On 03/05/2010 02:10 PM, Joel Forsberg wrote:
On Friday 05 March 2010 04:58:57 Sergiu Dumitriu wrote:
I need to use getXMLEncoded because the title doesn't always come from the content.
I saw the suggestion to modify the getXMLEncoded route on the JIRA ticket, so I decided to do some testing with that. I only know two ways to set the title for a document (are there more?) either from the content or the title, and
No, these are the only ones. Actually, as a fallback, if there is not title in any of these places, then the document name is used.
here's the results from those. (I have edited the out some hrefs="")
Case 1: Having a document where title field is blank, but having a section as Document 1: = A damn<hr /> ruler = Document 2: = Att-göra-lista =
Results: $rdoc.displayTitle 1<a>A damn<hr /> ruler</a> 2<a>Att göra-lista</a>
$xwiki.getXMLEncoded($rdoc.getRenderedTitle('plain/1.0') 1<a>A damn<hr /> ruler</a> 2<a>Att göra-lista</a>
Visually: all the results appears okay and the same in Firefox. (I wonder if IE versions can handle the XML output?) The xml route outputs UTF-8 characters, whereas displayTitle escapes them correctly even if the browser selects wrong character encoding. However, the rest of the wiki use utf-8 consistently so that later case is not likely an issue.
Case 2: Putting the same in proper title field.
Results: $rdoc.displayTitle 1<a>= A damn</a><hr/><a> ruler =</a> 2<a>= Att göra-lista =</a>
$xwiki.getXMLEncoded($rdoc.getRenderedTitle('plain/1.0') 1<a>= A damn</a><p><a></a></p><hr/><a></a><p><a>ruler =</a></p>
This is caused not by the display code, but by the fact that the result is used inside a panel written with the 1.0 syntax, which doesn't know that the result is already processed. You can check that by actually using this in the panel: {pre}<span class="panelitem"><a href="$rdoc.getURL('view')">$xwiki.getXMLEncoded($rdoc.getRenderedTitle('plain/1.0'))</a></span>{/pre} {pre}{/pre} prevents re-rendering the content. The result with this is: A damn ---- ruler Which again is a bit wrong, but this is a bug in the core, it always assumes that the content that it got from the title field is velocity+HTML, even if the page is in xwiki/2.0 syntax.
2<a>= Att göra-lista =</a>
Visually: As you see, the characters are not escaped at all when using the title, no matter what method is being used. Guessing would make me say the title field is buggy. The xml route even puts in a few extra<p> tags for some reason.
I think the proper title field needs to be fixed in some way to escape special characters before this can be fixed. It might also be good to have an example where getXMLEncoded() does any good for panel links at the moment, for testing purposes?
Try to put one of these in the title field: When to use </div> => badly broken display CrossSiteScripting example: <script>alert('I pwnd U')</script> => bad, bad, bad -- Sergiu Dumitriu http://purl.org/net/sergiu/