[jira] Updated: (OFBIZ-1133) Unescaped quotes break lookup screens functionality

["Christian Geisert (JIRA)" <ji...@apache.org>]

     [ https://issues.apache.org/jira/browse/OFBIZ-1133?page=com.atlassian.jira.plugin.system.issuetabpanels:all-tabpanel ]

Christian Geisert updated OFBIZ-1133:
-------------------------------------

    Attachment: patch_ofbiz_LookupProductAndPrice-branch.diff
                patch_ofbiz_LookupProductAndPrice-trunk.diff

I think the second parameter (internalName) should be removed in any case as it isn't used anywhere (and call_fieldlookup2 supports  one field only...) and  this will solve the problem most of the time (IDs are already checked for problematic characters at creation)

I've attached a patches for trunk and branch.

It seems LookupProduct has the same problem, I'll check if it's save to remove the internalName from there.

> Unescaped quotes break lookup screens functionality
> ---------------------------------------------------
>
>                 Key: OFBIZ-1133
>                 URL: https://issues.apache.org/jira/browse/OFBIZ-1133
>             Project: OFBiz
>          Issue Type: Bug
>    Affects Versions: SVN trunk, Release Branch 4.0
>            Reporter: Oleg Andreyev
>            Priority: Minor
>             Fix For: SVN trunk
>
>         Attachments: patch_ofbiz_LookupProductAndPrice-branch.diff, patch_ofbiz_LookupProductAndPrice-trunk.diff
>
>
> Example, it's impossible to select product in LookupProductAndPrice (used in EditQuoteItem) if product internal name contains quotas or apostrophe. The reason is obvious. The script "javascript:set_values('10112', 'Test product - Monitor 17", gray')" has error, unnecessary quote. I think the problem is common.
> Simple solution is to remove second parameter. There is no field internalName in opener form. But it's feckless way.
> Have anybody suggestion how rightly correct this problem? Modify HtmlFormRenderer?
> Please explain me why we don't store escaped string in database. This is generally accepted solution.

-- 
This message is automatically generated by JIRA.
-
You can reply to this email to add a comment to the issue online.