You are viewing a plain text version of this content. The canonical link for it is here.
Posted to issues@struts.apache.org by "Juan Duran (JIRA)" <ji...@apache.org> on 2007/08/29 23:16:35 UTC
[jira] Created: (STR-3092) org.apache.struts.taglib.html.ErrorsTag
should filter arguments for html display
org.apache.struts.taglib.html.ErrorsTag should filter arguments for html display
--------------------------------------------------------------------------------
Key: STR-3092
URL: https://issues.apache.org/struts/browse/STR-3092
Project: Struts 1
Issue Type: Improvement
Components: Taglibs
Environment: not sure about this field
Reporter: Juan Duran
Priority: Minor
Unlike bean:write, html:errors doesn't filter for html the arguments that may go along the message.
In my opinion, those arguments should be filtered for html by default as this is the purpose of the ErrorsTag (to display in html).
Sometimes we may want to include the user input in the error message after some validation. For example, say I want to validate that a nameserver is a valid registered nameserver. I would take the user input , run the validation service and would like my error message to be declared in the resources file as:
error.invalid.dns={0} is not a registered nameserver
if the user wants to screw my display, then he may enter something like "seehowthislooks<hr>" The html element doesn't get filtered out.
I believe ErrorsTag should make use of TagUtils.filter(value) in the doStartTag method (which is used by org.apache.struts.taglib.bean.WriteTag). that would take care of this issue.
workaround
----------------
Of course, we could do the filter before creating the error (ActionMessage), but it would be nice to have this feature just as it happens with bean:write
Thanks!
--
This message is automatically generated by JIRA.
-
You can reply to this email to add a comment to the issue online.
[jira] Commented: (STR-3092) ErrorsTag should filter arguments for
html display
Posted by "Juan Duran (JIRA)" <ji...@apache.org>.
[ https://issues.apache.org/struts/browse/STR-3092?page=com.atlassian.jira.plugin.system.issuetabpanels:comment-tabpanel#action_42073 ]
Juan Duran commented on STR-3092:
---------------------------------
Don't you think that would imply loss of functionality? the messages tag doesn't have the suffix and prefix properties.
Besides, messages tag is used for general purpose messages. Not only errors. so if you want to say display an error in red, how would you know if it is an error if it is invoked by the messages tag?
i perfectly could have something like this in the body of some jsp:
<p style="font-color:red"><html:errors /></p>
<p><html:messages '></p>
This way errors are displayed in red and general messages in the current font.
what do you think?
> ErrorsTag should filter arguments for html display
> --------------------------------------------------
>
> Key: STR-3092
> URL: https://issues.apache.org/struts/browse/STR-3092
> Project: Struts 1
> Issue Type: Improvement
> Components: Taglibs
> Affects Versions: 1.1.1
> Reporter: Juan Duran
> Assignee: Paul Benedict
> Priority: Minor
>
> Unlike bean:write, html:errors doesn't filter for html the arguments that may go along the message.
> In my opinion, those arguments should be filtered for html by default as this is the purpose of the ErrorsTag (to display in html).
> Sometimes we may want to include the user input in the error message after some validation. For example, say I want to validate that a nameserver is a valid registered nameserver. I would take the user input , run the validation service and would like my error message to be declared in the resources file as:
> error.invalid.dns={0} is not a registered nameserver
> if the user wants to screw my display, then he may enter something like "seehowthislooks<hr>" The html element doesn't get filtered out.
> I believe ErrorsTag should make use of TagUtils.filter(value) in the doStartTag method (which is used by org.apache.struts.taglib.bean.WriteTag). that would take care of this issue.
> workaround
> ----------------
> Of course, we could do the filter before creating the error (ActionMessage), but it would be nice to have this feature just as it happens with bean:write
> Thanks!
--
This message is automatically generated by JIRA.
-
You can reply to this email to add a comment to the issue online.
[jira] Updated: (STR-3092) ErrorsTag should filter arguments for
html display
Posted by "Paul Benedict (JIRA)" <ji...@apache.org>.
[ https://issues.apache.org/struts/browse/STR-3092?page=com.atlassian.jira.plugin.system.issuetabpanels:all-tabpanel ]
Paul Benedict updated STR-3092:
-------------------------------
Environment: (was: not sure about this field)
Affects Version/s: 1.1.1
Fix Version/s: 1.4.0
Assignee: Paul Benedict
Summary: ErrorsTag should filter arguments for html display (was: org.apache.struts.taglib.html.ErrorsTag should filter arguments for html display)
> ErrorsTag should filter arguments for html display
> --------------------------------------------------
>
> Key: STR-3092
> URL: https://issues.apache.org/struts/browse/STR-3092
> Project: Struts 1
> Issue Type: Improvement
> Components: Taglibs
> Affects Versions: 1.1.1
> Reporter: Juan Duran
> Assignee: Paul Benedict
> Priority: Minor
> Fix For: 1.4.0
>
>
> Unlike bean:write, html:errors doesn't filter for html the arguments that may go along the message.
> In my opinion, those arguments should be filtered for html by default as this is the purpose of the ErrorsTag (to display in html).
> Sometimes we may want to include the user input in the error message after some validation. For example, say I want to validate that a nameserver is a valid registered nameserver. I would take the user input , run the validation service and would like my error message to be declared in the resources file as:
> error.invalid.dns={0} is not a registered nameserver
> if the user wants to screw my display, then he may enter something like "seehowthislooks<hr>" The html element doesn't get filtered out.
> I believe ErrorsTag should make use of TagUtils.filter(value) in the doStartTag method (which is used by org.apache.struts.taglib.bean.WriteTag). that would take care of this issue.
> workaround
> ----------------
> Of course, we could do the filter before creating the error (ActionMessage), but it would be nice to have this feature just as it happens with bean:write
> Thanks!
--
This message is automatically generated by JIRA.
-
You can reply to this email to add a comment to the issue online.
[jira] Commented: (STR-3092) ErrorsTag should filter arguments for
html display
Posted by "Juan Duran (JIRA)" <ji...@apache.org>.
[ https://issues.apache.org/struts/browse/STR-3092?page=com.atlassian.jira.plugin.system.issuetabpanels:comment-tabpanel#action_42086 ]
Juan Duran commented on STR-3092:
---------------------------------
I see now Paul, thanks very much for the explanation.
> ErrorsTag should filter arguments for html display
> --------------------------------------------------
>
> Key: STR-3092
> URL: https://issues.apache.org/struts/browse/STR-3092
> Project: Struts 1
> Issue Type: Improvement
> Components: Taglibs
> Affects Versions: 1.1.1
> Reporter: Juan Duran
> Assignee: Paul Benedict
> Priority: Minor
>
> Unlike bean:write, html:errors doesn't filter for html the arguments that may go along the message.
> In my opinion, those arguments should be filtered for html by default as this is the purpose of the ErrorsTag (to display in html).
> Sometimes we may want to include the user input in the error message after some validation. For example, say I want to validate that a nameserver is a valid registered nameserver. I would take the user input , run the validation service and would like my error message to be declared in the resources file as:
> error.invalid.dns={0} is not a registered nameserver
> if the user wants to screw my display, then he may enter something like "seehowthislooks<hr>" The html element doesn't get filtered out.
> I believe ErrorsTag should make use of TagUtils.filter(value) in the doStartTag method (which is used by org.apache.struts.taglib.bean.WriteTag). that would take care of this issue.
> workaround
> ----------------
> Of course, we could do the filter before creating the error (ActionMessage), but it would be nice to have this feature just as it happens with bean:write
> Thanks!
--
This message is automatically generated by JIRA.
-
You can reply to this email to add a comment to the issue online.
[jira] Updated: (STR-3092) ErrorsTag should filter arguments for
html display
Posted by "Paul Benedict (JIRA)" <ji...@apache.org>.
