[
https://issues.apache.org/jira/browse/WW-5774?page=com.atlassian.jira.plugin.system.issuetabpanels:comment-tabpanel&focusedCommentId=18137932#comment-18137932
]
Lukasz Lenart commented on WW-5774:
-----------------------------------
Migration note for 7.5.0 (from [PR
#2074|https://github.com/apache/struts/pull/2074]):
The page-global {{autoPopulate_<escapedId>(element)}} function that the
{{combobox}} tag emitted is gone. A combobox's text field is now updated by a
single delegated {{change}} listener in the static {{combobox.js}}, driven by
{{data-struts-*}} attributes on the select:
* {{data-struts-combobox-target-id}} – id of the text field the selected value
is copied into
* {{data-struts-header-key}} – rendered only when {{headerKey}} and
{{headerValue}} are set; the header option is not copied
* {{data-struts-empty-option}} – rendered only when {{emptyOption}} is true;
the empty option is not copied
The combobox no longer emits any inline script, so it works under a CSP that
allows only static scripts or script hashes.
Application JavaScript that called {{autoPopulate_<id>(...)}} after setting
{{selectedIndex}} gets a {{ReferenceError}} on 7.5.0. Dispatch a {{change}}
event on the select instead, or set the text field directly:
{code:javascript}select.selectedIndex = 2;
select.dispatchEvent(new Event('change', { bubbles: true }));
{code}
{{data-struts-combobox}} stays on the select as a public styling and scripting
hook.
> Move combobox change handling into a static script with a delegated listener
> ----------------------------------------------------------------------------
>
> Key: WW-5774
> URL: https://issues.apache.org/jira/browse/WW-5774
> Project: Struts 2
> Issue Type: Improvement
> Components: Core Tags
> Reporter: Lukasz Lenart
> Priority: Major
> Fix For: 7.5.0
>
> Time Spent: 50m
> Remaining Estimate: 0h
>
> h2. Problem
> After WW-5772 the transfer-select and updownselect tags bind their buttons
> from a static script through one delegated listener. The combobox tag removes
> its inline {{onChange}} too, but it does so by emitting a per-instance inline
> script block (through the {{s.script}} directive, so it carries the nonce)
> that binds every select marked with {{data-struts-combobox}}.
> That leaves three issues:
> * A Content-Security-Policy based on script hashes or on static scripts only
> still blocks the combobox, while the transfer selects work under it.
> * The binding block is duplicated verbatim in
> {{template/simple/combobox.ftl}} and {{template/html5/combobox.ftl}}, so any
> change has to be made twice.
> * N comboboxes rendered in an iterator emit N script blocks, each scanning
> the page with {{querySelectorAll}}, plus N redefinitions of the
> {{autoPopulate_}} function.
> h2. Proposal
> Add a static {{combobox.js}} with a single delegated {{change}} listener that
> reads the target field from data attributes on the select, matching the
> approach WW-5772 uses for the transfer selects. The templates then emit no
> per-instance inline script.
> Related: WW-5772
--
This message was sent by Atlassian Jira
(v10.3.26#10030026)
