[jira] [Created] (OFBIZ-4688) For script tag in action section in Screen (and form) use a FlexibleStringExpander for scriptLocation and correctly manage minilang script

[Nicolas Malin (Jira)]

For script tag in action section in Screen (and form) use a FlexibleStringExpander for scriptLocation and correctly manage minilang script
------------------------------------------------------------------------------------------------------------------------------------------

                 Key: OFBIZ-4688
                 URL: https://issues.apache.org/jira/browse/OFBIZ-4688
             Project: OFBiz
          Issue Type: Improvement
          Components: framework
    Affects Versions: SVN trunk
            Reporter: Olivier Heintz
            Priority: Minor
         Attachments: OFBIZ-4688.patch

FlexibleStringExpander to be able to have script name depending from context.
Minilang script are Useful to migrated some action (too large) as a minilang script

Be carreful, this patch contain patch from JIRA-4687, if necessary I can submit a new patch without it

--
This message is automatically generated by JIRA.
If you think it was sent incorrectly, please contact your JIRA administrators: https://issues.apache.org/jira/secure/ContactAdministrators!default.jspa
For more information on JIRA, see: http://www.atlassian.com/software/jira

       

[Nicolas Malin (Jira)]

     [ https://issues.apache.org/jira/browse/OFBIZ-4688?page=com.atlassian.jira.plugin.system.issuetabpanels:all-tabpanel ]

Olivier Heintz updated OFBIZ-4688:
----------------------------------

    Attachment: OFBIZ-4688.patch
   

> For script tag in action section in Screen (and form) use a FlexibleStringExpander for scriptLocation and correctly manage minilang script
> ------------------------------------------------------------------------------------------------------------------------------------------
>
>                 Key: OFBIZ-4688
>                 URL: https://issues.apache.org/jira/browse/OFBIZ-4688
>             Project: OFBiz
>          Issue Type: Improvement
>          Components: framework
>    Affects Versions: SVN trunk
>            Reporter: Olivier Heintz
>            Priority: Minor
>         Attachments: OFBIZ-4688.patch
>
>
> FlexibleStringExpander to be able to have script name depending from context.
> Minilang script are Useful to migrated some action (too large) as a minilang script
> Be carreful, this patch contain patch from JIRA-4687, if necessary I can submit a new patch without it

--
This message is automatically generated by JIRA.
If you think it was sent incorrectly, please contact your JIRA administrators: https://issues.apache.org/jira/secure/ContactAdministrators!default.jspa
For more information on JIRA, see: http://www.atlassian.com/software/jira

       

[Nicolas Malin (Jira)]

    [ https://issues.apache.org/jira/browse/OFBIZ-4688?page=com.atlassian.jira.plugin.system.issuetabpanels:comment-tabpanel&focusedCommentId=13206376#comment-13206376 ]

Adrian Crum commented on OFBIZ-4688:
------------------------------------

I do not see any changes to FSE in this patch.

               

> For script tag in action section in Screen (and form) use a FlexibleStringExpander for scriptLocation and correctly manage minilang script
> ------------------------------------------------------------------------------------------------------------------------------------------
>
>                 Key: OFBIZ-4688
>                 URL: https://issues.apache.org/jira/browse/OFBIZ-4688
>             Project: OFBiz
>          Issue Type: Improvement
>          Components: framework
>    Affects Versions: SVN trunk
>            Reporter: Olivier Heintz
>            Priority: Minor
>         Attachments: OFBIZ-4688.patch
>
>
> FlexibleStringExpander to be able to have script name depending from context.
> Minilang script are Useful to migrated some action (too large) as a minilang script
> Be carreful, this patch contain patch from JIRA-4687, if necessary I can submit a new patch without it

--
This message is automatically generated by JIRA.
If you think it was sent incorrectly, please contact your JIRA administrators: https://issues.apache.org/jira/secure/ContactAdministrators!default.jspa
For more information on JIRA, see: http://www.atlassian.com/software/jira

       

[Nicolas Malin (Jira)]

     [ https://issues.apache.org/jira/browse/OFBIZ-4688?page=com.atlassian.jira.plugin.system.issuetabpanels:all-tabpanel ]

