Wedge

What does that have to do with this function?

It's used for the following to remove bad URLs from the indexers view. Well, if we just changed them to real, good URLs and then worked with those instead, that would make more sense and more understandable for everyone IMO.

It's not even in use everywhere. I took a look at the message index for this board:
result:

Code: [Select]

<span style="font-weight: bold;" onclick="expandPages(this, 'http://www.simplemachines.org/community/index.php?board=74.%1$d', 150, 2100, 50);" onmouseover="this.style.cursor='pointer';"> ... </span>

So, if it isn't being used there with an odd URL, shouldn't it be presenting errors or odd accesses in the logs?

It's used several times on the infocenter toggle object on the board index to add quotes around the $txt and session vars.

The following is a shining example from the display template. It is so much harder to read because of the escaping:

Code: [Select]

sTemplateBodyEdit: '\n\t\t\t\t\t\t\t\t<div id="quick_edit_body_container" style="width: 90%">\n\t\t\t\t\t\t\t\t\t<div id="error_box" style="padding: 4px;" class="error"><' + '/div>\n\t\t\t\t\t\t\t\t\t<textarea class="editor" name="message" rows="12" style="width: 100%; margin-bottom: 10px;" tabindex="5">%body%<' + '/textarea><br />\n\t\t\t\t\t\t\t\t\t<input type="hidden" name="af00a1ba031" value="c5e7963677f5827d8476125917ac76b2" />\n\t\t\t\t\t\t\t\t\t<input type="hidden" name="topic" value="382883" />\n\t\t\t\t\t\t\t\t\t<input type="hidden" name="msg" value="%msg_id%" />\n\t\t\t\t\t\t\t\t\t<div class="righttext">\n\t\t\t\t\t\t\t\t\t\t<input type="submit" name="post" value="Save" tabindex="6" onclick="return oQuickModify.modifySave(\'c5e7963677f5827d8476125917ac76b2\', \'af00a1ba031\');" accesskey="s" class="button_submit" />&nbsp;&nbsp;<input type="button" value="Spell Check" tabindex="7" onclick="spellCheck(\'quickModForm\', \'message\');" class="button_submit" />&nbsp;&nbsp;<input type="submit" name="cancel" value="Cancel" tabindex="8" onclick="return oQuickModify.modifyCancel();" class="button_submit" />\n\t\t\t\t\t\t\t\t\t<' + '/div>\n\t\t\t\t\t\t\t\t<' + '/div>',

It escaped the tabs with \\t and line breaks with \\n so they can be readable in JavaScript... but not the HTML output that anyone is actually going to read. It changed all of the closing divs... why? I don't even see any URLs here for it to escape.

I finally found one that supports what everyone is saying:

Code: [Select]

sTemplateSubjectNormal: ', JavaScriptEscape('<a href="' . $scripturl . '?topic=' . $context['current_topic'] . '.msg%msg_id%#msg%msg_id%" rel="nofollow">%subject%</a>'), ',


result:

Code: [Select]

sTemplateSubjectNormal: '<a hr'+'ef="http://www.simplemachines.org/community/index.php'+'?topic=382883.msg%msg_id%#msg%msg_id%" rel="nofollow">%subject%<' + '/a>'

How, you might ask, do I propose we fix that? Well, there are two (or even three) options.

One means that a normal, simple link is no longer created in the template. That makes the non-cached JavaScript a lot smaller.

Code: [Select]

Modify QuickModify() returning that link with the correct information. Makes a whole lot more sense that way.

Second would be to use the JavaScript var: smf_scripturl.

Code: [Select]

sTemplateSubjectNormal: \'<a href="\' + smf_scripturl \'?topic=', $context['current_topic'], '.msg%msg_id%#msg%msg_id%" rel="nofollow">%subject%</a>\'',


The last would be a URL creator function (pseudo since I'm using the browser to write all of this):

Code: [Select]

function url(base_uri = smf_scripturl, query_string, args)
{
   // see sprintf(): http://www.diveintojavascript.com/projects/javascript-sprintf
   return sprintf();
   // there are also easier replace().
}

Any way you look at that, it actually makes it easier for you to rewrite the URLs. It could still be possible to use a JS escaping function, but we should really figure out what we want to do with it and how it makes the user safer.

link=msg=263240 date=1309240621]
I'm 25, so I guess I was about 17 when I started working on SMF.  Certainly have learned a few things since then.

Dunno about whizzkid, essentially I spent the couple years after high school working on SMF before I got a job.  It's much easier to get a lot of things done when you don't have other obligations etc. yet.  More a function of circumstance.

-[Unknown]

How old are you, Unknown?
If you're younger than Pete is, does that mean you were one of those Dragooon-like wizkids back when you started SMF?

I hate those fucking wizkids, they always end up being faster and better than me :niark:

Considering there already is in Aeva...

To me it seems Wedge has already been laid out with that lesser possibilities for me as a designer, while SMF is still "full on"...although its focus on CSS-only themes takes away the focus on getting mods out of themes. But at least you CAN still change any template, luckily. I do remember Nao mentioned that it can be done in Wedge too, so its not all bad - but focusing on stylings sends a powerful signal out to any starting designer for Wedge.

But I also see WHY Nao/Arantor wants more features in - more powerful, central developing point etc. I think thats a slightly wrong turn though. Take Yourasoft, where a core was to replace SMF, with its forum as a module only(allowing others to also make other forum modules). It was from day one agreed that things should/could have alternatives.

* "[Unknown "]takes a moment to say he did not intentionally hijack this topic.