From a3f64a4214fe0ae29ecea298542a15c6a0071a45 Mon Sep 17 00:00:00 2001
From: "ctrlaltca@gmail.com" <>
Date: Sun, 25 Mar 2012 20:51:49 +0000
Subject: Reworked the patch for #391; now a TComponent-based  controls can
 contain methods prefixed by "js" to indicate that those methods can receive
 raw javascript. Such methods can be called both in a xss-safe,
 javascript-encoded way: $xxx->Property="yyy" and in a raw-javascript way:
 $xxx->jsProperty="zzz". Patch by gabor, documentation is on the way

---
 framework/Web/Javascripts/TJavaScript.php   | 22 +---------------------
 framework/Web/UI/TTemplateManager.php       | 24 +++++++++---------------
 framework/Web/UI/WebControls/TAccordion.php | 20 +++++++-------------
 framework/Web/UI/WebControls/TTabPanel.php  | 18 +++++++++---------
 4 files changed, 26 insertions(+), 58 deletions(-)

(limited to 'framework/Web')

diff --git a/framework/Web/Javascripts/TJavaScript.php b/framework/Web/Javascripts/TJavaScript.php
index 468182d2..8c7c865b 100644
--- a/framework/Web/Javascripts/TJavaScript.php
+++ b/framework/Web/Javascripts/TJavaScript.php
@@ -198,7 +198,7 @@ class TJavaScript
 		}
 		else if(is_object($value))
 			if ($value instanceof TJavaScriptLiteral)
-				return preg_replace('/^\s*javascript:/', '', $value);
+				return $value->toJavaScriptLiteral();
 			else
 				return self::encode(get_object_vars($value),$toMap);
 		else if($value===null)
@@ -281,23 +281,3 @@ class TJavaScript
 	}
 }
 
-/**
- * TJavaScriptLiteral class that encloses string literals that are not 
- * supposed to be escaped by TJavaScript::encode()
- *
- */
-class TJavaScriptLiteral
-{
-	private $_s;
-
-	public function __construct($s)
-	{
-		$this->_s = $s;
-	}
-
-	public function __toString()
-	{
-		return $this->_s;
-	}
-}
-
diff --git a/framework/Web/UI/TTemplateManager.php b/framework/Web/UI/TTemplateManager.php
index 566f6876..41ff76e1 100644
--- a/framework/Web/UI/TTemplateManager.php
+++ b/framework/Web/UI/TTemplateManager.php
@@ -423,17 +423,10 @@ class TTemplate extends TApplicationComponent implements ITemplate
 	{
 		if(strncasecmp($name,'on',2)===0)		// is an event
 			$this->configureEvent($control,$name,$value,$control);
-		else {
-			if(strncasecmp($name,'js',2)===0)
-			{
-				$name=substr($name,2);
-				$value=TJavaScript::quoteJsLiteral($value);
-			}
-			if(($pos=strrpos($name,'.'))===false)	// is a simple property or custom attribute
-				$this->configureProperty($control,$name,$value);
-			else	// is a subproperty
-				$this->configureSubProperty($control,$name,$value);
-		}
+		else if(($pos=strrpos($name,'.'))===false)	// is a simple property or custom attribute
+			$this->configureProperty($control,$name,$value);
+		else	// is a subproperty
+			$this->configureSubProperty($control,$name,$value);
 	}
 
 	/**
@@ -513,6 +506,9 @@ class TTemplate extends TApplicationComponent implements ITemplate
 		}
 		else
 		{
+			if (substr($name,0,2)=='js')
+				if ($value and !($value instanceof TJavaScriptLiteral))
+					$value = new TJavaScriptLiteral($value);
 			$setter='set'.$name;
 			$component->$setter($value);
 		}
@@ -944,12 +940,10 @@ class TTemplate extends TApplicationComponent implements ITemplate
 				}
 				else
 				{
-					if(strncasecmp($name,'js',2)===0)
-						$name=substr($name, 2);
 					// a simple property
-					if(!$class->hasMethod('set'.$name))
+					if (! ($class->hasMethod('set'.$name) || $class->hasMethod('setjs'.$name)) )
 					{
-						if($class->hasMethod('get'.$name))
+						if ($class->hasMethod('get'.$name) || $class->hasMethod('getjs'.$name))
 							throw new TConfigurationException('template_property_readonly',$type,$name);
 						else
 							throw new TConfigurationException('template_property_unknown',$type,$name);
diff --git a/framework/Web/UI/WebControls/TAccordion.php b/framework/Web/UI/WebControls/TAccordion.php
index 4e1cd325..8fd53e29 100644
--- a/framework/Web/UI/WebControls/TAccordion.php
+++ b/framework/Web/UI/WebControls/TAccordion.php
@@ -477,23 +477,17 @@ class TAccordion extends TWebControl implements IPostBackDataHandler
 	 */
 	protected function getClientOptions()
 	{
-		$options['ID']=$this->getClientID();
-		$options['ActiveHeaderCssClass']=$this->getActiveHeaderCssClass();
-		$options['HeaderCssClass']=$this->getHeaderCssClass();
-		$options['Duration']=$this->getAnimationDuration();
+		$options['ID'] = $this->getClientID();
+		$options['ActiveHeaderCssClass'] = $this->getActiveHeaderCssClass();
+		$options['HeaderCssClass'] = $this->getHeaderCssClass();
+		$options['Duration'] = $this->getAnimationDuration();
 
 		if (($viewheight = $this->getViewHeight())>0)
 			$options['maxHeight'] = $viewheight;
-		$views='';
+		$views = array();
 		foreach($this->getViews() as $view)
-		{
-			if($views!='') 
-				$views.=', ';
-			$views.= TJavaScript::encode($view->getClientID()).':'.($view->getVisible() ? '1': '0' );
-		}
-
-		$options['Views']=TJavaScript::quoteJsLiteral('{'.$views.='}');
-		$viewIDs=array();
+			$views[$view->getClientID()] = $view->getVisible() ? '1': '0';
+		$options['Views'] = $views;
 
 		return $options;
 	}
diff --git a/framework/Web/UI/WebControls/TTabPanel.php b/framework/Web/UI/WebControls/TTabPanel.php
index 558ead4e..7f0c2d36 100644
--- a/framework/Web/UI/WebControls/TTabPanel.php
+++ b/framework/Web/UI/WebControls/TTabPanel.php
@@ -436,18 +436,18 @@ class TTabPanel extends TWebControl implements IPostBackDataHandler
 	 */
 	protected function getClientOptions()
 	{
-		$options['ID']=$this->getClientID();
-		$options['ActiveCssClass']=$this->getActiveTabCssClass();
-		$options['NormalCssClass']=$this->getTabCssClass();
-		$viewIDs=array();
-		$viewVis=array();
+		$options['ID'] = $this->getClientID();
+		$options['ActiveCssClass'] = $this->getActiveTabCssClass();
+		$options['NormalCssClass'] = $this->getTabCssClass();
+		$viewIDs = array();
+		$viewVis = array();
 		foreach($this->getViews() as $view)
 		{
-			$viewIDs[]=TJavaScript::encode($view->getClientID());
-			$viewVis[]=TJavaScript::encode($view->getVisible());
+			$viewIDs[] = $view->getClientID();
+			$viewVis[] = $view->getVisible();
 		}
-		$options['Views']=TJavaScript::quoteJsLiteral('['.implode(',',$viewIDs).']');
-		$options['ViewsVis']=TJavaScript::quoteJsLiteral('['.implode(',',$viewVis).']');
+		$options['Views'] = $viewIDs;
+		$options['ViewsVis'] = $viewVis;
 
 		return $options;
 	}
-- 
cgit v1.2.3