[ https://issues.apache.org/struts/browse/STR-3092?page=com.atlassian.jira.plugin.system.issuetabpanels:all-tabpanel ]
Paul Benedict updated STR-3092:
-------------------------------
Fix Version/s: (was: 1.4.0)
> ErrorsTag should filter arguments for html display
> --------------------------------------------------
>
> Key: STR-3092
> URL: https://issues.apache.org/struts/browse/STR-3092
> Project: Struts 1
> Issue Type: Improvement
> Components: Taglibs
> Affects Versions: 1.1.1
> Reporter: Juan Duran
> Assignee: Paul Benedict
> Priority: Minor
>
> Unlike bean:write, html:errors doesn't filter for html the arguments that may go along the message.
> In my opinion, those arguments should be filtered for html by default as this is the purpose of the ErrorsTag (to display in html).
> Sometimes we may want to include the user input in the error message after some validation. For example, say I want to validate that a nameserver is a valid registered nameserver. I would take the user input , run the validation service and would like my error message to be declared in the resources file as:
> error.invalid.dns={0} is not a registered nameserver
> if the user wants to screw my display, then he may enter something like "seehowthislooks<hr>" The html element doesn't get filtered out.
> I believe ErrorsTag should make use of TagUtils.filter(value) in the doStartTag method (which is used by org.apache.struts.taglib.bean.WriteTag). that would take care of this issue.
> workaround
> ----------------
> Of course, we could do the filter before creating the error (ActionMessage), but it would be nice to have this feature just as it happens with bean:write
> Thanks!
--
This message is automatically generated by JIRA.
-
You can reply to this email to add a comment to the issue online.
[jira] Commented: (STR-3092) ErrorsTag should filter arguments for
html display
Posted by "Paul Benedict (JIRA)" <ji...@apache.org>.
[ https://issues.apache.org/struts/browse/STR-3092?page=com.atlassian.jira.plugin.system.issuetabpanels:comment-tabpanel#action_42094 ]
Paul Benedict commented on STR-3092:
------------------------------------
You're welcome. I hope you continue supporting Struts with proposals :-) It helps the community a lot. Thanks.
> ErrorsTag should filter arguments for html display
> --------------------------------------------------
>
> Key: STR-3092
> URL: https://issues.apache.org/struts/browse/STR-3092
> Project: Struts 1
> Issue Type: Improvement
> Components: Taglibs
> Affects Versions: 1.1.1
> Reporter: Juan Duran
> Assignee: Paul Benedict
> Priority: Minor
>
> Unlike bean:write, html:errors doesn't filter for html the arguments that may go along the message.
> In my opinion, those arguments should be filtered for html by default as this is the purpose of the ErrorsTag (to display in html).
> Sometimes we may want to include the user input in the error message after some validation. For example, say I want to validate that a nameserver is a valid registered nameserver. I would take the user input , run the validation service and would like my error message to be declared in the resources file as:
> error.invalid.dns={0} is not a registered nameserver
> if the user wants to screw my display, then he may enter something like "seehowthislooks<hr>" The html element doesn't get filtered out.
> I believe ErrorsTag should make use of TagUtils.filter(value) in the doStartTag method (which is used by org.apache.struts.taglib.bean.WriteTag). that would take care of this issue.
> workaround
> ----------------
> Of course, we could do the filter before creating the error (ActionMessage), but it would be nice to have this feature just as it happens with bean:write
> Thanks!
--
This message is automatically generated by JIRA.
-
You can reply to this email to add a comment to the issue online.
[jira] Resolved: (STR-3092) ErrorsTag should filter arguments for
html display
Posted by "Paul Benedict (JIRA)" <ji...@apache.org>.
[ https://issues.apache.org/struts/browse/STR-3092?page=com.atlassian.jira.plugin.system.issuetabpanels:all-tabpanel ]
Paul Benedict resolved STR-3092.
