[GWC-1234] Refactor inline JavaScript in the Demo Page #1236
Add this suggestion to a batch that can be applied as a single commit.
This suggestion is invalid because no changes were made to the code.
Suggestions cannot be applied while the pull request is closed.
Suggestions cannot be applied while viewing a subset of changes.
Only one suggestion per line can be applied in a batch.
Add this suggestion to a batch that can be applied as a single commit.
Applying suggestions on deleted lines is not supported.
You must change the existing code in this line in order to create a valid suggestion.
Outdated suggestions cannot be applied.
This suggestion has been applied or marked resolved.
Suggestions cannot be applied from pending reviews.
Suggestions cannot be applied on multi-line comments.
Suggestions cannot be applied while the pull request is queued to merge.
Suggestion cannot be applied right now. Please check back later.
This PR moves the inline JavaScript in the Seed Controller into an external file. See #1234 for more information. This PR is related to Content-Security-Policy work for GeoServer 2.26.0 and should NOT be backported.
All Java inputs that were previously written directly into the script tag are now written to hidden input fields that the external JavaScript file will read. The previous Demo Page Java code had to mix HTML and JavaScript escaping depending on where inputs were being written to but the new code only needs to use HTML escaping.
The GetFeatureInfo output was previously handled with a JavaScript XMLHttpRequest call and writing the response into the DOM but is now handled by an iframe like the WMS GetMap OpenLayers3 output format. The reason for this is that the iframe uses its own CSP which allows the GetFeatureInfo HTML to use a more lenient CSP than the Demo page. For example, the GetFeatureInfo CSP can enable inline scripts even if the Demo Page CSP disables inline scripts.
Example of the hidden inputs: