MyFacesHack.js bug...

["Barbalace, Richard" <RB...@PARTNERS.ORG>]

Hello.

Last November, I submitted some JavaScript changes for the JSCookMenu component,
which have been incorporated into MyFacesHack.js in the most recent release
(1.1.3).  These lines (23 through 25 of that file), however, were changed
slightly from my original version:
            // Link is a script method
            link = link.replace(/^\w*:A\]\w*:/, "");  // Remove JSF ID
            eval(link);

I think the intent here was to remove the MyFaces ID as well as the
"javascript:" tag before evaluating the code.  This fails, however, for
"mailto:" links, which also use that replacement.  This may also fail in the
rare case that the scripting language specified in the link is something other
than JavaScript.  They may be other cases that fail as well.

Instead of eval'ing the code as above, I recommend reverting to something closer
to my original suggestion.  Here is the corrected code, showing the full
section:
		// changes by Richard J. Barbalace
		if (link.match(/^\w*:A\]\w*:\/\//) != null ) {
			// Link is a URL
			link = link.replace(/^\w*:A\]/, "");  // Remove JSF ID
			window.open (link, target);
		} else if (link.match(/^\w*:A\]\w*:/) != null ) {
			// Link is a script method
			link = link.replace(/^\w*:A\]/, "");  // Remove JSF ID
			window.open (link, '_self');
		} else {
			// Link is a JSF action
			var dummyForm = document.forms[target];
			dummyForm.elements['jscook_action'].value = link;
			dummyForm.submit();

Using the window.open call allows the browser to interpret "javascript:" or
"mailto:" links properly, rather than having to provide special cases for every
possibility in the IF statement itself.  I have tested this successfully on
Firefox and IE on Windows, but more testing would be helpful.

Richard J. Barbalace
Software Developer
Harris Orthopaedics Biomechanics and Biomaterials Laboratory
Massachusetts General Hospital
55 Fruit Street, Jackson 1121
Boston, MA  02114
Tel: 617-726-3607
Fax: 617-726-3883