Due to the value binding on can get interesting effects when the
displayEdit field is in write (input) mode, as then the values still
get relayed to the display field, which itself is wanted as the field
supports live-switching, but even though the display field is
disabled and hidden, the value will be still rendered and a user can
XSS themselves inserting things like:
<img src="a" onerror="alert('cookie:'+document.cookie);"></token
And even though it's harmless (your browser knows your own cookie
already), it is rather odd and simply to cheap to harden against (per
default) to not do so.
Reported-by: Marcel Fromkorth <marcel.fromkorth@8com.de>
Signed-off-by: Thomas Lamprecht <t.lamprecht@proxmox.com>
The "smartness" is mostly "enable it automatically if the caller did
not specify an explicit override and there's neither a failure nor
callback function define", but that should cover most cases.
Signed-off-by: Thomas Lamprecht <t.lamprecht@proxmox.com>
while this is something that only the user that made the request will
see, and for most people the possibility of "hacking" themselves is
rather redundant, it is still not nice to have this possible in
general; as even if it's highly unlikely that there ever can be an
error triggered to another user via API2 request handling, hardening
against it is simply to cheap to not do it.
Reported-by: Marcel Fromkorth <marcel.fromkorth@8com.de>
Signed-off-by: Thomas Lamprecht <t.lamprecht@proxmox.com>
'picker.hide()' hides the picker, but does not do everything to
properly keep track of the picker state in the combobox class.
This lead to a bug when we reselected an entry, we had to click the
picker again twice to open it again.
Use the 'collapse' method of the combobox instead, which does the
necessary book-keeping.
Signed-off-by: Dominik Csapak <d.csapak@proxmox.com>
by introducing a errorHeight config property. This is necessary when
the ComboGrid has e.g. a toolbar and we show the error in the grid body
only, 100 pixels is not enough then. To solve that without hardcoding
different heights, let the subclass/caller configure that
also set this when the store load fails completely (was not done until now)
Signed-off-by: Dominik Csapak <d.csapak@proxmox.com>
for most of the combogrids, this does not make a difference, but we
want to have a node selection in some of their toolbars. There
having the error over the whole grid makes it impossible to select a
different node (which might be necessary to get rid of the error), so
we show the error on the view (which is the grids content body only).
Signed-off-by: Dominik Csapak <d.csapak@proxmox.com>
In PBS we get an array here, so the renderer is fine, but in pve it's
just a long string, so add a space after commas to achieve the same
effect.
Without this, the second column is not visible in pve because of an
error in the renderer (no 'join' function on a string)
Signed-off-by: Dominik Csapak <d.csapak@proxmox.com>
[ T: squash in code-reduction to make it a one-liner again ]
Signed-off-by: Thomas Lamprecht <t.lamprecht@proxmox.com>
Adds a download button in the TaskViewer. Uses the newly created
downloadAsFile() method in the Utils class.
Signed-off-by: Daniel Tschlatscher <d.tschlatscher@proxmox.com>
Tested-by: Stefan Sterz <s.sterz@proxmox.com>
Reviewed-by: Stefan Sterz <s.sterz@proxmox.com>
Adds a function for downloading a file from a remote URL in the Utils
class and uses it to revise one similar usage in FileBrowser.js
Signed-off-by: Daniel Tschlatscher <d.tschlatscher@proxmox.com>
Tested-by: Stefan Sterz <s.sterz@proxmox.com>
Reviewed-by: Stefan Sterz <s.sterz@proxmox.com>
it can happen that the view is destroyed during an api call, so we
should check if it's destroyed as the first thing in the callback
if the view is destroyed, there is nothing we can do here, so simply
return
Signed-off-by: Dominik Csapak <d.csapak@proxmox.com>
when showing full tags in the tree as inline-block, the height is
increased, leading to unwanted 'wobble' when tags are added/removed
Signed-off-by: Dominik Csapak <d.csapak@proxmox.com>
I tried to keep the format as close to the HTML docs as possible, but
there are a few discrepancies between HTML docs and how this patch
displays parameters, instead of:
- <enum>,the enum variants are displayed. [1]
- <0|1>, <boolean> is displayed.
[1] The HTML docs explain parameters after the initial format string,
which the GUI doesn't (and there's no space for that). Showing the
variants inline is the easiest way to not loose information here.
Signed-off-by: Matthias Heiserer <m.heiserer@proxmox.com>
helpers to
* generate a color from a string consistently
* generate a html tag for a tag
* related css classes
contrast is calculated according to SAPC draft:
https://github.com/Myndex/SAPC-APCA
which is likely to become a w3c guideline in the future and seems
to be a better algorithm for this
Signed-off-by: Dominik Csapak <d.csapak@proxmox.com>
As counter-part to `onGetValue`, which is for form assembly, add the
`onSetValues` helper that allows to hook into setting the values on
the fields, for example if one needs to transform a `disabled` to
`enable`.
Signed-off-by: Thomas Lamprecht <t.lamprecht@proxmox.com>
Regex parses a cpuset via 2 matches. Find number(s) or range(s) folowed
by a comma, then, find a single number or a single range not followed
by a comma. E.g., 0-1,4-5,6,7,10,11,14-15
CpuSet function first checks regex, then ensures left num <= right num
Signed-off-by: Daniel Bowder <daniel@bowdernet.com>
The text needs to be defined in the wait() call as otherwise the
Ext.Progressbar will show a percentage that is not correct anyway but
just reflects where the animated progress bar itself is.
Signed-off-by: Aaron Lauterer <a.lauterer@proxmox.com>
`proxmoxMail` used its own regex pattern to validate emails. that
meant certain email addresses were rejected by the front-end that
were accepted by the backend that uses the functionality from
`pve-common`. examples include the following:
- "user@host.test-tld"
- "user-@host.testtld"
- "user@host"
reported on the forum: https://forum.proxmox.com/threads/gui-bugulance-using-the-user-add-gui-interface.114743/
Signed-off-by: Stefan Sterz <s.sterz@proxmox.com>
When the up or down arrow key on the keyboard was pressed while a
number text field (or any one descending from Ext.form.field.Spinner)
was selected, the up and down callbacks for that text fields KeyNav
were called twice. Therefore, the value in the text field would always
incorrectly increment/decrement by step * 2.
The problem was an overwrite for the onRender() method of the Spinner
class, which caused the callbacks for pressing an arrow key to be
registered for a second time. Simply not doing that in the overwritten
onRender() method fixes the problem.
The redundant declarations for spinUpEl and spinDownEl were removed as
well. Additionally, the 'mousewheel' event handler, registered in the
overwritten (but still executed) parent function, is unregistered now,
as it could lead to unintended side effects in browsers which still
implement this event.
Signed-off-by: Daniel Tschlatscher <d.tschlatscher@proxmox.com>
