h:commandLink和unsafe-inline

时间:2017-07-03 03:23:33

标签: jsf content-security-policy

如果你看一下h:commandLink解决//JSF <h:commandLink action="#{user.goLoginPage}" value="Login page + Param "> <f:param name="username" value="mkyong" /> </h:commandLink> //HTML output <script type="text/javascript" src="/JavaServerFaces/faces/javax.faces.resource/jsf.js?ln=javax.faces&stage=Development"> </script> <a href="#" onclick="mojarra.jsfcljs(document.getElementById('j_idt6'), {'j_idt6:j_idt20':'j_idt6:j_idt20','username':'mkyong'},''); return false"> Login page + Param </a> 的方法,就会看起来像这样。

unsafe-inline

问题在于,如果您强制执行h:commandLinks,您的浏览器将拒绝执行此操作。

我一直使用Mkyong example将内联脚本列入白名单。

有没有办法让// ViewController.swift // // Copyright © 2017 smokzz. All rights reserved. // import UIKit import SwiftMessages import Alamofire class ViewController: UIViewController,UIAlertViewDelegate { @IBOutlet var myTableView: UIView! @IBOutlet weak var EmailField: UITextField! @IBOutlet weak var PasswordField: UITextField! @IBAction func LoginBtnTapped(_ sender: Any) { let userEmail = EmailField.text! let userPassword = PasswordField.text! if((userEmail.isEmpty) || (userPassword.isEmpty)){ // createAlert(title: "Oops! ", message: "Email or Password field is empty") let view = MessageView.viewFromNib(layout: .CardView) view.configureTheme(.error) view.configureDropShadow() let iconText = [""].sm_random()! view.configureContent(title: "Oops!", body: "Email or Password field is empty.", iconText: iconText) SwiftMessages.show(view: view) if #available(iOS 10.0, *) { let PhoneVibrate = UINotificationFeedbackGenerator() PhoneVibrate.notificationOccurred(.error) } return } else { let myUrl = URL(string: "http://192.168.0.105/api/api.php?action=login"); var request = URLRequest(url:myUrl!) request.httpMethod = "POST"// Compose a query string let postString = "email=\(userEmail)&password=\(userPassword)"; request.httpBody = postString.data(using: String.Encoding.utf8); let task = URLSession.shared.dataTask(with: request) { (data: Data?, response: URLResponse?, error: Error?) in if error != nil { print("error=\(error)") return } // You can print out response object print("response = \(response)") //Let's convert response sent from a server side script to a NSDictionary object: do { let json = try JSONSerialization.jsonObject(with: data!, options: .mutableContainers) as? NSDictionary if let parseJSON = json { // Now we can access value of First Name by its key let Message = parseJSON["status"] as? String var model_id = parseJSON["id"] as? String print("Message: \(Message)") print("Model ID: \(model_id)") if(Message == "true"){ let view = MessageView.viewFromNib(layout: .CardView) view.configureTheme(.success) view.configureDropShadow() let iconText = [""].sm_random()! view.configureContent(title: "Welcome!", body: "You have successfully logged in.", iconText: iconText) SwiftMessages.show(view: view) func prepare(for segue: UIStoryboardSegue, sender: Any?) { if let destination = segue.destination as? ActiveSubViewController { destination.id_model = model_id! } } OperationQueue.main.addOperation { self.dismiss(animated: true, completion: nil); self.performSegue(withIdentifier: "Home", sender: self) } } else { let view = MessageView.viewFromNib(layout: .CardView) view.configureTheme(.warning) view.configureDropShadow() let iconText = [""].sm_random()! view.configureContent(title: "Sorry!", body: "Incorrect Email or Password.", iconText: iconText) SwiftMessages.show(view: view) } } } catch { print(error) } } task.resume() } } override func viewDidLoad() { super.viewDidLoad() //dissmis keyboard let tap: UITapGestureRecognizer = UITapGestureRecognizer(target: self, action: "dismissKeyboard") view.addGestureRecognizer(tap) } func dismissKeyboard() { view.endEditing(true) } override func didReceiveMemoryWarning() { super.didReceiveMemoryWarning() // Dispose of any resources that can be recreated. } func createAlert(title:String, message:String) { let alert = UIAlertController(title: title, message: message, preferredStyle: UIAlertControllerStyle.alert) alert.addAction(UIAlertAction(title: "OK", style: UIAlertActionStyle.default, handler: { (action) in alert.dismiss(animated: true, completion: nil) })) self.present(alert, animated: true, completion: nil) }} 有效?

1 个答案:

答案 0 :(得分:3)

HTML 无法使用<a>元素执行POST请求。在这种情况下,JSF只是一个HTML代码生成器,对此无能为力。

您有3个选项:

  1. 替换为<h:commandButton>
  2. 或者,替换为<h:link>
  3. 或者,用外部初始化脚本的自定义组件替换。
  4. 另见: