Re: svn commit: r659454 - in /ofbiz/trunk/framework: example/webapp/example/WEB-INF/ example/webapp/example/WEB-INF/actions/ example/webapp/example/includes/ example/widget/example/ images/webapp/images/ widget/dtd/ widget/src/org/ofbiz/widget/form/ widget...

Fri, 23 May 2008 09:45:34 -0700 


Yes that's a good idea Adrian... would be more generic.
I saw an email between Anil and Jacopo (off-list) related to this and commented on something that is quite important and concerning: if we allow the client/browser to send an entity name and other such fields we are basically opening a huge security hole in that we are allowing anything to request data from the database with no permission checks or anything around it.
In fact, anyone putting OFBiz into production would have this vulnerability right now, so we should really pull this code until we figure out a way to secure this.
To put this in context: for server-side code and parameters and such we allow any sort of query and that code is responsible for "protecting" itself. If a client sends query parameters then we have no way to protect it. 

-David


On May 23, 2008, at 10:26 AM, Adrian Crum wrote:


Anil,
This looks good. One suggestion though - could we use sub-elements for the field element instead of attributes? I found attributes to be limiting in the form widget, so I set things up so that multiple ajax calls can be attached to form events (see the on-event-update- area element). The same might hold true for field events. 

Instead of -

<field name="exampleFeatureId" id-name="exampleFeatureId">
<text server-autocomplete-target="ajaxAutocompleteOptions" server- autocomplete- params = "entityName = ExampleFeature &amp;fieldName=exampleFeatureId&amp;selectFields=[exampleFeatureId, description]&amp;sortByFields=[-exampleFeatureId]"/> 
</field>

Have something like -

<field name="exampleFeatureId" id-name="exampleFeatureId">
 <text/>
<on-event-update-area event-type="change" area- id="exampleFeatureId" area-target="ajaxAutocompleteOptions? entityName = ExampleFeature &amp;fieldName=exampleFeatureId&amp;selectFields=[exampleFeatureId, description]&amp;sortByFields=[-exampleFeatureId]"/> 
</field>
Using this method you can fire multiple ajax events on a single text element.
Also, UtilHttp.java has a method to extract the params from a target, so two separate attributes aren't needed. Check out how it's used in the form renderer. 

-Adrian


[EMAIL PROTECTED] wrote:

