Re: Flow and State of a portlet

[Santiago Gala <sg...@hisitech.com>]

Jean-Christophe Kermagoret wrote:
> Luta, Raphael (VUN) wrote:
> 
>> De : Jean-Christophe Kermagoret [mailto:jck@BabelObjects.Com]
>>  
>>
>>> It's possible to have this kind of behaviour with a javascript 
>>> function that values the "action" and "template" parameter for each 
>>> case. For example :
>>>
>>> function SubmitDefault() {
>>>    form.....action.value = "MyDefaultPortletAction";
>>>    form.....template.value = "MyDefaultTemplate.vm" ;
>>> }
>>>
>>> function SubmitToUpdate() {
>>>    form.....action.value = "MyUpdatePortletAction";
>>>    form.....template.value = "MyUpdateTemplate.vm" ;
>>> }
>>> ...
>>> What are the reasons to use several action and template variables ?
>>>
>>>   
>>
>>
>> You probably don't want to do this in JS, for 3 reasons:
>> - you don't trust your client (and if you do, you should not :)
>> - you can't guarantee that your client will actually execute the
>>  code
>> - you break the MVC pattern by encoding controller information  in 
>> your template and tying your different templates together
>>
>> IMO, you should never explicitely set a template from another
>> one but always abstract your application flow through a "state"
>> that is mapped to a template view by your controller code.
>> It also makes it much easier to validate the current state of the
>> application.
>>
>> -- 
>> Raphaël Luta - raphael@apache.org
>> Jakarta Jetspeed - Enterprise Portal in Java
>> http://jakarta.apache.org/jetspeed/
>>
>> -- 
>> To unsubscribe, e-mail:   
>> <ma...@jakarta.apache.org>
>> For additional commands, e-mail: 
>> <ma...@jakarta.apache.org>
>>
>>  
>>
> I agree with what you are saying but :
> 1 - I can bypass security with hidden fields the same way I could bypass 
> it with JS

I think Raphael speaked more about those annoying "Script error in page, 
line..." Debug or Cancel? dialog boxes than about security. It is 
amazing how many newbies I have seen staring into the Javascript 
debugger in Windows.

> 2 - Almost everybody has javascript enabled

This depends largely on your target. With Javascript you can spoil 
completely the possibility (for instance) of Google indexing your page. 
I've seen quite a few such examples. Or have a page where no link works 
with Mozilla or a Nokia phone, for instance.

> 3 - Using JS is like your hidden fields : designers can change them 
> without breaking anything.
> 
> I still don't see any differences. Where are my glasses :-)
> 

You are introducing unneeded complexity just where you cannot control 
it. (Occam's razor?)

Go look for them, truly. ;-)

> -- 
> Jean-Christophe Kermagoret
> jck@BabelObjects.Com
> 
> 
> -- 
> To unsubscribe, e-mail:   
> <ma...@jakarta.apache.org>
> For additional commands, e-mail: 
> <ma...@jakarta.apache.org>



---------------------------------------------------------------------
To unsubscribe, e-mail: jetspeed-user-unsubscribe@jakarta.apache.org
For additional commands, e-mail: jetspeed-user-help@jakarta.apache.org