Adrian Crum updated OFBIZ-4688:
-------------------------------

    Comment: was deleted

(was: I do not see any changes to FSE in this patch.
)
   

> For script tag in action section in Screen (and form) use a FlexibleStringExpander for scriptLocation and correctly manage minilang script
> ------------------------------------------------------------------------------------------------------------------------------------------
>
>                 Key: OFBIZ-4688
>                 URL: https://issues.apache.org/jira/browse/OFBIZ-4688
>             Project: OFBiz
>          Issue Type: Improvement
>          Components: framework
>    Affects Versions: SVN trunk
>            Reporter: Olivier Heintz
>            Priority: Minor
>         Attachments: OFBIZ-4688.patch
>
>
> FlexibleStringExpander to be able to have script name depending from context.
> Minilang script are Useful to migrated some action (too large) as a minilang script
> Be carreful, this patch contain patch from JIRA-4687, if necessary I can submit a new patch without it

--
This message is automatically generated by JIRA.
If you think it was sent incorrectly, please contact your JIRA administrators: https://issues.apache.org/jira/secure/ContactAdministrators!default.jspa
For more information on JIRA, see: http://www.atlassian.com/software/jira

       

[Nicolas Malin (Jira)]

    [ https://issues.apache.org/jira/browse/OFBIZ-4688?page=com.atlassian.jira.plugin.system.issuetabpanels:comment-tabpanel&focusedCommentId=13206379#comment-13206379 ]

Adrian Crum commented on OFBIZ-4688:
------------------------------------

Using FSE for <actions> sub element attributes is a good idea. It would be best if the patch contained only the change mentioned in this issue - it was difficult to find.

               

> For script tag in action section in Screen (and form) use a FlexibleStringExpander for scriptLocation and correctly manage minilang script
> ------------------------------------------------------------------------------------------------------------------------------------------
>
>                 Key: OFBIZ-4688
>                 URL: https://issues.apache.org/jira/browse/OFBIZ-4688
>             Project: OFBiz
>          Issue Type: Improvement
>          Components: framework
>    Affects Versions: SVN trunk
>            Reporter: Olivier Heintz
>            Priority: Minor
>         Attachments: OFBIZ-4688.patch
>
>
> FlexibleStringExpander to be able to have script name depending from context.
> Minilang script are Useful to migrated some action (too large) as a minilang script
> Be carreful, this patch contain patch from JIRA-4687, if necessary I can submit a new patch without it

--
This message is automatically generated by JIRA.
If you think it was sent incorrectly, please contact your JIRA administrators: https://issues.apache.org/jira/secure/ContactAdministrators!default.jspa
For more information on JIRA, see: http://www.atlassian.com/software/jira

       

[Nicolas Malin (Jira)]

     [ https://issues.apache.org/jira/browse/OFBIZ-4688?page=com.atlassian.jira.plugin.system.issuetabpanels:all-tabpanel ]

Olivier Heintz updated OFBIZ-4688:
----------------------------------

    Attachment: OFBIZ-4688-without_TypeValue.patch

New patch without modifications about JIRA OFBIZ-4687
it contain only FSE modifications
and correction for using minilang as script (but now modifications about it is readable ;-)
               

> For script tag in action section in Screen (and form) use a FlexibleStringExpander for scriptLocation and correctly manage minilang script
> ------------------------------------------------------------------------------------------------------------------------------------------
>
>                 Key: OFBIZ-4688
>                 URL: https://issues.apache.org/jira/browse/OFBIZ-4688
>             Project: OFBiz
>          Issue Type: Improvement
>          Components: framework
>    Affects Versions: SVN trunk
>            Reporter: Olivier Heintz
>            Priority: Minor
>         Attachments: OFBIZ-4688-without_TypeValue.patch, OFBIZ-4688.patch
>
>
> FlexibleStringExpander to be able to have script name depending from context.
> Minilang script are Useful to migrated some action (too large) as a minilang script
> Be carreful, this patch contain patch from JIRA-4687, if necessary I can submit a new patch without it

--
This message is automatically generated by JIRA.
If you think it was sent incorrectly, please contact your JIRA administrators: https://issues.apache.org/jira/secure/ContactAdministrators!default.jspa
For more information on JIRA, see: http://www.atlassian.com/software/jira

       

[Nicolas Malin (Jira)]

    [ https://issues.apache.org/jira/browse/OFBIZ-4688?page=com.atlassian.jira.plugin.system.issuetabpanels:comment-tabpanel&focusedCommentId=13206389#comment-13206389 ]

Adrian Crum commented on OFBIZ-4688:
------------------------------------

The updated patch looks better, but now the <script> element "method" attribute has been eliminated. Why is that necessary?

