[MAGNOLIA-4810] Wrappers don't wrap everything what should be wrapped Created: 01/Feb/13  Updated: 20/May/13  Resolved: 20/May/13

Status: Closed
Project: Magnolia
Component/s: core
Affects Version/s: None
Fix Version/s: 4.5.9

Type: Bug Priority: Critical
Reporter: Milan Divilek Assignee: Jaroslav Simak
Resolution: Fixed Votes: 0
Labels: None
Σ Remaining Estimate: Not Specified Remaining Estimate: Not Specified
Σ Time Spent: Not Specified Time Spent: Not Specified
Σ Original Estimate: Not Specified Original Estimate: Not Specified

Issue Links:
dependency
is depended upon by MAGNOLIA-4778 Audit log is (partially) not working ... Closed
duplicate
relation
is related to MAGNOLIA-4865 ContentDecorator doesn't wrap newly c... Closed
Sub-Tasks:
Key
Summary
Type
Status
Assignee
MAGNOLIA-4866 Make sure every node and property ret... Sub-task Closed Jan Haderka  
MAGNOLIA-4991 Refactor wrappers to extend ContentDe... Sub-task Closed Jaroslav Simak  
MAGNOLIA-4992 ContentDecorator can be lost if works... Sub-task Closed Milan Divilek  
Template:
Acceptance criteria:
Empty
Task DoD:
[ ]* Doc/release notes changes? Comment present?
[ ]* Downstream builds green?
[ ]* Solution information and context easily available?
[ ]* Tests
[ ]* FixVersion filled and not yet released
[ ]  Architecture Decision Record (ADR)
Bug DoR:
[ ]* Steps to reproduce, expected, and actual results filled
[ ]* Affected version filled
Date of First Response:

 Description   

info.magnolia.jcr.wrapper.ChildWrappingNodeWrapper should wrap every returned node, but it doesn't wrap nodes returned by methods getParent and getAncestor.
Also it doesn't wrap session which is returned by method getSession. So if we call wrappedNode.getSession.getNode returned node is not wrapped. Similarly applies to workspace.

info.magnolia.jcr.wrapper.PropertyAndChildWrappingNodeWrapper should wrap every returned property, but it doesn't wrap nodes returned by setProperty(*) methods.

info.magnolia.jcr.wrapper.WrappingPropertyWrapper should also wrap every returned node and property not only nodes and properties acquired via references.



 Comments   
Comment by Roman Kovařík [ 22/Feb/13 ]

When this issue will be solved:

  1. FTL templates have to be changed, remove ?html - marked with
    "[#-- ?html have to be removed when MAGNOLIA-4810 will be solved --]"
  2. remove escaping in ImageModel:
    public String getPhoto() {
            ...
            if(binaryData != null){
                //escape to prevent XSS attack, should be tested without escaping when MAGNOLIA-4810 will be solved. Then the escaping should be removed.
                final String link = EscapeUtil.escapeXss(templatingFunctions.link(binaryData));
                return link;
            } else {
              ...
    
Comment by Magnolia International [ 22/Feb/13 ]

I hope custom templates won't have to be changed to continue working ?

Comment by Jan Haderka [ 24/Feb/13 ]

Nope.

Comment by Jan Haderka [ 03/Mar/13 ]

commits https://git.magnolia-cms.com/gitweb/?p=magnolia_main.git;a=commit;h=981acd7d9cda24069baaa6589ca50250d5bbd057 and https://git.magnolia-cms.com/gitweb/?p=magnolia_main.git;a=commit;h=450295ad070e7560e8f0684256b1c7c48eb7391c belong to the subtask - MAGNOLIA-4866.

Generated at Mon Feb 12 03:59:15 CET 2024 using Jira 9.4.2#940002-sha1:46d1a51de284217efdcb32434eab47a99af2938b.