Skip to main content
D
ddemay1-Visitor
1-Visitor
February 10, 2010
Question

Windchill 9.1 - Rendering readonly Workflow variablesin HTML format

  • February 10, 2010
  • 4 replies
  • 1047 views
Sounds like you need your own task form template JSP file to use. They are mentioned I think the customizers guide and workflow section of biz admin guide.

Sounds like html output in wf variables is being escaped so it ignored by browser and not rendered. Google html guides on how to display html tags in a webpage and that'll provide a clue as to how to bypass it using a custom task form template.



Sent from my Verizon Wireless BlackBerry

4 replies

V
VivekPhadnis1-Visitor
1-Visitor
February 11, 2010
Thanks Iker,
Setting com.ptc.netmarkets.outputFilter to false did the trick.
Does anyone know about any side effects of setting this property to
false?

Regards
Vivek
avillanueva
avillanueva23-Emerald I
23-Emerald I
February 11, 2010
I guess when you have large text fields, users can enter characters that
might be valid for what they are writing but would be interpreted as
HTML code. So when the webpage renders those text blocks, it can get
all fouled up.


J
jessh12-Amethyst
12-Amethyst
February 11, 2010
More than that -- not escaping such text will allow users to enter XSS
(cross-site scripting) attacks.

If the user enters something like:

This is my innocent description. <script>doSomethingNasty()</script>

That's not an issue if outputFilter is set to true and the pages which
render this input render it exactly as shown.

Setting outputFilter to false will guarantee ensure that pages which use
this property to control how they output will show:

This is my innocent description.

but will silently invoke doSomethingNasty().

Generally speaking allowing users to enter arbitrary HTML tags (and then
rendering them without escaping) is not a good thing and should be
disallowed except in cases where a really strict white list of allowable
markup is used to veto anything that is not absolutely known to be innocent.

--
Jess Holle

A
AL_ANDERSON12-Amethyst
12-Amethyst
February 11, 2010
Have you tried this.

Through the site.xconf set the following entry in wt.properties. (Default
value was true)

com.ptc.netmarkets.outputFilter=false.

Al Anderson
Solar Turbines Incorporated.






"Lockwood,Mike,IRVINE,R&D" <mike.lockwood@alconlabs.com>
02/10/2010 09:48 AM
Please respond to
"Lockwood,Mike,IRVINE,R&D" <mike.lockwood@alconlabs.com>


To
"Phadnis, Vivek" <vivek.phadnis@stryker.com>,
"-" <->
cc

Subject
[solutions] - RE: Windchill 9.1 - Rendering readonly Workflow variables in
HTML format



Terms & ConditionsAccessibility statement