0 Votes

Changes for page Attachments

Last modified by Сергей Коршунов on 2026/10/08 16:40

From version 21.1
edited by Сергей Коршунов
on 2026/06/28 18:02
Change comment: Install extension [org.xwiki.platform:xwiki-platform-attachment-ui/18.4.1]
To version 23.1
edited by Сергей Коршунов
on 2026/10/08 16:40
Change comment: Install extension [org.xwiki.platform:xwiki-platform-attachment-ui/18.8.0]

Summary

Details

Page properties
Content
... ... @@ -34,7 +34,7 @@
34 34  #**
35 35   * Displays the attachment gallery as a list of attachment boxes, starting with special boxes for uploading a new attachment and for setting a default value.
36 36   *
37 - * @param $targetDocument the document to recieve the field value being modified
37 + * @param $targetDocument the document to receive the field value being modified
38 38   * @param $targetAttachDocument the document to list/save attachments to
39 39   * @param $options generic picker options
40 40   *#
... ... @@ -175,8 +175,10 @@
175 175   (% class="gallery_actions" %)(((
176 176   #foreach ($action in $actions)
177 177   #set( $actionname = $services.localization.render("${translationPrefix}.actions.${action.name}") )
178 + ## Escape the URL so that it cannot break out of the link syntax, whatever its origin.
179 + #set ($actionURL = $services.rendering.escape($action.url, 'xwiki/2.1'))
178 178   [[${services.icon.render($action.icon)}(% class="sr-only"%)${actionname}(%%)>>##
179 - path:${action.url}||class="tool ${action.name} $!{action.extraCssClass}"##
181 + path:${actionURL}||class="tool ${action.name} $!{action.extraCssClass}"##
180 180   title="${actionname}" #if($action.rel) rel="${action.rel}"#end]]##
181 181   #end
182 182   $!additionalContent
... ... @@ -268,7 +268,10 @@
268 268   #_attachmentPicker_displayStartFrame({'cssClass' : "gallery_emptyChoice $!{dcssClass}", 'text' : $services.localization.render("${translationPrefix}.default"), 'value' : "${options.defaultValue}"} $currentValue)
269 269   #_attachmentPicker_displayAttachmentDetails($defaultAttachment $options)
270 270   #set ($returnURL = $escapetool.url($doc.getURL('view', $request.queryString)))
271 - #set ($selectURL = $targetDocument.getURL(${options.get('docAction')}, "${options.get('classname')}_${options.get('object')}_${options.get('property')}=&form_token=$!{services.csrf.getToken()}"))
273 + #set ($selectURL = $targetDocument.getURL(${options.get('docAction')}, $escapetool.url({
274 + "${options.get('classname')}_${options.get('object')}_${options.get('property')}": '',
275 + 'form_token': $!{services.csrf.getToken()}
276 + })))
272 272   #_attachmentPicker_displayEndFrame ([{'name' : 'select', 'url' : $selectURL, 'icon' : 'check', 'extraCssClass' : 'btn btn-xs btn-success'}])
273 273  #end
274 274  {{/velocity}}
XWiki.JavaScriptExtension[0]
Code
... ... @@ -319,8 +319,8 @@
319 319   document.observe('xwiki:dom:loaded', function() {
320 320   $$('.attachment-picker-start').invoke('observe', 'click', function(event) {
321 321   event.stop();
322 - var targetElement = event.element();
323 - var url = targetElement.href;
322 + const targetElement = event.target.closest('.attachment-picker-start');
323 + let url = targetElement.dataset.modalUrl;
324 324   if (url.indexOf('?') < 0) {
325 325   url += '?';
326 326   }
XWiki.WikiMacroClass[0]
Macro code
... ... @@ -146,9 +146,17 @@
146 146   #if ($hasTargetDoc)
147 147   #set ($queryString.targetdocname = $targetdoc.fullName)
148 148   #end
149 - #set ($linkLabel = $services.rendering.escape($services.rendering.escape($buttontext, 'xwiki/2.1'), 'xwiki/2.1'))
150 - (% class="buttonwrapper" %)[[$linkLabel>>${xcontext.macro.doc.fullName}||queryString="$escapetool.url($queryString)"
151 - class="attachment-picker-start button" title="$services.rendering.escape($buttontext, 'xwiki/2.1')"]](%%)##
149 + #set ($linkLabel = $escapetool.xml($buttontext))
150 + #set ($modalUrl = $escapetool.xml("$xcontext.macro.doc.URL?$escapetool.url($queryString)"))
151 + {{html clean="false"}}
152 + <p>
153 + <span class="buttonwrapper">
154 + <button type="button" class="attachment-picker-start button"
155 + title="$!{linkLabel}"
156 + data-modal-url="${modalUrl}">$!linkLabel</button>
157 + </span>
158 + </p>
159 + {{/html}}##
152 152   #end
153 153  #end
154 154  {{/velocity}}