Stop Grails from HTML encoding messages? - grails

Note: in the process of upgrading from Grails 1.3.6 to 2.2.2.
If I have a tag such as:
<g:message code="some.code.here" args="${[someHTML]}" />
It is encoding the value as HTML even though the following is set in Config.groovy:
grails.views.default.codec = "none"
This was not a problem in Grails 1.3.6. It does it for all tags throughout the entire project. This is necessary to pass in the links this way, as we are passing in links based on the language.
Any idea why this is not working even though it was working before the upgrade, or a workaround?
If the HTML is in the .properties file, that renders fine. If the variable is just embedded into the page, it works fine. It the act of passing it in as an argument to g:message that causes it to error. I have attempted to use the <%=someHTML%> way to pass it in, but it doesn't seem to like that, telling me that I am missing a quote.

g:message was changed because of a XSS vulnerability (GRAILS-7170). See http://jira.grails.org/browse/GRAILS-10099 for a workaround for continuing to use HTML arguments in certain cases (such as your use case).

Related

Grails: How to get locale in a GSP page that sits outsides of controller / domain / service?

I have an internazionalised application with language selection, based on Grails and the kickstarter plugin. As per the configuration in its UrlMappings, there are some pages without controller. On these, only the default locale is applied no matter what a user has actually selected. Further, on them changing the language does not work. g:message tags output with the default locale; I tried
<g:set var="locale"
value="${session.'org.springframework.web.servlet.i18n.SessionLocaleResolver.LOCALE' ?: org.springframework.web.servlet.support.RequestContextUtils.getLocale(request)}"/>
(forgot where I found that) .. but following that nothing changes.
Apparently this is a bug in grails versions prior to 2.4.4
I worked around it by retrieving the locale at the top of the gsp in question like so:
<g:set var="lang" value="${session.'org.springframework.web.servlet.i18n.SessionLocaleResolver.LOCALE'}"/>
(from this blog post) and then adding the locale to the messages I want to appear translated in the page, using a solution by #
SergeiShushkevich like so:
<g:message code="text.label" locale="${lang}"/>
${message([code:'text.label', locale:lang])}

Pass Javascript Variable into taglib method call Grails

any idea for this
var elemVal = $("#element").val();
var finalVal = "${someTagLib(attr: elemVal)}";
The element is a select option, so I am getting the value that the user selected to pass into a taglib function. It seems that search isn't being passed into the taglib. Anyone have a suggestion?
This is not possible at all. You are trying to mix server side code with client side code which is a common mistake.
When you use gsp's they first compiled on server i.e. in JVM, but there javascript can not be executed. Similarly when compiled gsp content is rendered as html in the browser, there will be no ${} since that is an groovy expression.
So the thing you are trying to achieve is not possible.

multi line tag in grails or html

With a grails app and from a local database, I'm returning some text in a xml format.
I can return it well formed in a <textarea></textarea> tag with the correct indenting (tabulation, line return,...etc.)
I want to go a bit further. In the text I'm returning, there are some <img/> tags and I'd like to replace those tag by the real images themselves.
I searched around and found no solution as of now. I understood that you can't add an image to a textarea (other then in a background), and if I choose a div tag, I won't have the indenting anymore (and therefore, harder to read)
I was wondering if using a <g:textField/> or an other tag from the grails library will do the trick. And if so, How can I append them to a page using jquery.
For example, how to append a <g:textField/> in jquery. It doesn't interpret it and I get this error
SyntaxError: missing ) after argument list [Break On This Error]...+doc).append("<input type="text" id="FTMAP_"+nb_sec+"" ...
And in my javascript file, I have
$("#FTM_"+doc).append("<g:textField id='FTMAP_"+nb_sec+"' ... />
Any possible solutions ?
EDIT
I did forget to mention that my final intentions are to be able to modify the text (tags included) and to have a nice and neat indentation so that it is the easiest possible for the end user.
You are asking a few different questions:
1. Can I use a single HTML tag to include images inside pre-formatted text.
No. You will have to parse the text and translate it into styled text yourself.
2. Is there a tag in the grails standard tags to accomplish this for me?
No.
3. How can I add grails tags from my javascript code.
Grails tags are processed on the server-side, and javascript is processed on the client. This means you cannot directly add grails tags via javascript.
There are a couple methods that can accomplish the same result, however:
You can set a javascript variable to the rendered content of a grails tag. This solution is good for data that is known at the time of the initial request.
var tagOutput = "${g.textField(/* etc */)}";
You can make an ajax request for the content to be added. Then your server-side grails code can render the tags you need. This is better for realtime data, or data that will be updated more than once on a single rendered page.

ASP.NET MVC 2 and sparkviewengine rendering single quotes to double quotes in html5 data- attribute

I'm having a problem with adding a json value as a data-attribute in a html5 page.
We use the spark view engine (v1.5) in our asp.net mvc 2.0 website.
The following viewcode:
</span>
is being rendered as:
<span class="silk-icon silk-icon-page-edit"></span>
note the enclosing double quotes in data-dialogoptions
A single quote is required to generate a valid json-string in the data-dialogoptions attribute.
Does anyone know what is causing this behavior and how I can change or work around it?
Although this is more of a workaround than an answer, you don't really need to get spark to render single quotes. You could use " escape character which JSON.parse seems to parse correctly.
Here's a really basic example of it running.
Looks like you're seeing this behavior due to a bug/feature in the Spark view engine.
As of version 1.6, this "feature" was "fixed". Spark should now properly preserve single/double quotes.

ASP.NET MVC 2 parameters throws JS error

My application works fine when I have only one parameter.
e.g.
/Product/Index/2
/Report/Sales/08-2009
But it failes when I add one more part to the url. Let's say I want to add the end month-year parameter to the url routing. Mow it becomes:
/Report/Sales/05-2009/09-2009
I do get both parameters in my action method. I parse it and retrieve the data and pass the Model to the View. With this scenario it throws the client side JS error when I try to access any of the form elements. I get "object expected" error. The same view works fine using just first parameter. What could be the issues here?
I also loose the CSS styles when this error occurs.
Thanks
well, without seeing any code at all this is difficult to troubleshoot, but I'd say it's likely because you are referencing your javascript and css files using a relative path like:
../content/scripts/myjavascript.js
Adding the second url parameter has caused the browser to be unable to find the urls because you have added what looks like an extra level of depth to the url.
You should provide absolute urls to your scripts and css files. An easy way to do this is to use the "ResolveUrl" method like so:
<%= ResolveUrl("~/Content/Scripts/myjavascript.css") %>

Resources