').text(jS.sheetTab(true)).html() [19:52] RobertPlummer: in jquery.sheet.js on line 2274, the tab name needs to be escaped. change jS.sheetTab(true) to jQuery('

').text(jS.sheetTab(true)).html() [19:52] that's the way to escape HTML in JavaScript that I found [19:52] that's the way to escape HTML in JavaScript that I found [19:53] what about escape()? [19:53] what about escape()? [19:53] RobertPlummer: escape and unescape() are for URI escaping [19:53] RobertPlummer: escape and unescape() are for URI escaping [19:53] ah ok [19:53] ah ok [20:12] hum, any problems with the application menu in trunk? mine seems to be empty [20:12] hum, any problems with the application menu in trunk? mine seems to be empty [20:13] ah, nevermind, that was because of the ADOdb bug jonnyb fixed, solved [20:13] ah, nevermind, that was because of the ADOdb bug jonnyb fixed, solved [20:16] chealer that fix is entirely too complex [20:16] chealer that fix is entirely too complex [20:16] RobertPlummer: really :-? [20:16] RobertPlummer: really :-? [20:16] I'm just messing with you [20:16] I'm just messing with you [20:16] Great suggestion! [20:16] Great suggestion! [20:17] RobertPlummer: aha, never know when you don't know the code [20:17] RobertPlummer: aha, never know when you don't know the code [20:17] One thing I'm having a problem with that I don't know how to solve as of yet is nested quotes.... [20:17] One thing I'm having a problem with that I don't know how to solve as of yet is nested quotes.... [20:17] If you look at grip.php, it is bad... just a big string. [20:17] If you look at grip.php, it is bad... just a big string. [20:17] We really need to make it a DOM element. [20:17] We really need to make it a DOM element. [20:17] What do you think chealer ? [20:17] What do you think chealer ? [20:18] RobertPlummer: uh, if I look at grid.php, I see 2800 lines of code I don't know... [20:18] RobertPlummer: uh, if I look at grid.php, I see 2800 lines of code I don't know... [20:19] lol [20:19] lol [20:19] I don't get your question [20:19] I don't get your question [20:19] I hear you. [20:19] I hear you. [20:19] look for "formula=" [20:19] look for "formula=" [20:19] bad, bad, bad [20:19] bad, bad, bad [20:19] That whole table should be a dom element [20:19] That whole table should be a dom element [20:20] http://php.net/manual/en/class.domelement.php [20:20] http://php.net/manual/en/class.domelement.php [20:21] RobertPlummer: there's a td with a formula attribute? [20:21] RobertPlummer: there's a td with a formula attribute? [20:21] right [20:21] right [20:21] what if the formula has nested quotes? [20:21] what if the formula has nested quotes? [20:21] BREAK! [20:21] BREAK! [20:21] RobertPlummer: which is invalid HTML, no? [20:21] RobertPlummer: which is invalid HTML, no? [20:22] it is [20:22] it is [20:22] we really shouldn't even use attr formula [20:22] we really shouldn't even use attr formula [20:23] we should use data-formula="" [20:23] we should use data-formula="" [20:24] RobertPlummer: hum. I really never started thinking how a JavaScript spreadsheet works or should work, but I would tend to think the formula should be stored in something like a JavaScript formulas arrays until it has to be displayed. unless there are performance issues? [20:24] RobertPlummer: hum. I really never started thinking how a JavaScript spreadsheet works or should work, but I would tend to think the formula should be stored in something like a JavaScript formulas arrays until it has to be displayed. unless there are performance issues? [20:24] *** redflo has joined #tikiwiki [20:24] *** redflo has joined #tikiwiki [20:25] jQuery.sheet was based off of a concept called TrimPath Spreadsheet. [20:25] jQuery.sheet was based off of a concept called TrimPath Spreadsheet. [20:25] That used the forumla attribute. [20:25] That used the forumla attribute. [20:26] Plus it is easy to make a spreadsheet with plain text

[20:26] Plus it is easy to make a spreadsheet with plain text

