Item14255: Bug when uploading files in TinyMCEPlugin

Dear Foswiki team,

I've got a problem when uploading a file with TinyMCEPlugin. In deed, in the version 2.1.2, the attach.js try to get the validation_key field from : - parent.document.MainEdit.validation_key

But the parent document have only one form named : "main".

The change must be done in the file : - TinyMCEPlugin/pub/System/TinyMCEPlugin/plugins/foswikibuttons/jscripts/attach.uncompressed.js - line 95

Changing from : - var key_carrier = parent.document.EditForm.validation_key; To: - var key_carrier = parent.document.main.validation_key;

Thanks a lot for your software. ++, Fabien

-- FabienSecheron - 14 Dec 2016

Crawford, I'm about 5 days away from building Foswiki 2.1.3. Could you validate this, and I'll get it into 2.1.3. Thanks

-- GeorgeClark - 15 Dec 2016

FabienSecheron, could you explain more detail on how exactly to recreate this? I have tested uploading of attachments using the paperclip icon in a wysiwyg editor, and it works just fine. It submits a validation key that appears to be valid.

What browser are you using to trigger this issue?

-- GeorgeClark - 16 Dec 2016

Actually in inspecting the browser window, this code does seem correct. The name of the form is "EditForm"

<form id="EditForm" name="EditForm" action="/bin/save" method="post" validate="" onsubmit="StrikeOne.submit(this)">
<input type='hidden' name='validation_key' value='?4e95ce7161ae7b61bdd27fa11780fa36' />

And the code in question:

    submit: function(url, $form) {
        var key_carrier = parent.document.EditForm.validation_key;
        if (typeof(StrikeOne) !== 'undefined') {
             // Get the validation key from the textarea
            var nonce = key_carrier.value;
            if (nonce) {
                // Transfer to the upload form
                $dlg('#validation_key').val(StrikeOne.calculateNewKey(nonce));
            }
        }

I'm not really a javascript dev, but this looks like it is correct.

-- GeorgeClark - 16 Dec 2016

It depends. If the browser is IE8 and the save request doesn't have the preserve_vk parameter, the key will be expired on the first upload. Subsequent uploads and saves would then fail. On other browsers the save post will respond with a new key that has to installed into all the forms on the edit page.

-- Main.CrawfordCurrie - 21 Jan 2017 - 09:02

Commenting is disabled while not logged in