Author: apatel
Date: Thu May 22 23:54:15 2008
New Revision: 659454
URL: http://svn.apache.org/viewvc?rev=659454&view=rev
Log:
Fist pass of implementation of Ajax.Autocompleter enhancement for form widget text box. I'll be working on improving this over next few days. 
Added:
   ofbiz/trunk/framework/example/webapp/example/WEB-INF/actions/
ofbiz/trunk/framework/example/webapp/example/WEB-INF/actions/ findExampleFeatures.bsh (with props) 
   ofbiz/trunk/framework/example/webapp/example/includes/
ofbiz/trunk/framework/example/webapp/example/includes/ exampleFeatures.ftl (with props) 
Modified:
ofbiz/trunk/framework/example/webapp/example/WEB-INF/ controller.xml ofbiz/trunk/framework/example/widget/example/ ExampleFeatureScreens.xml 
   ofbiz/trunk/framework/example/widget/example/ExampleForms.xml
   ofbiz/trunk/framework/example/widget/example/ExampleScreens.xml
   ofbiz/trunk/framework/images/webapp/images/selectall.js
   ofbiz/trunk/framework/widget/dtd/widget-form.xsd
ofbiz/trunk/framework/widget/src/org/ofbiz/widget/form/ ModelFormField.java ofbiz/trunk/framework/widget/src/org/ofbiz/widget/html/ HtmlFormRenderer.java Added: ofbiz/trunk/framework/example/webapp/example/WEB-INF/actions/ findExampleFeatures.bsh 
URL: 
http://svn.apache.org/viewvc/ofbiz/trunk/framework/example/webapp/example/WEB-INF/actions/findExampleFeatures.bsh?rev=659454&view=auto
= = = = = = = = = ===================================================================== --- ofbiz/trunk/framework/example/webapp/example/WEB-INF/actions/ findExampleFeatures.bsh (added) +++ ofbiz/trunk/framework/example/webapp/example/WEB-INF/actions/ findExampleFeatures.bsh Thu May 22 23:54:15 2008 
@@ -0,0 +1,27 @@
+import java.sql.Timestamp;
+import java.util.ArrayList;
+import org.ofbiz.entity.GenericValue;
+import org.ofbiz.entity.model.DynamicViewEntity;
+import org.ofbiz.entity.model.ModelKeyMap;
+import org.ofbiz.entity.util.EntityFindOptions;
+import org.ofbiz.entity.util.EntityListIterator;
+import org.ofbiz.entity.condition.*;
+import org.ofbiz.entity.condition.EntityOperator;
+import org.ofbiz.entity.condition.EntityExpr;
+import org.ofbiz.base.util.*;
+import org.ofbiz.service.LocalDispatcher;
+
+andExprs = new ArrayList();
+exampleFeatureId = request.getParameter("exampleFeatureId");
+if (exampleFeatureId != null && exampleFeatureId.length() > 0) {
+ andExprs.add(new EntityExpr(new EntityFunction.UPPER(new EntityFieldValue("exampleFeatureId")), + EntityOperator.LIKE, "%" + exampleFeatureId.toUpperCase() + "%")); 
+}
+
+if (andExprs.size() > 0){
+ entityConditionList = new EntityConditionList(andExprs, EntityOperator.AND); + List features = delegator.findByCondition("ExampleFeature", entityConditionList, null, UtilMisc.toList("-exampleFeatureId")); 
+    // exampleFeatureId list to use in form-widgets
+    System.out.println("featuresfeatures" + features.size());
+    context.put("listIt", features);
+}
Propchange: ofbiz/trunk/framework/example/webapp/example/WEB-INF/ actions/findExampleFeatures.bsh 
------------------------------------------------------------------------------
   svn:eol-style = native
Propchange: ofbiz/trunk/framework/example/webapp/example/WEB-INF/ actions/findExampleFeatures.bsh 
------------------------------------------------------------------------------
   svn:keywords = Date Rev Author URL Id
Propchange: ofbiz/trunk/framework/example/webapp/example/WEB-INF/ actions/findExampleFeatures.bsh 
------------------------------------------------------------------------------
   svn:mime-type = text/plain
Modified: ofbiz/trunk/framework/example/webapp/example/WEB-INF/ controller.xml 
URL: 
http://svn.apache.org/viewvc/ofbiz/trunk/framework/example/webapp/example/WEB-INF/controller.xml?rev=659454&r1=659453&r2=659454&view=diff
= = = = = = = = = ===================================================================== --- ofbiz/trunk/framework/example/webapp/example/WEB-INF/ controller.xml (original) +++ ofbiz/trunk/framework/example/webapp/example/WEB-INF/ controller.xml Thu May 22 23:54:15 2008 
@@ -154,6 +154,11 @@
<response name="success" type="view" value="EditExampleFeatureExampleAppls"/> <response name="error" type="view" value="EditExampleFeatureExampleAppls"/> 
    </request-map>
+    <request-map uri="ExampleFeatureOptions">
+        <security https="true" auth="true"/>