[20:27] RobertPlummer: frankly, I find any implementation that doesn't produce valid HTML quite ugly. but I guess, if you want to use an element attribute, quotes inside should be similarly HTML-escaped [20:27] RobertPlummer: frankly, I find any implementation that doesn't produce valid HTML quite ugly. but I guess, if you want to use an element attribute, quotes inside should be similarly HTML-escaped [20:32] RobertPlummer: when you say you should data-formula, what do you mean, is that not another attribute name? [20:32] RobertPlummer: when you say you should data-formula, what do you mean, is that not another attribute name? [20:32] In html5 there is the new data attribute. [20:32] In html5 there is the new data attribute. [20:33]

[20:33]

[20:33] RobertPlummer: so you can use data-foo and HTML will basically ignore it? [20:33] RobertPlummer: so you can use data-foo and HTML will basically ignore it? [20:33] I'm not sure what you mean, ignour it. [20:33] I'm not sure what you mean, ignour it. [20:34] It is the proper way to store your data in a dom element as of html 5. [20:34] It is the proper way to store your data in a dom element as of html 5. [20:34] I mean it doesn't consider it for rendering, just leaves it to scripts [20:34] I mean it doesn't consider it for rendering, just leaves it to scripts [20:34] good [20:34] good [20:34] In the past we could user $(obj).attr('myAttr', 'myVal'), but it wasen't html valid. [20:34] In the past we could user $(obj).attr('myAttr', 'myVal'), but it wasen't html valid. [20:34] RobertPlummer: so good then, do that but HTML-encode the value [20:34] RobertPlummer: so good then, do that but HTML-encode the value [20:34] how html encode? [20:34] how html encode? [20:35] RobertPlummer: if it's in PHP, with htmlspecialchars() [20:35] RobertPlummer: if it's in PHP, with htmlspecialchars() [20:35] oh nice! [20:35] oh nice! [20:36] RobertPlummer: are you on the security team? [20:36] RobertPlummer: are you on the security team? [20:36] I think Marc wants me on there. [20:36] I think Marc wants me on there. [20:36] I honestly don't know, [20:36] I honestly don't know, [20:37] He said "Lets get you on the security team"... and I was like "ok". [20:37] He said "Lets get you on the security team"... and I was like "ok". [20:37] Is that all there is to it? Or is there a ceremony? [20:37] Is that all there is to it? Or is there a ceremony? [20:38] RobertPlummer: I don't know how it's done, admins should know better. but I'll forward you an email [20:38] RobertPlummer: I don't know how it's done, admins should know better. but I'll forward you an email [20:39] Thanks [20:39] Thanks [20:39] chealer, didn't you start Tiki? [20:39] chealer, didn't you start Tiki? [20:42] RobertPlummer: yes, but that was when I lived in Argentina and could speak Spanish. now, whenever I start it, it crashes [20:42] RobertPlummer: yes, but that was when I lived in Argentina and could speak Spanish. now, whenever I start it, it crashes [20:43] What crashes? [20:43] What crashes? [20:43] spanish or tiki? [20:43] spanish or tiki? [20:44] Yo hablo espaniol tambien me amigo! [20:44] Yo hablo espaniol tambien me amigo! [20:44] Podemos hablar juntos! [20:44] Podemos hablar juntos! [20:44] chealer, so why aren't you an Admin? [20:44] chealer, so why aren't you an Admin? [20:44] Can't handle the pressure? [20:44] Can't handle the pressure? [20:45] RobertPlummer: I just forwarded you a related mail [20:45] RobertPlummer: I just forwarded you a related mail [20:46] RobertPlummer: I was just kidding, weren't you too? I did not actually create Tiki, Luis Argerich did. [20:46] RobertPlummer: I was just kidding, weren't you too? I did not actually create Tiki, Luis Argerich did. [20:46] No, [20:46] No, [20:47] I thought when we were in New York you said you founded it or something. [20:47] I thought when we were in New York you said you founded it or something. [20:48] RobertPlummer: hahaha, that's funny. I was there in the old days just after Luis ceased being involved, that's all. [20:48] RobertPlummer: hahaha, that's funny. I was there in the old days just after Luis ceased being involved, that's all. [20:48] Ah ok [20:48] Ah ok [20:48] I understand why you were asking so many questions now. I'm just a clueless mascot! [20:48] I understand why you were asking so many questions now. I'm just a clueless mascot! [20:49] RobertPlummer: I was recruited by Marc in the days where he, mose, luis (and redflo?) were the admins [20:49] RobertPlummer: I was recruited by Marc in the days where he, mose, luis (and redflo?) were the admins [20:54] Very