-struts-*` attributes. Application JS that called `autoPopulate_<id>(...)`
after setting `selectedIndex` will get a `ReferenceError` on 7.5.0 and should
dispatch a `change` event on the select (or set the field directly) instead.
Of 4-7 I took 5 and 6: the `combobox.js` include now sits inside the `<#if
attributes.list??>` guard right before the `select`, and the tests are renamed
to `testDataAttributeUsesEscapedId` (there is no JS call any more; the escaped
id lands in `data-struts-combobox`). I kept `data-struts-combobox` (7) and will
note it as a public styling/scripting hook - it carries the escaped id and the
sanitisation test anchors on it.
For 4 (N `<script src>` tags), please open a WW ticket: it is the same
pattern in `inputtransferselect`/`updownselect`/`utils.js`, so a per-request
de-dup in the `Script` component fits better than a per-template fix. The
window guard already stops repeated execution, so this is redundant tags rather
than repeated runs.
Issue Time Tracking
-------------------
Worklog Id: (was: 1051702)
Time Spent: 0.5h (was: 20m)
> Move combobox change handling into a static script with a delegated listener
> ----------------------------------------------------------------------------
>
> Key: WW-5774
> URL: https://issues.apache.org/jira/browse/WW-5774
> Project: Struts 2
> Issue Type: Improvement
> Components: Core Tags
> Reporter: Lukasz Lenart
> Priority: Major
> Fix For: 7.5.0
>
> Time Spent: 0.5h
> Remaining Estimate: 0h
>
> h2. Problem
> After WW-5772 the transfer-select and updownselect tags bind their buttons
> from a static script through one delegated listener. The combobox tag removes
> its inline {{onChange}} too, but it does so by emitting a per-instance inline
> script block (through the {{s.script}} directive, so it carries the nonce)
> that binds every select marked with {{data-struts-combobox}}.
> That leaves three issues:
> * A Content-Security-Policy based on script hashes or on static scripts only
> still blocks the combobox, while the transfer selects work under it.
> * The binding block is duplicated verbatim in
> {{template/simple/combobox.ftl}} and {{template/html5/combobox.ftl}}, so any
> change has to be made twice.
> * N comboboxes rendered in an iterator emit N script blocks, each scanning
> the page with {{querySelectorAll}}, plus N redefinitions of the
> {{autoPopulate_}} function.
> h2. Proposal
> Add a static {{combobox.js}} with a single delegated {{change}} listener that
> reads the target field from data attributes on the select, matching the
> approach WW-5772 uses for the transfer selects. The templates then emit no
> per-instance inline script.
> Related: WW-5772
--
This message was sent by Atlassian Jira
(v10.3.26#10030026)
