(ofbiz-framework) branch trunk updated: Fixed: Do not evaluate the area id and target of the Ajax update areas of forms twice as an expression (OFBIZ-13643)

[mridulpathak]

This is an automated email from the ASF dual-hosted git repository.

mridulpathak pushed a commit to branch trunk
in repository https://gitbox.apache.org/repos/asf/ofbiz-framework.git


The following commit(s) were added to refs/heads/trunk by this push:
     new ec65d95839 Fixed: Do not evaluate the area id and target of the Ajax 
update areas of forms twice as an expression (OFBIZ-13643)
ec65d95839 is described below

commit ec65d958399e9b4a67fd518d82020264545d37f4
Author: Mridul Pathak <mridul...@gmail.com>
AuthorDate: Sun Oct 4 13:01:18 2026 +0530

    Fixed: Do not evaluate the area id and target of the Ajax update areas of 
forms twice as an expression (OFBIZ-13643)
    
    MacroFormRenderer and MacroCommonRenderer created ModelForm.UpdateArea 
objects with the String constructor from values that were already evaluated, 
such as the form id, the background submit refresh target, the target of the 
lookup auto-completer and the target window and target of a link. That 
constructor takes widget expressions, so the area id and the target were 
evaluated a second time when the Ajax parameters were created, and a value that 
comes from the request and contains an e [...]
    
    These update areas are now created with UpdateArea.literal, which takes the 
area id and the target as they are, and a variant of it without parameters was 
added for them. The update areas defined in the widgets are evaluated as before.
---
 .../src/main/java/org/apache/ofbiz/widget/model/ModelForm.java | 10 ++++++++++
 .../ofbiz/widget/renderer/macro/MacroCommonRenderer.java       |  2 +-
 .../apache/ofbiz/widget/renderer/macro/MacroFormRenderer.java  |  4 ++--
 3 files changed, 13 insertions(+), 3 deletions(-)

diff --git 
a/framework/widget/src/main/java/org/apache/ofbiz/widget/model/ModelForm.java 
b/framework/widget/src/main/java/org/apache/ofbiz/widget/model/ModelForm.java
index c666de01ec..0932688789 100644
--- 
a/framework/widget/src/main/java/org/apache/ofbiz/widget/model/ModelForm.java
+++ 
b/framework/widget/src/main/java/org/apache/ofbiz/widget/model/ModelForm.java
@@ -2393,6 +2393,16 @@ public abstract class ModelForm extends ModelWidget {
             return new UpdateArea(eventType, areaId, areaTarget, 
parameterList, true);
         }
 
+        /** Creates an update area without parameters whose area id and target 
are already evaluated values, so that they
+         * are taken literally and never evaluated as an expression.
+         * @param areaId The evaluated id of the widget element to be updated
+         * @param areaTarget The evaluated target URL called to update the area
+         * @return the update area
+         */
+        public static UpdateArea literal(String eventType, String areaId, 
String areaTarget) {
+            return new UpdateArea(eventType, areaId, areaTarget, 
Collections.emptyList(), true);
+        }
+
         @Override
         public boolean equals(Object obj) {
             return obj instanceof UpdateArea && obj.hashCode() == 
this.hashCode();
diff --git 
a/framework/widget/src/main/java/org/apache/ofbiz/widget/renderer/macro/MacroCommonRenderer.java
 
b/framework/widget/src/main/java/org/apache/ofbiz/widget/renderer/macro/MacroCommonRenderer.java
index 994cd7b2ae..8be5547151 100644
--- 
a/framework/widget/src/main/java/org/apache/ofbiz/widget/renderer/macro/MacroCommonRenderer.java
+++ 
b/framework/widget/src/main/java/org/apache/ofbiz/widget/renderer/macro/MacroCommonRenderer.java
@@ -131,7 +131,7 @@ public class MacroCommonRenderer {
         HttpServletResponse response = (HttpServletResponse) 
context.get("response");
         switch (linkType) {
         case "update-area":
-            ModelForm.UpdateArea resolveUpdateArea = new 
ModelForm.UpdateArea("onclick",
+            ModelForm.UpdateArea resolveUpdateArea = 
ModelForm.UpdateArea.literal("onclick",
                     
WidgetWorker.getScreenStack(context).resolveScreenAreaId(link.getTargetWindow(context)),
                     link.getTarget(context));
             linkUrl = 
createAjaxParamsFromUpdateAreas(UtilMisc.toList(resolveUpdateArea),
diff --git 
a/framework/widget/src/main/java/org/apache/ofbiz/widget/renderer/macro/MacroFormRenderer.java
 
b/framework/widget/src/main/java/org/apache/ofbiz/widget/renderer/macro/MacroFormRenderer.java
index 6697df3d4e..87994dd20b 100644
--- 
a/framework/widget/src/main/java/org/apache/ofbiz/widget/renderer/macro/MacroFormRenderer.java
+++ 
b/framework/widget/src/main/java/org/apache/ofbiz/widget/renderer/macro/MacroFormRenderer.java
@@ -485,7 +485,7 @@ public final class MacroFormRenderer implements 
FormStringRenderer {
         String backgroundSubmitRefreshTarget = 
submitField.getBackgroundSubmitRefreshTarget(context);
         ModelForm.UpdateArea jwtCallback = 
ModelForm.UpdateArea.fromJwtToken(context);
         if (UtilValidate.isNotEmpty(backgroundSubmitRefreshTarget)) {
-            updateAreas.add(new ModelForm.UpdateArea("submit", formId, 
backgroundSubmitRefreshTarget));
+            updateAreas.add(ModelForm.UpdateArea.literal("submit", formId, 
backgroundSubmitRefreshTarget));
         }
 
         // In context a callback is present and no other update area to call 
after the submit, so trigger it.
@@ -1436,7 +1436,7 @@ public final class MacroFormRenderer implements 
FormStringRenderer {
             }
             autoCompleterTarget = autoCompleterTarget + "ajaxLookup=Y";
             updateAreas = new LinkedList<>();
-            updateAreas.add(new ModelForm.UpdateArea("change", id, 
autoCompleterTarget));
+            updateAreas.add(ModelForm.UpdateArea.literal("change", id, 
autoCompleterTarget));
         }
         boolean ajaxEnabled = UtilValidate.isNotEmpty(updateAreas) && 
this.javaScriptEnabled;
         String autocomplete = "";