+ <response name="success" type="view" value="ExampleFeatureOptions"/> + <response name="error" type="view" value="ExampleFeatureOptions"/> 
+    </request-map>
<request-map uri="FormWidgetExamples"><security https="true" auth="true"/><response name="success" type="view" value="FormWidgetExamples"/></request-map> 
@@ -178,7 +183,7 @@
<view-map name="FormWidgetExamples" type="screen" page="component://example/widget/example/ FormWidgetExampleScreens.xml#FormWidgetExamples"/> <view-map name="LookupExampleFeature" type="screen" page="component://example/widget/example/ ExampleFeatureScreens.xml#LookupExampleFeature"/> 
-
+ <view-map name="ExampleFeatureOptions" type="screen" page="component://example/widget/example/ ExampleFeatureScreens.xml#ExampleFeatureOptions"/> 
    <!-- ajax view mappings -->
<view-map name="findExampleAjax" type="screen" page="component://example/widget/example/ ExampleAjaxScreens.xml#AjaxExample"/> <view-map name="ListExampleFormOnly" type="screen" page="component://example/widget/example/ ExampleAjaxScreens.xml#ListExampleFormOnly"/> Added: ofbiz/trunk/framework/example/webapp/example/includes/ exampleFeatures.ftl 
URL: 
http://svn.apache.org/viewvc/ofbiz/trunk/framework/example/webapp/example/includes/exampleFeatures.ftl?rev=659454&view=auto
= = = = = = = = = ===================================================================== --- ofbiz/trunk/framework/example/webapp/example/includes/ exampleFeatures.ftl (added) +++ ofbiz/trunk/framework/example/webapp/example/includes/ exampleFeatures.ftl Thu May 22 23:54:15 2008 
@@ -0,0 +1,24 @@
+<#--
+Licensed to the Apache Software Foundation (ASF) under one
+or more contributor license agreements.  See the NOTICE file
+distributed with this work for additional information
+regarding copyright ownership.  The ASF licenses this file
+to you under the Apache License, Version 2.0 (the
+"License"); you may not use this file except in compliance
+with the License.  You may obtain a copy of the License at
+
+http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing,
+software distributed under the License is distributed on an
+"AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY
+KIND, either express or implied.  See the License for the
+specific language governing permissions and limitations
+under the License. <#assign listIt = parameters.listIt>
+-->
+
+<ul>
+  <#list listIt as feature>
+ <li>${feature.exampleFeatureId} <span class="informal"> $ {feature.description}</span></li> 
+  </#list>
+</ul>
Propchange: ofbiz/trunk/framework/example/webapp/example/includes/ exampleFeatures.ftl 
------------------------------------------------------------------------------
   svn:eol-style = native
Propchange: ofbiz/trunk/framework/example/webapp/example/includes/ exampleFeatures.ftl 
------------------------------------------------------------------------------
   svn:keywords = Date Rev Author URL Id
Propchange: ofbiz/trunk/framework/example/webapp/example/includes/ exampleFeatures.ftl 
------------------------------------------------------------------------------
   svn:mime-type = text/plain
Modified: ofbiz/trunk/framework/example/widget/example/ ExampleFeatureScreens.xml 
URL: 
http://svn.apache.org/viewvc/ofbiz/trunk/framework/example/widget/example/ExampleFeatureScreens.xml?rev=659454&r1=659453&r2=659454&view=diff
= = = = = = = = = ===================================================================== --- ofbiz/trunk/framework/example/widget/example/ ExampleFeatureScreens.xml (original) +++ ofbiz/trunk/framework/example/widget/example/ ExampleFeatureScreens.xml Thu May 22 23:54:15 2008 
@@ -74,7 +74,6 @@
            <actions>
<set field="titleProperty" value="PageTitleEditExampleFeatureExampleAppls"/> <set field="tabButtonItem" value="EditExampleFeatureExampleAppls"/> 
-
<set field="exampleFeatureId" from- field="parameters.exampleFeatureId"/> 
            </actions>
            <widgets>
@@ -110,5 +109,21 @@
            </widgets>
        </section>
    </screen>
-
+    <screen name="ExampleFeatureOptions">
+        <section>
+            <actions>
+ <script location="component://example/webapp/ example/WEB-INF/actions/findExampleFeatures.bsh"/> <!-- 
+                <set field="parameters.noConditionFind" value="Y"/>