cool [20:54] Very cool [20:56] RobertPlummer: yes. maybe we're missing a small page on Tiki history :-) [20:56] RobertPlummer: yes. maybe we're missing a small page on Tiki history :-) [20:56] chealer, on another front, ajax add to cart is now part of Tiki! [20:56] chealer, on another front, ajax add to cart is now part of Tiki! [20:56] Woohoo! [20:56] Woohoo! [20:57] With many carts, it is an afterthought. [20:57] With many carts, it is an afterthought. [20:57] With tiki, it is a core feature! [20:57] With tiki, it is a core feature! [20:58] RobertPlummer: will remember that when I try cart! [20:58] RobertPlummer: will remember that when I try cart! [20:59] Yea, just remember that is it VERY ruff right now. [20:59] Yea, just remember that is it VERY ruff right now. [20:59] yeah. maybe there should actually be a demo in the TikiFest [20:59] yeah. maybe there should actually be a demo in the TikiFest [21:02] s/tikifest/next TikiFest/ [21:02] s/tikifest/next TikiFest/ [21:04] RobertPlummer: now that you know I'm not the founder, I suppose you don't need me anymore? :-) [21:04] RobertPlummer: now that you know I'm not the founder, I suppose you don't need me anymore? :-) [21:08] silence speaks volumes [21:08] silence speaks volumes [21:08] chealer: jk [21:08] chealer: jk [21:11] chealer, adding your fix on line 2991 actually [21:11] chealer, adding your fix on line 2991 actually [21:11] better to do it for any time sheetTab is called. [21:11] better to do it for any time sheetTab is called. [21:12] there is actually a better way of doing it with regex rather than dom creation, and then returning text. [21:12] there is actually a better way of doing it with regex rather than dom creation, and then returning text. [21:13] For instance.... [21:13] For instance.... [21:13] Html
Test comes our HtmlTest, but what you want is " [21:13] Html
Test comes our HtmlTest, but what you want is " [21:13] "Html Test".... Notice the space [21:13] "Html Test".... Notice the space [21:18] SOOOO [21:18] SOOOO [21:18] line 2991.... [21:18] line 2991.... [21:18] return (sheetTab + '').replace(/<(?!\/(?=>|\s.*>))\/?.*?>/g, ' ')); [21:18] return (sheetTab + '').replace(/<(?!\/(?=>|\s.*>))\/?.*?>/g, ' ')); [21:18] what do you think chealer? [21:18] what do you think chealer? [21:18] simple yet elegant? [21:18] simple yet elegant? [21:23] RobertPlummer: with the fix I suggest, name "Html
Test" would be rendered as "Html
Test" [21:23] RobertPlummer: with the fix I suggest, name "Html
Test" would be rendered as "Html
Test" [21:23] RobertPlummer: you have to decide the field semantics. for me, names shouldn't contain HTML [21:23] RobertPlummer: you have to decide the field semantics. for me, names shouldn't contain HTML [21:24] chealer: So the fix that I have, good or bad? [21:24] chealer: So the fix that I have, good or bad? [21:24] chealer: you are a clever devel! [21:24] chealer: you are a clever devel! [21:25] Not devil :) [21:25] Not devil :) [21:25] RobertPlummer: I'm not familiar enough with JavaScript to read the regex easily, what does it do? [21:25] RobertPlummer: I'm not familiar enough with JavaScript to read the regex easily, what does it do? [21:26] it removes html tags and replaces them with a space. [21:26] it removes html tags and replaces them with a space. [21:26] And since one 1 space of any group of spaces is valid, the end result is tabs without html ;) [21:26] And since one 1 space of any group of spaces is valid, the end result is tabs without html ;) [21:26] We use ' ' not '%nbsp; [21:26] We use ' ' not '%nbsp; [21:26] [21:26] [21:26] sorry [21:26] sorry [21:27] I use this same solution in jQuery.s5 for the title at the bottom of the screen. [21:27] I use this same solution in jQuery.s5 for the title at the bottom of the screen. [21:27] It needed to be 1 long line [21:27] It needed to be 1 long line [21:27] RobertPlummer: you say sheetTab would already be escaped? [21:27] RobertPlummer: you say sheetTab would already be escaped? [21:28] No I just added it [21:28] No I just added it [21:29] RobertPlummer: yes, I mean in "(sheetTab + '')", sheetTab is a variable that was previously escaped, right? [21:29] RobertPlummer: yes, I mean in "(sheetTab + '')", sheetTab is a variable that was previously escaped, right? [21:30] it is declared as a