On 06/22/2011 05:11 PM, Charles Crouch wrote:
----- Original Message -----
> I think you have the right idea. But there is no way that I can think
> of
> to get that URL to show up in the UI as clickable link.
>
> The only thing I can think of is have the URL be output as part of the
> server-side plugin operation (called "control"). The URL string would
> appear in the results - but I don't think it would be clickable (since
> I believe it gets rendered in a TextArea type GWT field).
But that could potentially enhanced right Mazz? i.e. use a better widget that support
clickable urls?
ConfigurationEditor.buildSimpleField() contains:
if (propertyIsReadOnly && propertyDefinitionSimple.getType() !=
PropertySimpleType.PASSWORD) {
valueItem = new StaticTextItem();
}
(propertyIsReadOnly would be true for all properties in an operation
results Configuration)
By default, StaticTextItems will not escape any HTML in their values.
However, further down in buildSimpleField(), we explicitly escape the
value due to security concerns:
String value = propertySimple.getStringValue();
if (valueItem instanceof StaticTextItem) {
// Property values are user-editable, so escape HTML when
displayed as static text, to prevent XSS attacks.
value = StringUtility.escapeHtml(value);
}
valueItem.setValue(value);
If we decide that there are some cases, such as operation results, where
we always trust property values in a Configuration to not contain
malicious HTML, then we could easily add a new option to the
ConfigurationEditor, e.g.:
configurationEditor.setEscapeHtmlInPropertyValues(false);
and then change the code in buildSimpleField() to:
if (valueItem instanceof StaticTextItem && isEscapeHtmlInPropertyValues()) {
...
> You'd have to
> cut-n-paste into the browser.