You are here: Foswiki>Tasks Web>Item386 (22 Feb 2009, KennethLavrsen)Edit Attach

Item386: Form.pm calls javascript function launchWindow

pencil
Priority: Urgent
Current State: Closed
Released In: 1.0.0
Target Release: patch
Applies To: Engine
Component:
Branches:
Reported By: Foswiki:Main.ArthurClemens
Waiting For:
Last Change By: KennethLavrsen
A lib file should not assume javascript. Especially because this is inserted in default skin that does not load any javascript .Line 280 in Form.pm
Agreed; and because of the potential for a XSS exploit by this route, I'm confirming it and raising it to Urgent.

The obvious solution is to template the function.


The correct way is to use unobtrusive javascript, as with BehaviourContrib or JQuery.

Looking at it I couldn't see the point of having the function call at all. The target attribute should suffice for that application.

-- CrawfordCurrie - 11 Dec 2008

Except when we want to conform to strict XHTML.

-- ArthurClemens - 11 Dec 2008

Ho ho ho that's a good one!

-- CrawfordCurrie - 11 Dec 2008

ItemTemplate edit

Summary Form.pm calls javascript function launchWindow
ReportedBy Foswiki:Main.ArthurClemens
Codebase
SVN Range SVN 1155: Foswiki-0.9.0, Tue, 02 Dec 2008, build 1127
AppliesTo Engine
Component
Priority Urgent
CurrentState Closed
WaitingFor
Checkins distro:4e85a0a47cc6 distro:d79a916dee7f distro:396c86b94938
TargetRelease patch
ReleasedIn 1.0.0
Topic revision: r11 - 22 Feb 2009, KennethLavrsen
The copyright of the content on this website is held by the contributing authors, except where stated elsewhere. See Copyright Statement. Creative Commons License    Legal Imprint    Privacy Policy