               

> For script tag in action section in Screen (and form) use a FlexibleStringExpander for scriptLocation and correctly manage minilang script
> ------------------------------------------------------------------------------------------------------------------------------------------
>
>                 Key: OFBIZ-4688
>                 URL: https://issues.apache.org/jira/browse/OFBIZ-4688
>             Project: OFBiz
>          Issue Type: Improvement
>          Components: framework
>    Affects Versions: SVN trunk
>            Reporter: Olivier Heintz
>            Priority: Minor
>         Attachments: OFBIZ-4688-without_TypeValue.patch, OFBIZ-4688.patch
>
>
> FlexibleStringExpander to be able to have script name depending from context.
> Minilang script are Useful to migrated some action (too large) as a minilang script
> Be carreful, this patch contain patch from JIRA-4687, if necessary I can submit a new patch without it

--
This message is automatically generated by JIRA.
If you think it was sent incorrectly, please contact your JIRA administrators: https://issues.apache.org/jira/secure/ContactAdministrators!default.jspa
For more information on JIRA, see: http://www.atlassian.com/software/jira

       

[Nicolas Malin (Jira)]

    [ https://issues.apache.org/jira/browse/OFBIZ-4688?page=com.atlassian.jira.plugin.system.issuetabpanels:comment-tabpanel&focusedCommentId=13206459#comment-13206459 ]

Olivier Heintz commented on OFBIZ-4688:
---------------------------------------

in <script> there is only location attribute, and method is read from location, it's the second part after "#". So I have eliminated nothing ;-)

{code}
String method = WidgetWorker.getScriptMethodName(scriptLocation);
{code}
               

> For script tag in action section in Screen (and form) use a FlexibleStringExpander for scriptLocation and correctly manage minilang script
> ------------------------------------------------------------------------------------------------------------------------------------------
>
>                 Key: OFBIZ-4688
>                 URL: https://issues.apache.org/jira/browse/OFBIZ-4688
>             Project: OFBiz
>          Issue Type: Improvement
>          Components: framework
>    Affects Versions: SVN trunk
>            Reporter: Olivier Heintz
>            Priority: Minor
>         Attachments: OFBIZ-4688-without_TypeValue.patch, OFBIZ-4688.patch
>
>
> FlexibleStringExpander to be able to have script name depending from context.
> Minilang script are Useful to migrated some action (too large) as a minilang script
> Be carreful, this patch contain patch from JIRA-4687, if necessary I can submit a new patch without it

--
This message is automatically generated by JIRA.
If you think it was sent incorrectly, please contact your JIRA administrators: https://issues.apache.org/jira/secure/ContactAdministrators!default.jspa
For more information on JIRA, see: http://www.atlassian.com/software/jira

       

[Nicolas Malin (Jira)]

    [ https://issues.apache.org/jira/browse/OFBIZ-4688?page=com.atlassian.jira.plugin.system.issuetabpanels:comment-tabpanel&focusedCommentId=13206775#comment-13206775 ]

Adrian Crum commented on OFBIZ-4688:
------------------------------------

Yes, you are correct. I apologize for the confusion.
               

> For script tag in action section in Screen (and form) use a FlexibleStringExpander for scriptLocation and correctly manage minilang script
> ------------------------------------------------------------------------------------------------------------------------------------------
>
>                 Key: OFBIZ-4688
>                 URL: https://issues.apache.org/jira/browse/OFBIZ-4688
>             Project: OFBiz
>          Issue Type: Improvement
>          Components: framework
>    Affects Versions: SVN trunk
>            Reporter: Olivier Heintz
>            Priority: Minor
>         Attachments: OFBIZ-4688-without_TypeValue.patch, OFBIZ-4688.patch
>
>
> FlexibleStringExpander to be able to have script name depending from context.
> Minilang script are Useful to migrated some action (too large) as a minilang script
> Be carreful, this patch contain patch from JIRA-4687, if necessary I can submit a new patch without it

--
This message is automatically generated by JIRA.
If you think it was sent incorrectly, please contact your JIRA administrators: https://issues.apache.org/jira/secure/ContactAdministrators!default.jspa
For more information on JIRA, see: http://www.atlassian.com/software/jira

       

[Nicolas Malin (Jira)]

     [ https://issues.apache.org/jira/browse/OFBIZ-4688?page=com.atlassian.jira.plugin.system.issuetabpanels:all-tabpanel ]

Olivier Heintz updated OFBIZ-4688:
----------------------------------

    Attachment: OFBIZ-4688-without_TypeValue_V2.patch

in the previous patch I have forgot the new MethodContext contructor for minilang which is used when calling minilang script from screen action section.
               

> For script tag in action section in Screen (and form) use a FlexibleStringExpander for scriptLocation and correctly manage minilang script
> ------------------------------------------------------------------------------------------------------------------------------------------
>
>                 Key: OFBIZ-4688
>                 URL: https://issues.apache.org/jira/browse/OFBIZ-4688
>             Project: OFBiz
>          Issue Type: Improvement
>          Components: framework
>    Affects Versions: SVN trunk
>            Reporter: Olivier Heintz
>            Priority: Minor
>         Attachments: OFBIZ-4688-without_TypeValue.patch, OFBIZ-4688-without_TypeValue_V2.patch, OFBIZ-4688.patch
>
>
> FlexibleStringExpander to be able to have script name depending from context.
> Minilang script are Useful to migrated some action (too large) as a minilang script
> Be carreful, this patch contain patch from JIRA-4687, if necessary I can submit a new patch without it

--
This message is automatically generated by JIRA.
If you think it was sent incorrectly, please contact your JIRA administrators: https://issues.apache.org/jira/secure/ContactAdministrators!default.jspa
For more information on JIRA, see: http://www.atlassian.com/software/jira

       

[Nicolas Malin (Jira)]

     [ https://issues.apache.org/jira/browse/OFBIZ-4688?page=com.atlassian.jira.plugin.system.issuetabpanels:all-tabpanel ]

Olivier Heintz updated OFBIZ-4688:
----------------------------------

    Attachment: OFBIZ-4688-without_TypeValue_V3.patch

update patch after commit about scripting engine
               

> For script tag in action section in Screen (and form) use a FlexibleStringExpander for scriptLocation and correctly manage minilang script
> ------------------------------------------------------------------------------------------------------------------------------------------
>
>                 Key: OFBIZ-4688
>                 URL: https://issues.apache.org/jira/browse/OFBIZ-4688
>             Project: OFBiz
>          Issue Type: Improvement
>          Components: framework
>    Affects Versions: SVN trunk
>            Reporter: Olivier Heintz
>            Priority: Minor
>         Attachments: OFBIZ-4688-without_TypeValue.patch, OFBIZ-4688-without_TypeValue_V2.patch, OFBIZ-4688-without_TypeValue_V3.patch, OFBIZ-4688.patch
>
>
> FlexibleStringExpander to be able to have script name depending from context.
> Minilang script are Useful to migrated some action (too large) as a minilang script
> Be carreful, this patch contain patch from JIRA-4687, if necessary I can submit a new patch without it

--
This message is automatically generated by JIRA.
If you think it was sent incorrectly, please contact your JIRA administrators: https://issues.apache.org/jira/secure/ContactAdministrators!default.jspa
For more information on JIRA, see: http://www.atlassian.com/software/jira

       

[Nicolas Malin (Jira)]

     [ https://issues.apache.org/jira/browse/OFBIZ-4688?page=com.atlassian.jira.plugin.system.issuetabpanels:all-tabpanel ]

Olivier Heintz updated OFBIZ-4688:
----------------------------------

    Summary: For script tag in action section in Screen (and form) use a FlexibleStringExpander for scriptLocation and correctly manage minilang script context  (was: For script tag in action section in Screen (and form) use a FlexibleStringExpander for scriptLocation and correctly manage minilang script)
   

> For script tag in action section in Screen (and form) use a FlexibleStringExpander for scriptLocation and correctly manage minilang script context
> --------------------------------------------------------------------------------------------------------------------------------------------------
>
>                 Key: OFBIZ-4688
>                 URL: https://issues.apache.org/jira/browse/OFBIZ-4688
>             Project: OFBiz
>          Issue Type: Improvement
>          Components: framework
>    Affects Versions: SVN trunk
>            Reporter: Olivier Heintz
>            Priority: Minor
>         Attachments: OFBIZ-4688-without_TypeValue.patch, OFBIZ-4688-without_TypeValue_V2.patch, OFBIZ-4688-without_TypeValue_V3.patch, OFBIZ-4688.patch
>
>
> FlexibleStringExpander to be able to have script name depending from context.
> Minilang script are Useful to migrated some action (too large) as a minilang script
> Be carreful, this patch contain patch from JIRA-4687, if necessary I can submit a new patch without it

--
This message is automatically generated by JIRA.
If you think it was sent incorrectly, please contact your JIRA administrators: https://issues.apache.org/jira/secure/ContactAdministrators!default.jspa
For more information on JIRA, see: http://www.atlassian.com/software/jira

       

[Nicolas Malin (Jira)]

     [ https://issues.apache.org/jira/browse/OFBIZ-4688?page=com.atlassian.jira.plugin.system.issuetabpanels:all-tabpanel ]

Olivier Heintz updated OFBIZ-4688:
----------------------------------

    Attachment: OFBIZ-4688-without_TypeValue_V4.patch

to follow last adrian commit about script return value.
change "context" to "widget" in patch about mini-langue script call from widget.

It's clearly more clear.
               

> For script tag in action section in Screen (and form) use a FlexibleStringExpander for scriptLocation and correctly manage minilang script context
> --------------------------------------------------------------------------------------------------------------------------------------------------
>
>                 Key: OFBIZ-4688
>                 URL: https://issues.apache.org/jira/browse/OFBIZ-4688
>             Project: OFBiz
>          Issue Type: Improvement
>          Components: framework
>    Affects Versions: SVN trunk
>            Reporter: Olivier Heintz
>            Priority: Minor
>         Attachments: OFBIZ-4688-without_TypeValue.patch, OFBIZ-4688-without_TypeValue_V2.patch, OFBIZ-4688-without_TypeValue_V3.patch, OFBIZ-4688-without_TypeValue_V4.patch, OFBIZ-4688.patch
>
>
> FlexibleStringExpander to be able to have script name depending from context.
> Minilang script are Useful to migrated some action (too large) as a minilang script
> Be carreful, this patch contain patch from JIRA-4687, if necessary I can submit a new patch without it

--
This message is automatically generated by JIRA.
If you think it was sent incorrectly, please contact your JIRA administrators: https://issues.apache.org/jira/secure/ContactAdministrators!default.jspa
For more information on JIRA, see: http://www.atlassian.com/software/jira

       

[Nicolas Malin (Jira)]

    [ https://issues.apache.org/jira/browse/OFBIZ-4688?page=com.atlassian.jira.plugin.system.issuetabpanels:comment-tabpanel&focusedCommentId=13227784#comment-13227784 ]

Adrian Crum commented on OFBIZ-4688:
------------------------------------

Olivier,

I see a lot of changes in the latest patch that don't have anything to do with using FSE for the script location. Also, your latest patch removes the context Map copying, which will cause problems with existing code.

               

> For script tag in action section in Screen (and form) use a FlexibleStringExpander for scriptLocation and correctly manage minilang script context
> --------------------------------------------------------------------------------------------------------------------------------------------------
>
>                 Key: OFBIZ-4688
>                 URL: https://issues.apache.org/jira/browse/OFBIZ-4688
>             Project: OFBiz
>          Issue Type: Improvement
>          Components: framework
>    Affects Versions: SVN trunk
>            Reporter: Olivier Heintz
>            Priority: Minor
>         Attachments: OFBIZ-4688-without_TypeValue.patch, OFBIZ-4688-without_TypeValue_V2.patch, OFBIZ-4688-without_TypeValue_V3.patch, OFBIZ-4688-without_TypeValue_V4.patch, OFBIZ-4688.patch
>
>
> FlexibleStringExpander to be able to have script name depending from context.
> Minilang script are Useful to migrated some action (too large) as a minilang script
> Be carreful, this patch contain patch from JIRA-4687, if necessary I can submit a new patch without it

