[
https://issues.apache.org/jira/browse/JSPWIKI-1130?page=com.atlassian.jira.plugin.system.issuetabpanels:comment-tabpanel&focusedCommentId=18134046#comment-18134046
]
Arturo Bernal commented on JSPWIKI-1130:
----------------------------------------
Reproduced with the current code (master plus an unrelated parser change,
Tomcat 10.1) with jspwiki.translatorReader.allowHTML=true and a page with the
If plugin around a script that calls document.writeln. Opening the page in the
editor replaces the whole editor page with the output of the script.
The preview request is made in Wiki.Edit.js, function livepreview, with
MooTools Request.HTML. Its option evalScripts is true by default, so the
scripts of the preview response are run, and document.writeln after the page
has loaded replaces the document. Measured in the browser on the editor page:
with the default, typing the script text into the editor leaves only the script
output. With Request.HTML.prototype.options.evalScripts set to false before the
preview is triggered, the editor stays and the preview is rendered (the script
is not run and is not part of the preview).
A fix would pass evalScripts false in that request, which matches the
suggestion in the description to disable JavaScript during preview. The effect
on plugins that rely on scripts in the preview is not measured. No pull request
yet.
> Preview doesn't handle embedded JavaScript correctly
> ----------------------------------------------------
>
> Key: JSPWIKI-1130
> URL: https://issues.apache.org/jira/browse/JSPWIKI-1130
> Project: JSPWiki
> Issue Type: Bug
> Components: Editors
> Affects Versions: 2.11.0-M6
> Reporter: Ulf Dittmer
> Priority: Minor
>
> If "jspwiki.translatorReader.allowHTML = true", JavaScript can be inserted
> into a page and executed like this:
> [{If page='SandBox' exists='true'
> <script language="javascript">document.writeln("<b>User Agent: </b>" +
> navigator.userAgent);</script>}]
> However, if preview is turned on during editing, executing the JavaScript
> interferes with the editor, replacing the editor page with the output of the
> code execution. I'm not sure whether it's possible to fix this while still
> trying to execute JavaScript. If not, disabling JavaScript during preview
> seems fine.
> [https://jspwiki-wiki.apache.org/Wiki.jsp?page=TESTEST] also shows this.
--
This message was sent by Atlassian Jira
(v10.3.26#10030026)
