Commit dbcaa640 authored by Tomáš Peterka's avatar Tomáš Peterka Committed by Tomáš Peterka

[hal_json] Choose named prefix over "_" for private variables passed via forms

parent 60c42769
......@@ -203,7 +203,7 @@ if len(listbox_id_list):
# First check for an query in form parameters - if they are there
# that means previous view was a listbox with selected stuff so recover here
query = extra_param.get("query", None)
select_all = extra_param.get("_select_all", 0)
select_all = extra_param.get("basedialog_select_all", 0)
# inject `uids` into Scripts **kwargs when we got any `query` (empty or filled)
if query is not None:
......@@ -216,7 +216,7 @@ if query is not None:
# early-stop if user selected all documents
if query == "" and select_all == 0 and dialog_method != update_method: # do not interrupt on UPDATE
extra_param["_select_all"] = 1
extra_param["basedialog_select_all"] = 1
return context.Base_renderForm(
dialog_id,
message=translate("All documents are selected! Submit again to proceed or Cancel and narrow down your search."),
......
......@@ -13,14 +13,13 @@ else:
if kwargs.get("update_method", ""):
return context.Base_renderForm(dialog_id, message="Updated. " + message)
if _my_confirmation == 0:
# Here is an example of unfriendly confirmation Script which takes
# whole keep_item for itself!
if donothing_confirmation == 0:
# Here is an example of an adversary Script which hijacks `keep_items`
# It should take keep_items from parameters, update it and pass it
# along. But no programmer will ever comply with that so we are ready!
# through. But no programmer will ever comply therefor we are ready!
return context.Base_renderForm(dialog_id,
message="Submit again to confirm. " + message,
level='warning',
keep_items={'_my_confirmation': 1})
keep_items={'donothing_confirmation': 1})
return context.Base_redirect(form_id, keep_items={"portal_status_message": message})
......@@ -50,7 +50,7 @@
</item>
<item>
<key> <string>_params</string> </key>
<value> <string>dialog_id, form_id, uids, _my_confirmation=0, **kwargs</string> </value>
<value> <string>dialog_id, form_id, uids, donothing_confirmation=0, **kwargs</string> </value>
</item>
<item>
<key> <string>id</string> </key>
......
Markdown is supported
0%
or
You are about to add 0 people to the discussion. Proceed with caution.
Finish editing this message first!
Please register or to comment