From 11f4f1fbe0fb44b2b81b16988a74d88a63eed58e Mon Sep 17 00:00:00 2001
From: Coleman Watts <coleman@civicrm.org>
Date: Mon, 26 Aug 2019 22:10:45 -0400
Subject: [PATCH] Move modelProps to whitelist

---
 ext/afform/core/ang/af/ModelList.js           |  6 ++--
 ext/afform/core/ang/af/ModelProp.js           | 29 +++++++++----------
 ext/afform/core/ang/afBlock/ContactEmail.html |  2 +-
 ext/afform/core/ang/afBlock/ContactName.html  |  2 +-
 ext/afform/core/ang/afField/afField.js        |  2 +-
 5 files changed, 20 insertions(+), 21 deletions(-)

diff --git a/ext/afform/core/ang/af/ModelList.js b/ext/afform/core/ang/af/ModelList.js
index b4465a4515..85222bf806 100644
--- a/ext/afform/core/ang/af/ModelList.js
+++ b/ext/afform/core/ang/af/ModelList.js
@@ -21,8 +21,8 @@
         $scope.myCtrl = this;
 
         this.registerEntity = function registerEntity(entity) {
-          schema[entity.name] = entity;
-          data[entity.name] = data[entity.name] || {};
+          schema[entity.afName] = entity;
+          data[entity.afName] = data[entity.afName] || {};
         };
         this.registerField = function(entityName, fieldName) {
           schema[entityName].fields.push(fieldName);
@@ -40,7 +40,7 @@
         this.loadData = function() {
           var toLoad = 0;
           _.each(schema, function(entity, entityName) {
-            if ($routeParams[entityName] || entity.autofill) {
+            if ($routeParams[entityName] || entity.afAutofill) {
               toLoad++;
             }
           });
diff --git a/ext/afform/core/ang/af/ModelProp.js b/ext/afform/core/ang/af/ModelProp.js
index ce597661ed..47426a6cc5 100644
--- a/ext/afform/core/ang/af/ModelProp.js
+++ b/ext/afform/core/ang/af/ModelProp.js
@@ -2,25 +2,24 @@
   // "afModelProp" is a basic skeletal directive.
   // Example usage: <af-model-list>... <af-model-prop af-name="myModel" af-type="Individual" /> ...</af-model-list>
   angular.module('af').directive('afModelProp', function() {
+    // Whitelist of all allowed properties of an af-model
+    // (at least the ones we care about client-side - other's can be added for server-side processing and we'll just ignore them)
+    var modelProps = {
+      afType: '@',
+      afName: '@',
+      afLabel: '@',
+      afAutofill: '@'
+    };
     return {
       restrict: 'AE',
       require: '^afModelList',
-      scope: {
-        afType: '@',
-        afName: '@',
-        afLabel: '@',
-        afAutofill: '@'
-      },
+      scope: modelProps,
       link: function($scope, $el, $attr, afModelListCtrl) {
-        var ts = $scope.ts = CRM.ts('afform');
-        afModelListCtrl.registerEntity({
-          id: null,
-          type: $scope.afType,
-          name: $scope.afName,
-          label: $scope.afLabel,
-          autofill: $scope.afAutofill,
-          fields: []
-        });
+        var ts = $scope.ts = CRM.ts('afform'),
+          entity = _.pick($scope, _.keys(modelProps));
+        entity.id = null;
+        entity.fields = [];
+        afModelListCtrl.registerEntity(entity);
         // $scope.$watch('afModelProp', function(newValue){$scope.myOptions = newValue;});
       }
     };
diff --git a/ext/afform/core/ang/afBlock/ContactEmail.html b/ext/afform/core/ang/afBlock/ContactEmail.html
index 680a4f1eca..b40b6bec6b 100644
--- a/ext/afform/core/ang/afBlock/ContactEmail.html
+++ b/ext/afform/core/ang/afBlock/ContactEmail.html
@@ -1 +1 @@
-<div>{{ts('Contact email block for a model of type %1 named %2', {1: afModel.getDefn().type, 2: afModel.getDefn().name})}}</div>
+<div>{{ts('Contact email block for a model of type %1 named %2', {1: afModel.getDefn().afType, 2: afModel.getDefn().afName})}}</div>
diff --git a/ext/afform/core/ang/afBlock/ContactName.html b/ext/afform/core/ang/afBlock/ContactName.html
index e1155b04b6..9a18f57841 100644
--- a/ext/afform/core/ang/afBlock/ContactName.html
+++ b/ext/afform/core/ang/afBlock/ContactName.html
@@ -1 +1 @@
-<div>{{ts('Contact name block for a model of type %1 named %2', {1: afModel.getDefn().type, 2: afModel.getDefn().name})}}</div>
+<div>{{ts('Contact name block for a model of type %1 named %2', {1: afModel.getDefn().afType, 2: afModel.getDefn().afName})}}</div>
diff --git a/ext/afform/core/ang/afField/afField.js b/ext/afform/core/ang/afField/afField.js
index 5d4fb7a1fa..f826d22dc4 100644
--- a/ext/afform/core/ang/afField/afField.js
+++ b/ext/afform/core/ang/afField/afField.js
@@ -13,7 +13,7 @@
         var ts = $scope.ts = CRM.ts('afform');
         $scope.afModel = ctrls[0];
         var modelList = ctrls[1];
-        $scope.fieldId = $scope.afModel.getDefn().name + '-' + $scope.fieldName;
+        $scope.fieldId = $scope.afModel.getDefn().afName + '-' + $scope.fieldName;
         $scope.getData = $scope.afModel.getData;
 
         $scope.getOptions = function() {
-- 
2.25.1