Thanks for the replies.
I realized after getting into this that I couldn't figure out how to get
a message (in this case the URL) to be displayed from a script run as an
alert sender/notification. So I tried creating my own Alert plugin that
can do the snapshot operation and display the URL in the Notification
message field.
That works fine, except that the URL in that field cannot be copied and
pasted anywhere! Can this field be made copyable?
I also had a problem with the snapshot operation timing out. I am using
SupportManager.getSnapshotReport(), so there is not the usual option to
supply a timeout that an ResourceOperationSchedule provides. Is there
any way to set a timeout, maybe at a global level?
Thanks in advance.
Steve
On 6/23/2011 9:38 AM, Ian Springer wrote:
Note, currently when we cleanse values to prevent XSS attacks, we
escape
all HTML tags. Once we upgrade to GWT 2.2, in certain places (such as
the alert info field) we will be able to instead use the new "safe HTML"
APIs provided by GWT, which escape everything except certain HTML tags
that are know to be "safe" (e.g.<b>,<i>,<h1>,<a>,
etc.).
I think the plan is to upgrade to GWT 2.2 soon.
On 06/22/2011 05:30 PM, Ian Springer wrote:
> On 06/22/2011 05:11 PM, Charles Crouch wrote:
>> ----- Original Message -----
>>> I think you have the right idea. But there is no way that I can think
>>> of
>>> to get that URL to show up in the UI as clickable link.
>>>
>>> The only thing I can think of is have the URL be output as part of the
>>> server-side plugin operation (called "control"). The URL string
would
>>> appear in the results - but I don't think it would be clickable (since
>>> I believe it gets rendered in a TextArea type GWT field).
>> But that could potentially enhanced right Mazz? i.e. use a better widget that
support clickable urls?
> ConfigurationEditor.buildSimpleField() contains:
>
> if (propertyIsReadOnly&& propertyDefinitionSimple.getType() !=
> PropertySimpleType.PASSWORD) {
> valueItem = new StaticTextItem();
> }
>
> (propertyIsReadOnly would be true for all properties in an operation
> results Configuration)
>
> By default, StaticTextItems will not escape any HTML in their values.
> However, further down in buildSimpleField(), we explicitly escape the
> value due to security concerns:
>
> String value = propertySimple.getStringValue();
> if (valueItem instanceof StaticTextItem) {
> // Property values are user-editable, so escape HTML when
> displayed as static text, to prevent XSS attacks.
> value = StringUtility.escapeHtml(value);
> }
> valueItem.setValue(value);
>
> If we decide that there are some cases, such as operation results, where
> we always trust property values in a Configuration to not contain
> malicious HTML, then we could easily add a new option to the
> ConfigurationEditor, e.g.:
>
> configurationEditor.setEscapeHtmlInPropertyValues(false);
>
> and then change the code in buildSimpleField() to:
>
> if (valueItem instanceof StaticTextItem&& isEscapeHtmlInPropertyValues())
{
> ...
>
>
>
>>> You'd have to
>>> cut-n-paste into the browser.
> _______________________________________________
> rhq-devel mailing list
> rhq-devel(a)lists.fedorahosted.org
>
https://fedorahosted.org/mailman/listinfo/rhq-devel