Sorry for the noise, I struggled with """ for long time and didn't
realise that I wasn't need "eval()" anymore...

I don't need js var and eva(); at all as long as I have XML()

# In view
{{if request.args(0)=='SOMETHING':}}
<script type="text/javascript">
    {{=XML(conditional_field_trigger_selected_event_js)}}
</script>
{{pass}}

Richard

On Tue, Jul 17, 2012 at 12:52 PM, Richard Vézina <
[email protected]> wrote:

> I had to use XML() to avoid $quot; in the view, like this :
>
> # In controller
> conditional_field_trigger_selected_event_js
> = '$("select[name=FIELDOFINTERESS]").change(function() {var val =
> $(this).children(":selected").attr("value");$(this).trigger($(this).attr("id")
> + "__selected", [val]);});'
>
> ...
>
> return dict(..., conditional_field_trigger_selected_event_js
> = conditional_field_trigger_selected_event_js)
>
> # In view
> {{if request.args(0)=='SOMETHING':}}
> <script type="text/javascript">
> var conditional_field_trigger_selected_event_js =
> {{=XML(conditional_field_trigger_selected_event_js)}}
> eval(conditional_field_trigger_selected_event_js);
> </script>
> {{pass}}
>
> But, still curious to know if there is security issue with javascript
> eval(); the way I use it.
>
> The purpose of this is to use lazy_option_widget plugin (
> http://dev.s-cubism.com/plugin_lazy_options_widget) without having to use
> suggest widget that is a dependency of lazy_option_widget... Since
> lazy_option_widget only need selected event to be trigger on by suggest
> widget, giving it trigger event from a default web2py dropbox allow to
> eliminate the dependency.
>
> In the future I would implement a custom dropbox widget that support
> trigger selected event. Thought it could be nice to have a option in the
> default web2py dropbox widget to activate and deactivate as needed selected
> trigger event, but don't know if it a good idea.
>
> Thanks to answer.
>
> Richard
>
>
>
> On Tue, Jul 17, 2012 at 11:38 AM, Richard Vézina <
> [email protected]> wrote:
>
>> Hello Anthony in order to do what you propose here, I mean passing
>> javascript code from the controller to the view by mean of return
>> dict(var=js), I think the only way I have to execute the passed js code is
>> to use eval in the view like this :
>>
>> <script type="text/javascript">
>> eval({{=var}});
>> </script>
>>
>> Now, my concern is, is that secure to use javascript eval(); in this way
>> and is what you have in mind when you make this proposition?
>>
>> Thanks
>>
>> Richard
>>
>> On Sun, Jun 5, 2011 at 7:43 PM, Anthony <[email protected]> wrote:
>>
>>> Can't you just include the relevant JS directly in the view template for
>>> the page, or maybe include the JS string in the dict returned by the
>>> controller, and insert it as a variable in the view?
>>>
>>> On Sunday, June 5, 2011 6:22:13 PM UTC-4, David J wrote:
>>>
>>>> How do I inject javascript in my controller from a regular web request?
>>>>
>>>> I read the docs it syas response.js is executed only in a component;
>>>>
>>>> so I have a form and I would like to add JS validators.
>>>>
>>>> so I try adding to the response.js = '$("myfield").validate("**digits");'
>>>>
>>>>
>>>> Of course this only works in component mode as I tried it;
>>>>
>>>> But now I have a single form page and I want this same javascript to
>>>> work;
>>>>
>>>> How do I do that?
>>>>
>>>> Thanks.
>>>>
>>>>
>>>>
>>
>

-- 



Reply via email to