--
This message is automatically generated by JIRA.
If you think it was sent incorrectly, please contact your JIRA administrators: https://issues.apache.org/jira/secure/ContactAdministrators!default.jspa
For more information on JIRA, see: http://www.atlassian.com/software/jira

       

[Nicolas Malin (Jira)]

    [ https://issues.apache.org/jira/browse/OFBIZ-4688?page=com.atlassian.jira.plugin.system.issuetabpanels:comment-tabpanel&focusedCommentId=13228452#comment-13228452 ]

Olivier Heintz commented on OFBIZ-4688:
---------------------------------------

this modification was present in the first patch but only in ModelWidgetAction, in the last, i have only generalize in ModelScreenAction and ModelFormAction.

This Jira has 2 points:
- FSE for the scriptlocation
- correction on context creation for mini-langue script using in action (screen or form)

In the patch I add a constructor in MethodContext.java, witch copy context and parameters
               

> For script tag in action section in Screen (and form) use a FlexibleStringExpander for scriptLocation and correctly manage minilang script context
> --------------------------------------------------------------------------------------------------------------------------------------------------
>
>                 Key: OFBIZ-4688
>                 URL: https://issues.apache.org/jira/browse/OFBIZ-4688
>             Project: OFBiz
>          Issue Type: Improvement
>          Components: framework
>    Affects Versions: SVN trunk
>            Reporter: Olivier Heintz
>            Priority: Minor
>         Attachments: OFBIZ-4688-without_TypeValue.patch, OFBIZ-4688-without_TypeValue_V2.patch, OFBIZ-4688-without_TypeValue_V3.patch, OFBIZ-4688-without_TypeValue_V4.patch, OFBIZ-4688.patch
>
>
> FlexibleStringExpander to be able to have script name depending from context.
> Minilang script are Useful to migrated some action (too large) as a minilang script
> Be carreful, this patch contain patch from JIRA-4687, if necessary I can submit a new patch without it

--
This message is automatically generated by JIRA.
If you think it was sent incorrectly, please contact your JIRA administrators: https://issues.apache.org/jira/secure/ContactAdministrators!default.jspa
For more information on JIRA, see: http://www.atlassian.com/software/jira

       

[Nicolas Malin (Jira)]

     [ https://issues.apache.org/jira/browse/OFBIZ-4688?page=com.atlassian.jira.plugin.system.issuetabpanels:all-tabpanel ]

Adrian Crum closed OFBIZ-4688.
------------------------------

       Resolution: Won't Fix
    Fix Version/s: SVN trunk

Olivier,

I am closing this issue because it opens a security hole. This change would allow users to introduce malicious scripts.

I would recommend using a service call instead.

Thank you for your effort.

               

> For script tag in action section in Screen (and form) use a FlexibleStringExpander for scriptLocation and correctly manage minilang script context
> --------------------------------------------------------------------------------------------------------------------------------------------------
>
>                 Key: OFBIZ-4688
>                 URL: https://issues.apache.org/jira/browse/OFBIZ-4688
>             Project: OFBiz
>          Issue Type: Improvement
>          Components: framework
>    Affects Versions: SVN trunk
>            Reporter: Olivier Heintz
>            Priority: Minor
>             Fix For: SVN trunk
>
>         Attachments: OFBIZ-4688-without_TypeValue.patch, OFBIZ-4688-without_TypeValue_V2.patch, OFBIZ-4688-without_TypeValue_V3.patch, OFBIZ-4688-without_TypeValue_V4.patch, OFBIZ-4688.patch
>
>
> FlexibleStringExpander to be able to have script name depending from context.
> Minilang script are Useful to migrated some action (too large) as a minilang script
> Be carreful, this patch contain patch from JIRA-4687, if necessary I can submit a new patch without it

--
This message is automatically generated by JIRA.
If you think it was sent incorrectly, please contact your JIRA administrators: https://issues.apache.org/jira/secure/ContactAdministrators!default.jspa
For more information on JIRA, see: http://www.atlassian.com/software/jira