Task #17626

JS-function checkSubmit should not use eval

Added by Mads Brunn almost 14 years ago. Updated almost 4 years ago.

Status:
Closed
Priority:
Should have
Assignee:
Category:
FormEngine aka TCEforms
Target version:
Start date:
2007-09-24
Due date:
% Done:

100%

Estimated time:
TYPO3 Version:
PHP Version:
Tags:
Complexity:
Sprint Focus:

Description

The checkSubmit function in typo3/jsfunc.tbe_editor.js (used in backend forms) is in IMHO not correctly implemented.

The lines 260-264 checks if any user-defined javascript (registered with t3lib_tceforms->additionalJS_submit) should be evaluated before the form is submitted.

But it uses the eval-function to execute the javascript and this means that you cannot abort the submit in your own javascript-code (using "return false;") .

(issue imported from #M6392)


Related issues

Related to TYPO3 Core - Task #63712: Avoid use of eval() and replace itClosed2015-09-30

Actions
Related to TYPO3 Core - Bug #61996: unsafe-evalClosed2014-10-01

Actions
#1

Updated by Oliver Hader almost 14 years ago

Hi,
what do you mean with "abort the submit in your own javascript-code"? Could you please give an example?
We cound integrate another check before line 266, e.g.

if (STOP) {
  return false;
}

So, you can add e.g. the following to t3lib_TCEforms->additionalJS_submit:
if (!MyValidatorObject.someFunction()) {
  STOP = true;
}

#2

Updated by Mads Brunn almost 14 years ago

Hi,

Yes, that's exactly what I had in mind.

I want e.g. to do a check on a specific field and if it doesn't have a specific value the submit should be aborted.

Btw. I think this used to work in version 4.0 but back then the code in t3lib_TCEforms->additionalJS_submit was simply injected directly in the onsubmit function.

#3

Updated by Andreas Wolf about 10 years ago

  • Tracker changed from Bug to Feature
  • Subject changed from JS-function checkSubmit not correctly implemented to JS-function checkSubmit should not use eval
  • Category set to FormEngine aka TCEforms
  • Status changed from New to Accepted
  • Assignee set to Andreas Wolf
  • Target version deleted (0)

I guess this is more a feature than a bug... But we should definitely have it.

#4

Updated by Mathias Schreiber almost 7 years ago

  • Assignee changed from Andreas Wolf to Frank Naegler

Could you check during your FormEngine crusade, please?

#5

Updated by Frank Naegler about 6 years ago

  • Target version set to 7.4 (Backend)
  • PHP Version deleted (4.3)
#6

Updated by Susanne Moog about 6 years ago

  • Target version changed from 7.4 (Backend) to 7.5
#7

Updated by Benni Mack almost 6 years ago

  • Target version changed from 7.5 to 7 LTS
#8

Updated by Gerrit Code Review almost 6 years ago

  • Status changed from Accepted to Under Review

Patch set 1 for branch master of project Packages/TYPO3.CMS has been pushed to the review server.
It is available at http://review.typo3.org/43743

#9

Updated by Gerrit Code Review almost 6 years ago

Patch set 2 for branch master of project Packages/TYPO3.CMS has been pushed to the review server.
It is available at http://review.typo3.org/43743

#10

Updated by Gerrit Code Review almost 6 years ago

Patch set 3 for branch master of project Packages/TYPO3.CMS has been pushed to the review server.
It is available at http://review.typo3.org/43743

#11

Updated by Benni Mack almost 6 years ago

  • Tracker changed from Feature to Task
#12

Updated by Gerrit Code Review almost 6 years ago

Patch set 4 for branch master of project Packages/TYPO3.CMS has been pushed to the review server.
It is available at http://review.typo3.org/43743

#13

Updated by Frank Naegler almost 6 years ago

  • Status changed from Under Review to Resolved
  • % Done changed from 0 to 100
#14

Updated by Riccardo De Contardi almost 4 years ago

  • Status changed from Resolved to Closed

Also available in: Atom PDF