Commit dbcaa640 authored by Tomáš Peterka's avatar Tomáš Peterka Committed by Tomáš Peterka

[hal_json] Choose named prefix over "_" for private variables passed via forms

parent 60c42769
...@@ -203,7 +203,7 @@ if len(listbox_id_list): ...@@ -203,7 +203,7 @@ if len(listbox_id_list):
# First check for an query in form parameters - if they are there # First check for an query in form parameters - if they are there
# that means previous view was a listbox with selected stuff so recover here # that means previous view was a listbox with selected stuff so recover here
query = extra_param.get("query", None) query = extra_param.get("query", None)
select_all = extra_param.get("_select_all", 0) select_all = extra_param.get("basedialog_select_all", 0)
# inject `uids` into Scripts **kwargs when we got any `query` (empty or filled) # inject `uids` into Scripts **kwargs when we got any `query` (empty or filled)
if query is not None: if query is not None:
...@@ -216,7 +216,7 @@ if query is not None: ...@@ -216,7 +216,7 @@ if query is not None:
# early-stop if user selected all documents # early-stop if user selected all documents
if query == "" and select_all == 0 and dialog_method != update_method: # do not interrupt on UPDATE if query == "" and select_all == 0 and dialog_method != update_method: # do not interrupt on UPDATE
extra_param["_select_all"] = 1 extra_param["basedialog_select_all"] = 1
return context.Base_renderForm( return context.Base_renderForm(
dialog_id, dialog_id,
message=translate("All documents are selected! Submit again to proceed or Cancel and narrow down your search."), message=translate("All documents are selected! Submit again to proceed or Cancel and narrow down your search."),
......
...@@ -13,14 +13,13 @@ else: ...@@ -13,14 +13,13 @@ else:
if kwargs.get("update_method", ""): if kwargs.get("update_method", ""):
return context.Base_renderForm(dialog_id, message="Updated. " + message) return context.Base_renderForm(dialog_id, message="Updated. " + message)
if _my_confirmation == 0: if donothing_confirmation == 0:
# Here is an example of unfriendly confirmation Script which takes # Here is an example of an adversary Script which hijacks `keep_items`
# whole keep_item for itself!
# It should take keep_items from parameters, update it and pass it # It should take keep_items from parameters, update it and pass it
# along. But no programmer will ever comply with that so we are ready! # through. But no programmer will ever comply therefor we are ready!
return context.Base_renderForm(dialog_id, return context.Base_renderForm(dialog_id,
message="Submit again to confirm. " + message, message="Submit again to confirm. " + message,
level='warning', level='warning',
keep_items={'_my_confirmation': 1}) keep_items={'donothing_confirmation': 1})
return context.Base_redirect(form_id, keep_items={"portal_status_message": message}) return context.Base_redirect(form_id, keep_items={"portal_status_message": message})
...@@ -50,7 +50,7 @@ ...@@ -50,7 +50,7 @@
</item> </item>
<item> <item>
<key> <string>_params</string> </key> <key> <string>_params</string> </key>
<value> <string>dialog_id, form_id, uids, _my_confirmation=0, **kwargs</string> </value> <value> <string>dialog_id, form_id, uids, donothing_confirmation=0, **kwargs</string> </value>
</item> </item>
<item> <item>
<key> <string>id</string> </key> <key> <string>id</string> </key>
......
Markdown is supported
0%
or
You are about to add 0 people to the discussion. Proceed with caution.
Finish editing this message first!
Please register or to comment