[Rt-devel] the /CLASS modifier in ParseFormat

[Jesse Vincent]

On Aug 20, 2007, at 11:55 AM, Nicholas Clark wrote:

> In Elements/CollectionAsTable/ParseFormat, along with the code for / 
> TITLE,
> /STYLE and /ALIGN, there is code to parse /CLASS and store the value.
> But nothing ever reads it
>
> Would the appended patch make sense? (Against 3.6.4)
> With this I can tweak the format to set classes, which allows CSS to
> reference particular <td>s
>

Before you commit this, can you make sure that $class gets properly  
escaped? so that users cant' inject javascript and the like?

> Nicholas Clark
>
> Index: html/Elements/CollectionAsTable/Row
> ===================================================================
> RCS file: /export/cvsroot/rt-external/html/Elements/ 
> CollectionAsTable/Row,v
> retrieving revision 1.1.1.2
> diff -p -u -r1.1.1.2 Row
> --- html/Elements/CollectionAsTable/Row	1 Aug 2007 15:56:53 -0000	 
> 1.1.1.2
> +++ html/Elements/CollectionAsTable/Row	20 Aug 2007 11:02:13 -0000
> @@ -71,7 +71,8 @@ foreach my $column (@Format) {
>          next;
>      }
>      $item++;
> -    $m->out('<td class="collection-as-table" ');
> +    my $class = $column->{class} || 'collection-as-table';
> +    $m->out(qq{<td class="$class" });
>      $m->out( 'align="' . $column->{align} . '"' ) if ( $column-> 
> {align} );
>      $m->out( 'style="' . $column->{style} . '"' ) if ( $column-> 
> {style} );
>      $m->out('>');
> _______________________________________________
> List info: http://lists.bestpractical.com/cgi-bin/mailman/listinfo/ 
> rt-devel
>

-------------- next part --------------
A non-text attachment was scrubbed...
Name: PGP.sig
Type: application/pgp-signature
Size: 186 bytes
Desc: This is a digitally signed message part
Url : http://lists.bestpractical.com/pipermail/rt-devel/attachments/20070820/7b48d800/PGP.pgp