--------------------------------
Resolution: Won't Fix
I am marking this as WONTFIX because the support already exists in MessageTag. I recomend users switch to that tag instead.
> ErrorsTag should filter arguments for html display
> --------------------------------------------------
>
> Key: STR-3092
> URL: https://issues.apache.org/struts/browse/STR-3092
> Project: Struts 1
> Issue Type: Improvement
> Components: Taglibs
> Affects Versions: 1.1.1
> Reporter: Juan Duran
> Assignee: Paul Benedict
> Priority: Minor
> Fix For: 1.4.0
>
>
> Unlike bean:write, html:errors doesn't filter for html the arguments that may go along the message.
> In my opinion, those arguments should be filtered for html by default as this is the purpose of the ErrorsTag (to display in html).
> Sometimes we may want to include the user input in the error message after some validation. For example, say I want to validate that a nameserver is a valid registered nameserver. I would take the user input , run the validation service and would like my error message to be declared in the resources file as:
> error.invalid.dns={0} is not a registered nameserver
> if the user wants to screw my display, then he may enter something like "seehowthislooks<hr>" The html element doesn't get filtered out.
> I believe ErrorsTag should make use of TagUtils.filter(value) in the doStartTag method (which is used by org.apache.struts.taglib.bean.WriteTag). that would take care of this issue.
> workaround
> ----------------
> Of course, we could do the filter before creating the error (ActionMessage), but it would be nice to have this feature just as it happens with bean:write
> Thanks!
--
This message is automatically generated by JIRA.
-
You can reply to this email to add a comment to the issue online.
[jira] Commented: (STR-3092) ErrorsTag should filter arguments for
html display
Posted by "Paul Benedict (JIRA)" <ji...@apache.org>.
[ https://issues.apache.org/struts/browse/STR-3092?page=com.atlassian.jira.plugin.system.issuetabpanels:comment-tabpanel#action_42081 ]
Paul Benedict commented on STR-3092:
------------------------------------
Juan, thanks for your feedback. The MessageTag was introduced into Struts after ErrorTag and is meant to replace it. You can duplicate all the functionality of the ErrorTag with it although the implementation is not identical. Do as follows:
<logic:messagesPresent>
<bean:message key="errors.header" />
<ul class="error">
<html:messages id="error">
<li><c:out value="${error}" /></li>
</html:messages>
</ul>
<bean:message key="errors.footer" />
</logic:messagesPresent>
Wrap that in a JSP fragment to include. So as you can see, the MessageTag gives you greater flexibility to customize the design and look and feel of the error messages.
Paul
> ErrorsTag should filter arguments for html display
> --------------------------------------------------
>
> Key: STR-3092
> URL: https://issues.apache.org/struts/browse/STR-3092
> Project: Struts 1
> Issue Type: Improvement
> Components: Taglibs
> Affects Versions: 1.1.1
> Reporter: Juan Duran
> Assignee: Paul Benedict
> Priority: Minor
>
> Unlike bean:write, html:errors doesn't filter for html the arguments that may go along the message.
> In my opinion, those arguments should be filtered for html by default as this is the purpose of the ErrorsTag (to display in html).
> Sometimes we may want to include the user input in the error message after some validation. For example, say I want to validate that a nameserver is a valid registered nameserver. I would take the user input , run the validation service and would like my error message to be declared in the resources file as:
> error.invalid.dns={0} is not a registered nameserver
> if the user wants to screw my display, then he may enter something like "seehowthislooks<hr>" The html element doesn't get filtered out.
> I believe ErrorsTag should make use of TagUtils.filter(value) in the doStartTag method (which is used by org.apache.struts.taglib.bean.WriteTag). that would take care of this issue.
> workaround
> ----------------
> Of course, we could do the filter before creating the error (ActionMessage), but it would be nice to have this feature just as it happens with bean:write
> Thanks!
--
This message is automatically generated by JIRA.