+ <service service-name="performFind" result-map- name="result"> + <field-map field-name="inputFields" env- name="parameters"/> + <field-map field-name="orderBy" value="description"/> + <field-map field-name="entityName" value="ExampleFeature"/> 
+                </service>
+                <set field="listIt" from-field="result.listIt"/> -->
+            </actions>
+            <widgets>
+ <platform-specific><html><html-template location="component://example/webapp/example/includes/ exampleFeatures.ftl"/></html></platform-specific> 
+            </widgets>
+        </section>
+    </screen>
</screens>
Modified: ofbiz/trunk/framework/example/widget/example/ ExampleForms.xml 
URL: 
http://svn.apache.org/viewvc/ofbiz/trunk/framework/example/widget/example/ExampleForms.xml?rev=659454&r1=659453&r2=659454&view=diff
= = = = = = = = = ===================================================================== --- ofbiz/trunk/framework/example/widget/example/ExampleForms.xml (original) +++ ofbiz/trunk/framework/example/widget/example/ExampleForms.xml Thu May 22 23:54:15 2008 
@@ -173,7 +173,8 @@
<form name="AddExampleFeatureAppl" type="single" target="example_createExampleFeatureAppl" title=""> <auto-fields-service service- name="createExampleFeatureAppl"/> 
        <field name="exampleId"><hidden/></field>
- <field name="exampleFeatureId" title="$ {uiLabelMap.ExampleFeature}"><lookup target-form- name="LookupExampleFeature"/></field> + <field name="exampleFeatureId" id- name="exampleFeatureId"><text server-autocomplete- target="ExampleFeatureOptions"></text></field> + <!-- <field name="exampleFeatureId" title="$ {uiLabelMap.ExampleFeature}" id-name="exampleFeatureId"><lookup target-form-name="LookupExampleFeature"/></field> --> <field name="exampleFeatureApplTypeId" title="$ {uiLabelMap.CommonType}"> 
            <drop-down allow-empty="false">
<entity-options entity- name="ExampleFeatureApplType" description="${description}"> Modified: ofbiz/trunk/framework/example/widget/example/ ExampleScreens.xml 
URL: 
http://svn.apache.org/viewvc/ofbiz/trunk/framework/example/widget/example/ExampleScreens.xml?rev=659454&r1=659453&r2=659454&view=diff
= = = = = = = = = ===================================================================== --- ofbiz/trunk/framework/example/widget/example/ExampleScreens.xml (original) +++ ofbiz/trunk/framework/example/widget/example/ExampleScreens.xml Thu May 22 23:54:15 2008 
@@ -88,6 +88,10 @@
    <screen name="EditExampleFeatureAppls">
        <section>
            <actions>
+ + <set field="layoutSettings.javaScripts[+0]" value="/images/prototypejs/ scriptaculous.js" global="true"/> + <set field="layoutSettings.javaScripts[+0]" value="/images/prototypejs/prototype.js" global="true"/> + <set field="layoutSettings.styleSheets[+0]" value="/images/prototypejs/scriptaculouscontrols.css" global="true"/> <set field="titleProperty" value="PageTitleEditExampleFeatureAppls"/> <set field="tabButtonItem" value="EditExampleFeatureAppls"/> <set field="exampleId" from- field="parameters.exampleId"/> 
Modified: ofbiz/trunk/framework/images/webapp/images/selectall.js
URL: 
http://svn.apache.org/viewvc/ofbiz/trunk/framework/images/webapp/images/selectall.js?rev=659454&r1=659453&r2=659454&view=diff
= = = = = = = = = ===================================================================== --- ofbiz/trunk/framework/images/webapp/images/selectall.js (original) +++ ofbiz/trunk/framework/images/webapp/images/selectall.js Thu May 22 23:54:15 2008 
@@ -286,6 +286,11 @@
ajaxSubmitRequestUpdateAreas(form.action, form.serialize(true), areaCsvString); 
}
+function ajaxAutoCompleter(textFieldId,url,params) {
+       var optionsDivId = textFieldId + "_autoCompleterOptions";
+ $(textFieldId ).insert({after: '<div class="autocomplete"' + 'id=' + optionsDivId + '></div>'}); + new Ajax.Autocompleter($(textFieldId), optionsDivId, url, params); 
+}
// ===== End of Ajax Functions ===== //
 function submitFormDisableSubmits(form) {
Modified: ofbiz/trunk/framework/widget/dtd/widget-form.xsd
URL: 
http://svn.apache.org/viewvc/ofbiz/trunk/framework/widget/dtd/widget-form.xsd?rev=659454&r1=659453&r2=659454&view=diff
= = = = = = = = = ===================================================================== 
--- ofbiz/trunk/framework/widget/dtd/widget-form.xsd (original)
+++ ofbiz/trunk/framework/widget/dtd/widget-form.xsd Thu May 22 23:54:15 2008 
