Move authoring UI inline JS handlers to data attributes - #168
Open
snoopdave wants to merge 2 commits into
Open
Conversation
The editor screens built handler arguments by interpolating template values directly into inline onclick/onchange attributes. Those values now travel in data-* attributes and are read back through delegated listeners, which matches how the rest of the UI binds behaviour and keeps markup and data separate. Writes that placed those values into the DOM now use text APIs rather than html(), and ThemeDataServlet escapes its JSON output so theme metadata cannot produce a malformed document. Adds AuthoringUiSinkAuditTest to keep the editor templates on this pattern.
The media gallery rendered the media file name into single-quoted HTML attributes; those attributes are now double-quoted so the value stays data. The sink-audit test description now states the rule it enforces, and the repeated per-page comment is collapsed to one line. Claude-Session: https://claude.ai/code/session_01A1fhY1E2PCFU6UAPXu2WtV
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Several authoring pages embed values in inline JavaScript string literals and
then write them into the page with jQuery
.html(). This refactor moves thosevalues into data attributes and writes them through text APIs, so JSPs stop
hand-concatenating markup and data.
What changed
into double-quoted, HTML-escaped
data-*attributes.textContent,.text(),.val(), or DOM constructors..html()writes with a text API.entry lists, and entry editing, including the category iterator and
delete-modal cases.
ThemeDataServletreturn validJSON.
Tests
and
</script>remain text through each path.author or administrator session.
single-quoted attribute, or a
.html()sink.