Jean Jordaan | 14 Jan 16:25 2007
Picon

Patch to bxeConfig.js

Hi there

I needed to integrate the bitflux editor in Plone. While doing this I
found that the kupu editor adds some functions to Array.prototype, and
that this breaks BXE.

In bxeConfig.js, in the function bxeConfig.prototype.parseUrlParams
there is an iteration over the elements of an array. At the moment,
.split is called on every element. With the new members introduced by
kupu, there are now array elements that aren't strings, so .split raises
an error.

To avoid this, I test typeof p == "string" before trying the split.

I don't know if this is the best way, and there may be other vulnerable
spots in BXE. But for what it's worth, here's my patch to make BXE show
up in Plone:

=== js/bxeConfig.js
==================================================================
--- js/bxeConfig.js	(revision 2939)
+++ js/bxeConfig.js	(local)
 <at>  <at>  -326,11 +326,13  <at>  <at> 
 	this.urlParams = new Array ();
     var params =
window.location.search.substring(1,window.location.search.length).split("&");
     var i = 0;
-    for (var param in params)
-    {
-        var p = params[param].split("=");
(Continue reading)

Jean Jordaan | 14 Jan 20:21 2007
Picon

Re: Patch to bxeConfig.js

Hi again

> I don't know if this is the best way, and there may be other vulnerable
> spots in BXE.

I think I've just found another one. In 'mozile/domlevel3.js'

function documentSaveXML(snode)
{
	[...]
	for(var i in ns ) {
		if (i == "xmlns") {
			snode.setAttributeNS(XMLNS,"xmlns",ns[i]);
		} else {
			snode.setAttributeNS(XMLNS,"xmlns:" + i , ns[i]);
		}
	}

Breaks with 'snode.setAttributeNS' undefined, and 'i' equal to
'contains', the name of one of the functions that kupu puts on
Array.prototype
No breakage without the kupu code. So the previous fix is not sufficient ..

-- 
jean                                              . .. .... //\\\oo///\\
--

-- 
bx-editor-users mailing list
bx-editor-users <at> lists.bitflux.ch
http://lists.bitflux.ch/cgi-bin/listinfo/bx-editor-users

(Continue reading)

Christian Stocker | 14 Jan 21:05 2007
Picon

Re: Patch to bxeConfig.js

Hi

Thanks for your reports. I'll look into them.

But could you please add them to our bugtracker at

http://bugs.bitflux.ch/browse/BXE

other they may get forgotten

thanks

christian

On 14.1.2007 20:21 Uhr, Jean Jordaan wrote:
> Hi again
> 
>> I don't know if this is the best way, and there may be other vulnerable
>> spots in BXE.
> 
> I think I've just found another one. In 'mozile/domlevel3.js'
> 
> function documentSaveXML(snode)
> {
> 	[...]
> 	for(var i in ns ) {
> 		if (i == "xmlns") {
> 			snode.setAttributeNS(XMLNS,"xmlns",ns[i]);
> 		} else {
> 			snode.setAttributeNS(XMLNS,"xmlns:" + i , ns[i]);
(Continue reading)

Jean Jordaan | 14 Jan 21:31 2007
Picon

Re: Patch to bxeConfig.js

By the way, just wanted to say I'm enjoying working with BXE, thank
you for a very useful tool.

-- 
jean                                              . .. .... //\\\oo///\\
--

-- 
bx-editor-users mailing list
bx-editor-users <at> lists.bitflux.ch
http://lists.bitflux.ch/cgi-bin/listinfo/bx-editor-users

Jean Jordaan | 14 Jan 21:30 2007
Picon

Re: Patch to bxeConfig.js

Hi Christian

> But could you please add them to our bugtracker at
>
> http://bugs.bitflux.ch/browse/BXE

I wanted to, but at http://bugs.bitflux.ch/secure/CreateIssue!default.jspa
there is only

<select name="pid" id="project">
    <option value="10010">Flux CMS</option>
    <option value="10000">zzz Test Projekt</option>
</select>

in the Project dropdown ..

-- 
jean                                              . .. .... //\\\oo///\\
--

-- 
bx-editor-users mailing list
bx-editor-users <at> lists.bitflux.ch
http://lists.bitflux.ch/cgi-bin/listinfo/bx-editor-users

Christian Stocker | 14 Jan 22:18 2007
Picon

Re: Patch to bxeConfig.js


On 14.1.2007 21:30 Uhr, Jean Jordaan wrote:
> Hi Christian
> 
>> But could you please add them to our bugtracker at
>>
>> http://bugs.bitflux.ch/browse/BXE
> 
> I wanted to, but at http://bugs.bitflux.ch/secure/CreateIssue!default.jspa
> there is only
> 
> <select name="pid" id="project">
>     <option value="10010">Flux CMS</option>
>     <option value="10000">zzz Test Projekt</option>
> </select>

Can you try again, something was wrong with the permissions :)

chregu
> 
> in the Project dropdown ..
> 

-- 
christian stocker | Bitflux GmbH | schoeneggstrasse 5 | ch-8004 zurich
phone +41 44 240 56 70 | mobile +41 76 561 88 60 | fax +41 1 240 56 71
http://www.bitflux.ch | christian.stocker <at> bitflux.ch |  GPG 0x5CE1DECB
--

-- 
bx-editor-users mailing list
bx-editor-users <at> lists.bitflux.ch
(Continue reading)

Jean Jordaan | 14 Jan 23:09 2007
Picon

Re: Patch to bxeConfig.js

Hi Christian

> Can you try again, something was wrong with the permissions :)

OK, will do.

I'm struggling to save & exit -- I do this (just read it as pseudocode ..)

            self.REQUEST.RESPONSE.setStatus(204)
            self.REQUEST.RESPONSE.setHeader('Location',
'http://localhost:8080/plone/xmldocs/1-AP011.xml/bxe-edit')
            return

and I end up at
  http://localhost:8085/plone/xmldocs/null
instead of at bxe-edit .. any idea why?

-- 
jean                                              . .. .... //\\\oo///\\
--

-- 
bx-editor-users mailing list
bx-editor-users <at> lists.bitflux.ch
http://lists.bitflux.ch/cgi-bin/listinfo/bx-editor-users


Gmane