You are viewing a plain text version of this content. The canonical link for it is here.
Posted to issues@struts.apache.org by "Hudson (Commented) (JIRA)" <ji...@apache.org> on 2011/10/10 21:10:29 UTC
[jira] [Commented] (WW-3047) doubleselect does not escape quotes in
doublelist values
[ https://issues.apache.org/jira/browse/WW-3047?page=com.atlassian.jira.plugin.system.issuetabpanels:comment-tabpanel&focusedCommentId=13124400#comment-13124400 ]
Hudson commented on WW-3047:
----------------------------
Integrated in Struts2 #361 (See [https://builds.apache.org/job/Struts2/361/])
WW-3047 - adds js_script to escape the option label and value
lukaszlenart :
Files :
* /struts/struts2/trunk/core/src/main/resources/template/simple/doubleselect.ftl
> doubleselect does not escape quotes in doublelist values
> --------------------------------------------------------
>
> Key: WW-3047
> URL: https://issues.apache.org/jira/browse/WW-3047
> Project: Struts 2
> Issue Type: Bug
> Affects Versions: 2.0.14
> Environment: Tomcat 5.5.17, Windows XP SP2, Firefox 3.0.7
> Reporter: Lee Clemens
> Assignee: Lukasz Lenart
> Attachments: WW-3047.patch
>
>
> Using:
> <s:doubleselect name="priId" doubleName="subId"
> list="mainList" doubleList="subList"
> listKey="value" doubleListKey="value"
> listValue="label" doubleListValue="label"/>
> mainList is a class which contains getSubList(), which returns a list for the second drop down.
> Both Lists contain classes which contain getValue() and getLabel() methods.
> A quoted value is properly escaped if from the 'list'; however, the 'doublelist' values are not escaped:
> Example of resultant HTML:
> List is escaped:
> <option value="abc">"quotedString"</option>
> However, generated JavaScript for the doubleselect is not escaped:
> FormName_doubleSelectFoo[123][0] = new Option(""quotedString"", "123");
> Which causes the second drop down box to only contain an empty option (presumably from error in JavaScript).
> I haven't tested this to ensure it escapes the Labels, however the same issue may be present there.
--
This message is automatically generated by JIRA.
If you think it was sent incorrectly, please contact your JIRA administrators: https://issues.apache.org/jira/secure/ContactAdministrators!default.jspa
For more information on JIRA, see: http://www.atlassian.com/software/jira