XH 1.7: Remove event handler attributes

Discussions and requests related to new CMSimple features, plugins, templates etc. and how to develop.
Please don't ask for support at this forums!
Post Reply
cmb
Posts: 13273
Joined: Tue Jun 21, 2011 11:04 am
Location: Mü-Sa, RLP, DE
Contact:

XH 1.7: Remove event handler attributes

Post by cmb » Tue Mar 24, 2015 1:16 pm

Hi everybody,

I suggest to remove the event handler attributes from the core and the internal plugins (meta_tags, page_params and filebrowser), and to replace them with event listeners. I prefer to keep JavaScript out of the generated HTML generally, as it tends to require painful escaping for anything non trivial (see Filebrowser_View::escapeForEventHandlerAttribute(), for instance), and seems to add some complexity to the dependency resolution. But more importantly, it would be a prerequisite for enabling Content Security Policy. According to the Content Security Policy Level 2 CR there may be workarounds via nonces and hashes, but that might introduce unnecessary complexity.
Christoph M. Becker – Plugins for CMSimple_XH

cmb
Posts: 13273
Joined: Tue Jun 21, 2011 11:04 am
Location: Mü-Sa, RLP, DE
Contact:

Re: XH 1.7: Remove event handler attributes

Post by cmb » Sun Mar 29, 2015 10:03 pm

I propose this patch. It removes all event handler attributes[1] which I could find, and adds event listeners instead which are registered in a "jQuery style". To avoid introducing some general JS library, I've duplicated some code for now. We should consider to either use jQuery instead, or to roll a minimal JS library on our own, in one of the next sprints, but at least for now, this duplication seems to be tolerable.

[1] Except the $onload attributes used in the front-end (login form and password forgotten focusing), because we have not yet any JS resources for the front-end.
Christoph M. Becker – Plugins for CMSimple_XH

manu
Posts: 749
Joined: Wed Jun 04, 2008 12:05 pm
Location: St. Gallen - Schweiz
Contact:

Re: XH 1.7: Remove event handler attributes

Post by manu » Mon Mar 30, 2015 8:20 am

Just a question as we didn't lock out older templates: Is this HTML < 5 - proof?
Besides impressive good work, Christoph.
regards
manu

cmb
Posts: 13273
Joined: Tue Jun 21, 2011 11:04 am
Location: Mü-Sa, RLP, DE
Contact:

Re: XH 1.7: Remove event handler attributes

Post by cmb » Mon Mar 30, 2015 12:38 pm

manu wrote:Just a question as we didn't lock out older templates: Is this HTML < 5 - proof?
Yes. Using event listeners is actually more standards conforming, because they have been introduced in the DOM Level 2 Events Specification, whereas the exact behavior of event handler attributes may not have been standardized at all.
manu wrote:Besides impressive good work, Christoph.
Thanks.
Christoph M. Becker – Plugins for CMSimple_XH

cmb
Posts: 13273
Joined: Tue Jun 21, 2011 11:04 am
Location: Mü-Sa, RLP, DE
Contact:

Re: XH 1.7: Remove event handler attributes

Post by cmb » Tue Apr 21, 2015 6:24 pm

Done (r1535).
Christoph M. Becker – Plugins for CMSimple_XH

Post Reply