@@ -854,6 +854,10 @@
                </xs:restriction>
            </xs:simpleType>
        </xs:attribute>
+ <xs:attribute type="xs:string" name="server-autocomplete- params"/> + <xs:attribute type="xs:string" name="server-autocomplete- target"> + <xs:annotation><xs:documentation>Url to request user options.</xs:documentation></xs:annotation> 
+        </xs:attribute>
    </xs:attributeGroup>
    <xs:element name="textarea" substitutionGroup="AllFields">
        <xs:complexType>
Modified: ofbiz/trunk/framework/widget/src/org/ofbiz/widget/form/ ModelFormField.java 
URL: 
http://svn.apache.org/viewvc/ofbiz/trunk/framework/widget/src/org/ofbiz/widget/form/ModelFormField.java?rev=659454&r1=659453&r2=659454&view=diff
= = = = = = = = = ===================================================================== --- ofbiz/trunk/framework/widget/src/org/ofbiz/widget/form/ ModelFormField.java (original) +++ ofbiz/trunk/framework/widget/src/org/ofbiz/widget/form/ ModelFormField.java Thu May 22 23:54:15 2008 
@@ -2167,7 +2167,9 @@
        protected SubHyperlink subHyperlink;
        protected boolean disabled;
        protected boolean clientAutocompleteField;
-
+ protected FlexibleStringExpander serverAutocompleteTargetExdr; + protected FlexibleStringExpander serverAutocompleteParamsExdr; 
+                 protected TextField() {
            super();
        }
@@ -2211,6 +2213,9 @@
            if (subHyperlinkElement != null) {
this.subHyperlink = new SubHyperlink(subHyperlinkElement); 
            }
+ this.serverAutocompleteTargetExdr = new FlexibleStringExpander(element.getAttribute("server-autocomplete- target")); + this.serverAutocompleteParamsExdr = new FlexibleStringExpander(element.getAttribute("server-autocomplete- params")); 
+
        }
public void renderFieldString(StringBuffer buffer, Map context, FormStringRenderer formStringRenderer) { 
@@ -2288,6 +2293,21 @@
        public void setSubHyperlink(SubHyperlink newSubHyperlink) {
            this.subHyperlink = newSubHyperlink;
        }
+        public String getServerAutocompleteTarget(Map context) {
+            if(serverAutocompleteTargetExdr !=null){
+ return this.serverAutocompleteTargetExdr.expandString(context); 
+            } else {
+                return "";
+            }
+        }
+        public String getServerAutocompleteParams(Map context) {
+            if(serverAutocompleteParamsExdr !=null){
+ return this.serverAutocompleteParamsExdr.expandString(context); 
+            } else {
+                return "";
+            }            +        }
+             }
     public static class TextareaField extends FieldInfo {
Modified: ofbiz/trunk/framework/widget/src/org/ofbiz/widget/html/ HtmlFormRenderer.java 
URL: 
http://svn.apache.org/viewvc/ofbiz/trunk/framework/widget/src/org/ofbiz/widget/html/HtmlFormRenderer.java?rev=659454&r1=659453&r2=659454&view=diff
= = = = = = = = = ===================================================================== --- ofbiz/trunk/framework/widget/src/org/ofbiz/widget/html/ HtmlFormRenderer.java (original) +++ ofbiz/trunk/framework/widget/src/org/ofbiz/widget/html/ HtmlFormRenderer.java Thu May 22 23:54:15 2008 
@@ -290,8 +290,22 @@
this.makeHyperlinkString(buffer, textField.getSubHyperlink(), context); 
         this.appendTooltip(buffer, context, modelFormField);
-
-        //appendWhitespace(buffer);
+ //Add javascript block to execute a function that will register textfield to autocompleter Ajax system. + String serverAutocompleteTarget = textField.getServerAutocompleteTarget(context); 
+        if (UtilValidate.isNotEmpty(serverAutocompleteTarget)) {
+            appendWhitespace(buffer);
+ buffer.append("<script language=\"JavaScript\" type= \"text/javascript\">"); 
+            appendWhitespace(buffer);
+            buffer.append("ajaxAutoCompleter('");
+            buffer.append(idName);
+            buffer.append("', '");
+ WidgetWorker.buildHyperlinkUrl(buffer, serverAutocompleteTarget,HyperlinkField.DEFAULT_TARGET_TYPE, request, response, context); 
+            buffer.append("', '");
+ buffer.append(textField.getServerAutocompleteParams(context) + "');"); 
+            appendWhitespace(buffer);
+            buffer.append("</script>");
+        }
+        appendWhitespace(buffer);
    }
     /* (non-Javadoc)

Reply via email to