Changes for page Attachments

Last modified by SuperUwe Trueggelmann on 2026/10/09 12:58

From version 4.1
edited by SuperNico Laub
on 2025/09/18 17:51
Change comment: Install extension [org.xwiki.platform:xwiki-platform-attachment-ui/17.7.0]
To version 5.1
edited by SuperUwe Trueggelmann
on 2026/10/09 12:58
Change comment: Install extension [org.xwiki.platform:xwiki-platform-attachment-ui/17.10.13]

Summary

Details

Page properties
Author
... ... @@ -1,1 +1,1 @@
1 -xwiki:XWiki.supernico
1 +xwiki:XWiki.superuwe
Content
... ... @@ -175,8 +175,10 @@
175 175   (% class="gallery_actions" %)(((
176 176   #foreach ($action in $actions)
177 177   #set( $actionname = $services.localization.render("${translationPrefix}.actions.${action.name}") )
178 + ## Escape the URL so that it cannot break out of the link syntax, whatever its origin.
179 + #set ($actionURL = $services.rendering.escape($action.url, 'xwiki/2.1'))
178 178   [[${services.icon.render($action.icon)}(% class="sr-only"%)${actionname}(%%)>>##
179 - path:${action.url}||class="tool ${action.name} $!{action.extraCssClass}"##
181 + path:${actionURL}||class="tool ${action.name} $!{action.extraCssClass}"##
180 180   title="${actionname}" #if($action.rel) rel="${action.rel}"#end]]##
181 181   #end
182 182   $!additionalContent
... ... @@ -268,7 +268,10 @@
268 268   #_attachmentPicker_displayStartFrame({'cssClass' : "gallery_emptyChoice $!{dcssClass}", 'text' : $services.localization.render("${translationPrefix}.default"), 'value' : "${options.defaultValue}"} $currentValue)
269 269   #_attachmentPicker_displayAttachmentDetails($defaultAttachment $options)
270 270   #set ($returnURL = $escapetool.url($doc.getURL('view', $request.queryString)))
271 - #set ($selectURL = $targetDocument.getURL(${options.get('docAction')}, "${options.get('classname')}_${options.get('object')}_${options.get('property')}=&form_token=$!{services.csrf.getToken()}"))
273 + #set ($selectURL = $targetDocument.getURL(${options.get('docAction')}, $escapetool.url({
274 + "${options.get('classname')}_${options.get('object')}_${options.get('property')}": '',
275 + 'form_token': $!{services.csrf.getToken()}
276 + })))
272 272   #_attachmentPicker_displayEndFrame ([{'name' : 'select', 'url' : $selectURL, 'icon' : 'check', 'extraCssClass' : 'btn btn-xs btn-success'}])
273 273  #end
274 274  {{/velocity}}
XWiki.JavaScriptExtension[0]
Code
... ... @@ -2,6 +2,7 @@
2 2   function uploadTemporaryAttachment() {
3 3   // Require jquery locally until we are able to fully migrate this code away from prototype.
4 4   const form = this.property.up('form');
5 + const propertyReferenceInput = this.property.querySelector('input[type="hidden"].property-reference');
5 5   require(['jquery'], function ($) {
6 6   const data = new FormData();
7 7   const uploadedFile = $('#attachfile')[0].files[0];
... ... @@ -40,7 +40,7 @@
40 40   .prop('type', 'hidden')
41 41   .prop('name', 'uploadedFiles')
42 42   .prop('value', response.fileName))
43 - $(form).find('input[type="hidden"].property-reference').prop('value', response.fileName);
44 + propertyReferenceInput.value = response.fileName;
44 44   this.updateAttachment(response.fileName, response.url);
45 45   this.dialog.closeDialog();
46 46   }.bind(this)).fail(function () {
... ... @@ -167,7 +167,7 @@
167 167   /** AJAX deletion of attachments. */
168 168   onDelete : function(event) {
169 169   event.stop();
170 - deleteTool = event.element();
171 + const deleteTool = event.target.closest('.btn');
171 171   if (!deleteTool.disabled) {
172 172   new XWiki.widgets.ConfirmedAjaxRequest(
173 173   deleteTool.readAttribute('href'),
... ... @@ -210,7 +210,7 @@
210 210   /** Update the property with the selected value without reloading the page. */
211 211   onSelect : function(event) {
212 212   event.stop();
213 - var targetElement = event.element();
214 + const targetElement = event.target.closest('.btn');
214 214   var attachmentName = targetElement.up('.gallery_attachmentbox').down('.gallery_attachmenttitle').title;
215 215   var imageSource = targetElement.up('.gallery_attachmentbox.gallery_image');
216 216   if (imageSource) {
... ... @@ -225,7 +225,7 @@
225 225   if (this.directSave) {
226 226   // save via ajax
227 227   if (!targetElement.disabled) {
228 - new Ajax.Request(event.element().href, {
229 + new Ajax.Request(targetElement.href, {
229 229   onCreate : function() {
230 230   targetElement.disabled = true;
231 231   targetElement._x_notif = new XWiki.widgets.Notification("$services.localization.render('core.widgets.confirmationBox.notification.inProgress')", 'inprogress');
XWiki.WikiMacroClass[0]
Macro code
... ... @@ -121,9 +121,9 @@
121 121   #set ($attachmentResource = '')
122 122   #end
123 123   #if ($displayImage)
124 - (% class="$!{cssClass}#if (!$attachment) hidden#end" %)(((#if ("$!{attachmentResource}" != '' || $forceElement)#if($withLink)[[#end[[image:$services.rendering.escape(${attachmentResource}, 'xwiki/2.1')$!{imageParams}]]#if($withLink)>>attach:$services.rendering.escape(${attachmentResource},'xwiki/2.1')||rel=lightbox]]#{end}#end)))##
124 + (% class="${services.rendering.escape($!cssClass, 'xwiki/2.1')}#if (!$attachment) hidden#end" %)(((#if ("$!{attachmentResource}" != '' || $forceElement)#if($withLink)[[#end[[image:$services.rendering.escape(${attachmentResource}, 'xwiki/2.1')$!{imageParams}]]#if($withLink)>>attach:$services.rendering.escape(${attachmentResource},'xwiki/2.1')||rel=lightbox]]#{end}#end)))##
125 125   #else
126 - (% class="$!{cssClass}" %)#if ("$!{attachmentResource}" != '' || $forceElement)#if ($withLink)[[attach:${attachmentResource}||rel=__blank]]#{else}(% class="displayed" %)#if($targetPermView)$!{services.rendering.escape($!{attachmentName}, 'xwiki/2.1')}#{else}Access Denied#{end}(% %)#{end}#end(%%)##
126 + (% class="${services.rendering.escape($!cssClass, 'xwiki/2.1')}" %)#if ("$!{attachmentResource}" != '' || $forceElement)#if ($withLink)[[attach:${attachmentResource}||rel=__blank]]#{else}(% class="displayed" %)#if($targetPermView)$!{services.rendering.escape($!{attachmentName}, 'xwiki/2.1')}#{else}Access Denied#{end}(% %)#{end}#end(%%)##
127 127   #end
128 128  #end
129 129