variable, [21:30] it is declared as a variable, [21:30] of type string [21:30] of type string [21:30] but with jQuery an attribute can be an object as well as text [21:30] but with jQuery an attribute can be an object as well as text [21:30] line 2976: jS.obj.sheet().attr('title'); [21:30] line 2976: jS.obj.sheet().attr('title'); [21:31] sheetTab = jS.obj.sheet().attr('title'); [21:31] sheetTab = jS.obj.sheet().attr('title'); [21:31] sorry [21:31] sorry [21:31] Man I can't type today! [21:31] Man I can't type today! [21:31] *** jonnyb has quit IRC (Quit: nite nite) [21:31] *** jonnyb has quit IRC (Quit: nite nite) [21:31] So (sheetTab + '') is shorthand for sheetTab.toString() [21:31] So (sheetTab + '') is shorthand for sheetTab.toString() [21:32] RobertPlummer: OK, so then it's a variable (or a kind of variable), but it is not yet HTML-escaped, right? [21:32] RobertPlummer: OK, so then it's a variable (or a kind of variable), but it is not yet HTML-escaped, right? [21:32] right [21:32] right [21:32] RobertPlummer: ah, I see [21:32] RobertPlummer: ah, I see [21:32] return (sheetTab + '').replace(/<(?!\/(?=>|\s.*>))\/?.*?>/g, ' ')); effectively escapes it [21:32] return (sheetTab + '').replace(/<(?!\/(?=>|\s.*>))\/?.*?>/g, ' ')); effectively escapes it [21:32] into plain text [21:32] into plain text [21:33] minus the html [21:33] minus the html [21:35] RobertPlummer: well, one problem is that escaping needs to do more than neutralizing HTML tags. If another HTML special character appears, like ampersand, it should be escaped as & [21:35] RobertPlummer: well, one problem is that escaping needs to do more than neutralizing HTML tags. If another HTML special character appears, like ampersand, it should be escaped as & [21:37] I disagree, I think that & should show up '&' [21:37] I disagree, I think that & should show up '&' [21:37] RobertPlummer: also, neutralizing HTML is not entirely trivial. I can't precisely decipher your regex, but any regex has chances of being flawed. I don't means your is but it's risky [21:37] RobertPlummer: also, neutralizing HTML is not entirely trivial. I can't precisely decipher your regex, but any regex has chances of being flawed. I don't means your is but it's risky [21:38] RobertPlummer: OK, first, why would people put HTML code in a sheet's name? [21:38] RobertPlummer: OK, first, why would people put HTML code in a sheet's name? [21:38] I have no idea, perhaps I don't understand the issue fully. [21:38] I have no idea, perhaps I don't understand the issue fully. [21:39] RobertPlummer: I mean, I'm not going to name my child Geo
rge, unless I want the state to take it from me [21:39] RobertPlummer: I mean, I'm not going to name my child Geo
rge, unless I want the state to take it from me [21:40] lol. good point [21:40] lol. good point [21:41] In jQuery.sheet I'd always tried to make it what others want, I thought that is what you were asking for. [21:41] In jQuery.sheet I'd always tried to make it what others want, I thought that is what you were asking for. [21:41] no? [21:41] no? [21:41] if I do, I think showing his name literally as "Geo
rge" would be correct [21:41] if I do, I think showing his name literally as "Geo
rge" would be correct [21:41] lol [21:41] lol [21:42] With my solution it would be "Geo rge" [21:42] With my solution it would be "Geo rge" [21:42] Ok ok, I will do it YOUR way [21:42] Ok ok, I will do it YOUR way [21:42] RobertPlummer: if I look at sheets, I don't see why I would name a sheet "Geo
rge" to show it as "Geo rge" [21:42] RobertPlummer: if I look at sheets, I don't see why I would name a sheet "Geo
rge" to show it as "Geo rge" [21:43] RobertPlummer: it would show with the line break in http://localhost/tiki/trunk/tiki-sheets.php ? [21:43] RobertPlummer: it would show with the line break in http://localhost/tiki/trunk/tiki-sheets.php ? [21:43] What I'm saying is I thought that is what you were asking for. [21:43] What I'm saying is I thought that is what you were asking for. [21:44] RobertPlummer: no, my main concern is to always produce valid HTML and to neutralize data avoiding HTML injections [21:44] RobertPlummer: no, my main concern is to always produce valid HTML and to neutralize data avoiding HTML injections [21:44] ok [21:44] ok [21:44] That is a good way of putting