14 Nov
2009
14 Nov
'09
10:43 a.m.
Hi Jerome,
Jerome Velociter wrote:
On 11/12/09 3:54 PM, Marius Dumitru Florea wrote:
[snip]
http://markmail.org/thread/rubnuunk4vd25bzt see :)
I don't remember we've voted on that, we probably should have. I'm
really not fan of executing the scripts in the WYSIWYG, in the end.
Even the "mark DOM changes" technique will not be enough, as we can't
control how JS libraries we use do inject their content (typically the
lightbox code here) and most extensions are made of/rely on external
libraries.
In the same way, blocking JSX doesn't prevent a user from writing a
dangerous script tag inside the HTML macro or a wiki macro author to
generate a script tag that alters the DOM outside the macro markers. I
can't really prevent JavaScript execution in WYSIWYG edit mode unless
the renderer strips all script tags. Do we want this? I'm not against.
BTW is it
such a good idea to load extensions in edit mode?
I'm not very convinced, since some extensions could affect the content
of the edited DOM, leading to weird content. (Think about the addSizes
extension of the SX tutorial for example
http://platform.xwiki.org/xwiki/bin/view/DevGuide/SkinExtensionsTutorial).
There
were some complains regarding the fact that the live table doesn't
look the same in edit mode so I had to load the extensions in edit mode
( http://jira.xwiki.org/jira/browse/XWIKI-3991 ). This is just an
example. Once we have transformation markers any JSX will be able to
change the DOM provided the changes are marked. Also, I'm thinking that
a macro could use a JSX to "draw" something on the page. If JSX are not
loaded in edit mode the page will look different.
Marius
For the livetables ( http://jira.xwiki.org/jira/browse/XWIKI-3991 ) I
tend to think it would have been enough to have the proper CSS, but not
the JS (and have the table would remain empty). I don't see the value of
having the tables really work in edit mode. (Except for saying "it's
really WYSIWYG").
I don't like too much the strategy that would say
"extensions developers
have to check if they are executed in the WYSIWYG (I guess it's
possible, not tried yet) and adapt the extension behavior accordingly"
Feels somehow a bit too complex.
I think it's also the responsibility of the extension author to make
sure its extension behaves well in WYSIWYG edit mode. If there is a way
to write an extension so that it looks nice in edit mode, some
developers might appreciate it.
So is it really useful to execute the JavaScript in edit mode?
Thanks,
Marius
Jerome.
_______________________________________________
devs mailing list
devs(a)xwiki.org
http://lists.xwiki.org/mailman/listinfo/devs