Move modelProps to whitelist
authorColeman Watts <coleman@civicrm.org>
Tue, 27 Aug 2019 02:10:45 +0000 (22:10 -0400)
committerCiviCRM <info@civicrm.org>
Wed, 16 Sep 2020 02:13:19 +0000 (19:13 -0700)
ext/afform/core/ang/af/ModelList.js
ext/afform/core/ang/af/ModelProp.js
ext/afform/core/ang/afBlock/ContactEmail.html
ext/afform/core/ang/afBlock/ContactName.html
ext/afform/core/ang/afField/afField.js

index b4465a4515dff6bc68cd88ef7b276fec785a47e7..85222bf806ae28fcc2a720285824fe53ce69cfc2 100644 (file)
@@ -21,8 +21,8 @@
         $scope.myCtrl = this;
 
         this.registerEntity = function registerEntity(entity) {
-          schema[entity.name] = entity;
-          data[entity.name] = data[entity.name] || {};
+          schema[entity.afName] = entity;
+          data[entity.afName] = data[entity.afName] || {};
         };
         this.registerField = function(entityName, fieldName) {
           schema[entityName].fields.push(fieldName);
@@ -40,7 +40,7 @@
         this.loadData = function() {
           var toLoad = 0;
           _.each(schema, function(entity, entityName) {
-            if ($routeParams[entityName] || entity.autofill) {
+            if ($routeParams[entityName] || entity.afAutofill) {
               toLoad++;
             }
           });
index ce597661ed5d6446dd8e7a75642ed6001c47f4a2..47426a6cc52002ea6516ad0edbbb658d76dfdb76 100644 (file)
@@ -2,25 +2,24 @@
   // "afModelProp" is a basic skeletal directive.
   // Example usage: <af-model-list>... <af-model-prop af-name="myModel" af-type="Individual" /> ...</af-model-list>
   angular.module('af').directive('afModelProp', function() {
+    // Whitelist of all allowed properties of an af-model
+    // (at least the ones we care about client-side - other's can be added for server-side processing and we'll just ignore them)
+    var modelProps = {
+      afType: '@',
+      afName: '@',
+      afLabel: '@',
+      afAutofill: '@'
+    };
     return {
       restrict: 'AE',
       require: '^afModelList',
-      scope: {
-        afType: '@',
-        afName: '@',
-        afLabel: '@',
-        afAutofill: '@'
-      },
+      scope: modelProps,
       link: function($scope, $el, $attr, afModelListCtrl) {
-        var ts = $scope.ts = CRM.ts('afform');
-        afModelListCtrl.registerEntity({
-          id: null,
-          type: $scope.afType,
-          name: $scope.afName,
-          label: $scope.afLabel,
-          autofill: $scope.afAutofill,
-          fields: []
-        });
+        var ts = $scope.ts = CRM.ts('afform'),
+          entity = _.pick($scope, _.keys(modelProps));
+        entity.id = null;
+        entity.fields = [];
+        afModelListCtrl.registerEntity(entity);
         // $scope.$watch('afModelProp', function(newValue){$scope.myOptions = newValue;});
       }
     };
index 680a4f1eca97c6f82c324a6746b1b2509d596eed..b40b6bec6b80cef35f600906cf56b47f9b9749da 100644 (file)
@@ -1 +1 @@
-<div>{{ts('Contact email block for a model of type %1 named %2', {1: afModel.getDefn().type, 2: afModel.getDefn().name})}}</div>
+<div>{{ts('Contact email block for a model of type %1 named %2', {1: afModel.getDefn().afType, 2: afModel.getDefn().afName})}}</div>
index e1155b04b6dae90bfca7aa0a6c6207a79df5a1b9..9a18f57841738303b8055fd51f691ba501b4c6fd 100644 (file)
@@ -1 +1 @@
-<div>{{ts('Contact name block for a model of type %1 named %2', {1: afModel.getDefn().type, 2: afModel.getDefn().name})}}</div>
+<div>{{ts('Contact name block for a model of type %1 named %2', {1: afModel.getDefn().afType, 2: afModel.getDefn().afName})}}</div>
index 5d4fb7a1fae5268492fd359f9f6fd897bf0a66db..f826d22dc43b113ff34943dd0bc48b6f71700144 100644 (file)
@@ -13,7 +13,7 @@
         var ts = $scope.ts = CRM.ts('afform');
         $scope.afModel = ctrls[0];
         var modelList = ctrls[1];
-        $scope.fieldId = $scope.afModel.getDefn().name + '-' + $scope.fieldName;
+        $scope.fieldId = $scope.afModel.getDefn().afName + '-' + $scope.fieldName;
         $scope.getData = $scope.afModel.getData;
 
         $scope.getOptions = function() {