it. [21:44] That is a good way of putting it. [21:44] Your way is better for that [21:44] Your way is better for that [21:44] I will use it them [21:44] I will use it them [21:44] I will use it then [21:44] I will use it then [21:45] RobertPlummer: for example, converting "" to a space doesn't make sense [21:45] RobertPlummer: for example, converting "" to a space doesn't make sense [21:46] RobertPlummer: so yes, I think the title should be defined as nothing but text, and rendered as that text literally [21:46] RobertPlummer: so yes, I think the title should be defined as nothing but text, and rendered as that text literally [21:46] unless we discover a good use case to do differently [21:46] unless we discover a good use case to do differently [21:51] RobertPlummer: as for pre-escaping jS.sheetTab() vs escaping when using it, I don't know jquery.sheet(), you know better. don't even take my patch as a suggestion the latter is better, I must have done it that way because it was faster for me. it's certainly a good idea to check if the value lacks escaping in other places or to try preventing it. [21:51] RobertPlummer: as for pre-escaping jS.sheetTab() vs escaping when using it, I don't know jquery.sheet(), you know better. don't even take my patch as a suggestion the latter is better, I must have done it that way because it was faster for me. it's certainly a good idea to check if the value lacks escaping in other places or to try preventing it. [21:53] :) [21:53] :) [21:53] chealer is it tr or tra in php to translate? [21:53] chealer is it tr or tra in php to translate? [21:54] RobertPlummer: any, one calls the other [21:54] RobertPlummer: any, one calls the other [21:54] You guys got lazy! [21:54] You guys got lazy! [21:54] eventually it'll be t() [21:54] eventually it'll be t() [21:54] unless it already is? [21:54] unless it already is? [21:55] hehehe. I don't think so but I think gettext has it even lazier :-) [21:55] hehehe. I don't think so but I think gettext has it even lazier :-) [21:56] (optionally, anyway) [21:56] (optionally, anyway) [21:56] Translating the menu for sheet... [21:56] Translating the menu for sheet... [21:56] or making it translatable I mean. [21:56] or making it translatable I mean. [21:56] like $translation = _("foo"); [21:56] like $translation = _("foo"); [21:56] great [21:56] great [21:57] on that, I'm actually going to leave. thanks RobertPlummer [21:57] on that, I'm actually going to leave. thanks RobertPlummer [21:57] Thanks for you help today, [21:57] Thanks for you help today, [21:57] Sorry to delay your exit mi amigo [21:57] Sorry to delay your exit mi amigo [21:58] pleasure, no delay [21:58] pleasure, no delay [21:59] mi espanol no esta muy bueno :-) [21:59] mi espanol no esta muy bueno :-) [21:59] hasta luego! [21:59] hasta luego! [22:09] Ok all, I've created a file menu.php in lib/jquery_tiki/jquery.sheet/ and it is saying I don't have access to it, what gives? [22:09] Ok all, I've created a file menu.php in lib/jquery_tiki/jquery.sheet/ and it is saying I don't have access to it, what gives? [22:09] it is chmod 777 [22:09] it is chmod 777 [22:14] Info: Tiki 7 Beta Available for Download - http://info.tiki.org/article162-Tiki-7-Beta-Available-for-Download [22:14] Info: Tiki 7 Beta Available for Download - http://info.tiki.org/article162-Tiki-7-Beta-Available-for-Download [22:18] *** daniam has joined #tikiwiki [22:18] *** daniam has joined #tikiwiki [22:46] RobertPlummer: when doing what? [22:46] RobertPlummer: when doing what? [22:46] what "it" is saying that? [22:46] what "it" is saying that? [22:48] New Forum Posts: Edit UI is fixed width - http://tiki.org/tiki-view_forum_thread.php?forumId=4&comments_parentId=41120 [22:48] New Forum Posts: Edit UI is fixed width - http://tiki.org/tiki-view_forum_thread.php?forumId=4&comments_parentId=41120 [23:18] *** Trebly has quit IRC (Ping timeout: 240 seconds) [23:18] *** Trebly has quit IRC (Ping timeout: 240 seconds) [23:32] *** Trebly has joined #tikiwiki [23:32] *** Trebly has joined #tikiwiki [23:36] *** Trebly has quit IRC (Read error: Connection reset by peer) [23:36] *** Trebly has quit IRC (Read error: Connection reset by peer) [23:37] *** daniam has quit IRC (Ping timeout: 252 seconds) [23:37] *** daniam has quit IRC (Ping timeout: 252 seconds)