Changes for page Attachments
Last modified by Сергей Коршунов on 2026/10/08 16:40
From version 21.1
edited by Сергей Коршунов
on 2026/06/28 18:02
on 2026/06/28 18:02
Change comment:
Install extension [org.xwiki.platform:xwiki-platform-attachment-ui/18.4.1]
To version 23.1
edited by Сергей Коршунов
on 2026/10/08 16:40
on 2026/10/08 16:40
Change comment:
Install extension [org.xwiki.platform:xwiki-platform-attachment-ui/18.8.0]
Summary
-
Page properties (1 modified, 0 added, 0 removed)
-
Objects (2 modified, 0 added, 0 removed)
Details
- Page properties
-
- Content
-
... ... @@ -34,7 +34,7 @@ 34 34 #** 35 35 * Displays the attachment gallery as a list of attachment boxes, starting with special boxes for uploading a new attachment and for setting a default value. 36 36 * 37 - * @param $targetDocument the document to rec ieve the field value being modified37 + * @param $targetDocument the document to receive the field value being modified 38 38 * @param $targetAttachDocument the document to list/save attachments to 39 39 * @param $options generic picker options 40 40 *# ... ... @@ -175,8 +175,10 @@ 175 175 (% class="gallery_actions" %)((( 176 176 #foreach ($action in $actions) 177 177 #set( $actionname = $services.localization.render("${translationPrefix}.actions.${action.name}") ) 178 + ## Escape the URL so that it cannot break out of the link syntax, whatever its origin. 179 + #set ($actionURL = $services.rendering.escape($action.url, 'xwiki/2.1')) 178 178 [[${services.icon.render($action.icon)}(% class="sr-only"%)${actionname}(%%)>>## 179 - path:${action .url}||class="tool ${action.name} $!{action.extraCssClass}"##181 + path:${actionURL}||class="tool ${action.name} $!{action.extraCssClass}"## 180 180 title="${actionname}" #if($action.rel) rel="${action.rel}"#end]]## 181 181 #end 182 182 $!additionalContent ... ... @@ -268,7 +268,10 @@ 268 268 #_attachmentPicker_displayStartFrame({'cssClass' : "gallery_emptyChoice $!{dcssClass}", 'text' : $services.localization.render("${translationPrefix}.default"), 'value' : "${options.defaultValue}"} $currentValue) 269 269 #_attachmentPicker_displayAttachmentDetails($defaultAttachment $options) 270 270 #set ($returnURL = $escapetool.url($doc.getURL('view', $request.queryString))) 271 - #set ($selectURL = $targetDocument.getURL(${options.get('docAction')}, "${options.get('classname')}_${options.get('object')}_${options.get('property')}=&form_token=$!{services.csrf.getToken()}")) 273 + #set ($selectURL = $targetDocument.getURL(${options.get('docAction')}, $escapetool.url({ 274 + "${options.get('classname')}_${options.get('object')}_${options.get('property')}": '', 275 + 'form_token': $!{services.csrf.getToken()} 276 + }))) 272 272 #_attachmentPicker_displayEndFrame ([{'name' : 'select', 'url' : $selectURL, 'icon' : 'check', 'extraCssClass' : 'btn btn-xs btn-success'}]) 273 273 #end 274 274 {{/velocity}}
- XWiki.JavaScriptExtension[0]
-
- Code
-
... ... @@ -319,8 +319,8 @@ 319 319 document.observe('xwiki:dom:loaded', function() { 320 320 $$('.attachment-picker-start').invoke('observe', 'click', function(event) { 321 321 event.stop(); 322 - vartargetElement = event.element();323 - varurl = targetElement.href;322 + const targetElement = event.target.closest('.attachment-picker-start'); 323 + let url = targetElement.dataset.modalUrl; 324 324 if (url.indexOf('?') < 0) { 325 325 url += '?'; 326 326 }
- XWiki.WikiMacroClass[0]
-
- Macro code
-
... ... @@ -146,9 +146,17 @@ 146 146 #if ($hasTargetDoc) 147 147 #set ($queryString.targetdocname = $targetdoc.fullName) 148 148 #end 149 - #set ($linkLabel = $services.rendering.escape($services.rendering.escape($buttontext, 'xwiki/2.1'), 'xwiki/2.1')) 150 - (% class="buttonwrapper" %)[[$linkLabel>>${xcontext.macro.doc.fullName}||queryString="$escapetool.url($queryString)" 151 - class="attachment-picker-start button" title="$services.rendering.escape($buttontext, 'xwiki/2.1')"]](%%)## 149 + #set ($linkLabel = $escapetool.xml($buttontext)) 150 + #set ($modalUrl = $escapetool.xml("$xcontext.macro.doc.URL?$escapetool.url($queryString)")) 151 + {{html clean="false"}} 152 + <p> 153 + <span class="buttonwrapper"> 154 + <button type="button" class="attachment-picker-start button" 155 + title="$!{linkLabel}" 156 + data-modal-url="${modalUrl}">$!linkLabel</button> 157 + </span> 158 + </p> 159 + {{/html}}## 152 152 #end 153 153 #end 154 154 {{/velocity}}