-
You can reply to this email to add a comment to the issue online.
[jira] Commented: (STR-3092) ErrorsTag should filter arguments for
html display
Posted by "Paul Benedict (JIRA)" <ji...@apache.org>.
[ https://issues.apache.org/struts/browse/STR-3092?page=com.atlassian.jira.plugin.system.issuetabpanels:comment-tabpanel#action_42064 ]
Paul Benedict commented on STR-3092:
------------------------------------
Have you seen STR-1922 ? This could be done for the errors tag too.
> ErrorsTag should filter arguments for html display
> --------------------------------------------------
>
> Key: STR-3092
> URL: https://issues.apache.org/struts/browse/STR-3092
> Project: Struts 1
> Issue Type: Improvement
> Components: Taglibs
> Affects Versions: 1.1.1
> Reporter: Juan Duran
> Assignee: Paul Benedict
> Priority: Minor
> Fix For: 1.4.0
>
>
> Unlike bean:write, html:errors doesn't filter for html the arguments that may go along the message.
> In my opinion, those arguments should be filtered for html by default as this is the purpose of the ErrorsTag (to display in html).
> Sometimes we may want to include the user input in the error message after some validation. For example, say I want to validate that a nameserver is a valid registered nameserver. I would take the user input , run the validation service and would like my error message to be declared in the resources file as:
> error.invalid.dns={0} is not a registered nameserver
> if the user wants to screw my display, then he may enter something like "seehowthislooks<hr>" The html element doesn't get filtered out.
> I believe ErrorsTag should make use of TagUtils.filter(value) in the doStartTag method (which is used by org.apache.struts.taglib.bean.WriteTag). that would take care of this issue.
> workaround
> ----------------
> Of course, we could do the filter before creating the error (ActionMessage), but it would be nice to have this feature just as it happens with bean:write
> Thanks!
--
This message is automatically generated by JIRA.
-
You can reply to this email to add a comment to the issue online.
[jira] Commented: (STR-3092) ErrorsTag should filter arguments for
html display
Posted by "Juan Duran (JIRA)" <ji...@apache.org>.
[ https://issues.apache.org/struts/browse/STR-3092?page=com.atlassian.jira.plugin.system.issuetabpanels:comment-tabpanel#action_42065 ]
Juan Duran commented on STR-3092:
---------------------------------
No I hadn't, and you're right. I did something similar in my project extending ErrorsTag, but your solution is more complete as it implements a new parameter to make the filtering a choice. In my project the escaping on the arguments is the default and can't be changed.
> ErrorsTag should filter arguments for html display
> --------------------------------------------------
>
> Key: STR-3092
> URL: https://issues.apache.org/struts/browse/STR-3092
> Project: Struts 1
> Issue Type: Improvement
> Components: Taglibs
> Affects Versions: 1.1.1
> Reporter: Juan Duran
> Assignee: Paul Benedict
> Priority: Minor
> Fix For: 1.4.0
>
>
> Unlike bean:write, html:errors doesn't filter for html the arguments that may go along the message.
> In my opinion, those arguments should be filtered for html by default as this is the purpose of the ErrorsTag (to display in html).
> Sometimes we may want to include the user input in the error message after some validation. For example, say I want to validate that a nameserver is a valid registered nameserver. I would take the user input , run the validation service and would like my error message to be declared in the resources file as:
> error.invalid.dns={0} is not a registered nameserver
> if the user wants to screw my display, then he may enter something like "seehowthislooks<hr>" The html element doesn't get filtered out.
> I believe ErrorsTag should make use of TagUtils.filter(value) in the doStartTag method (which is used by org.apache.struts.taglib.bean.WriteTag). that would take care of this issue.
> workaround
> ----------------
> Of course, we could do the filter before creating the error (ActionMessage), but it would be nice to have this feature just as it happens with bean:write
> Thanks!
--
This message is automatically generated by JIRA.
-
You can reply to this email to add a comment to the issue online.