Editable in-place property of anthor page

Help / Discuss
1

Hi,

I tried to make a field (property) from an object available on another page and editable in-place.
That seems not possible but here are my attempts.

When I click on the edit button, the content is empty.

{{velocity}}
{{html wiki="true" clean="false"}}
## Load the JavaScript code required to make the object properties editable in-place.
#set ($discard = $xwiki.jsfx.use('uicomponents/edit/editableProperty.js', {
  'forceSkinAction': true,
  'language': $xcontext.locale
}))
#set($subdoc = $xwiki.getDocument('Test.another document'))
#set ($editing = $xcontext.action == 'edit')
#set ($xobject = $subdoc.getObject('Test.TestClass'))
#set ($xclass = $xobject.xWikiClass)
#set ($discard = $subdoc.use($xobject))
[[${subdoc.title}>>$subdoc]]
<div class="xform">
  <dl>
    #set($property=$xclass.get('my_field'))
    <dt #if (!$editing && $hasEdit)
        class="editableProperty"
        #set ($xobjectPropertyReference = $xobject.getProperty($property.name).reference)
        data-property="$escapetool.xml($services.model.serialize($xobjectPropertyReference))"
        data-property-type="object"#end>
      ## This must match the id generated by the $doc.display() method below.
      #set ($propertyId = "${xclass.name}_${xobject.number}_$property.name")
      <label#if ($editing) for="$escapetool.xml($propertyId)"#end>
        $escapetool.xml($property.translatedPrettyName)
      </label>
      ## Support for specifying a translation key as hint in the property definition.
      <span class="xHint">$!escapetool.xml($services.localization.render($property.hint))</span>
    </dt>
    <dd>$subdoc.display($property.name)</dd>
  </dl>
</div>
{{/html}}
{{/velocity}}

Did I forget something?

2

Looking at the JavaScript code, this is not possible with the default in-place editor, it always reads/edits properties of objects of the current document (i.e., the main document that is displayed) so regardless of the HTML code you produce, this won’t work. You would need to develop your own JavaScript code for the editing or submit a pull request with an improved version of the in-place editor such that it can be included in XWiki itself.

Just as a small feedback, you need to escape ${subdoc.title} and $subdoc for XWiki syntax and also HTML as you’re inside an HTML macro in the above code, or arbitrary HTML and wiki code can be inserted through them, leading to both XSS (through HTML) and server side code execution vulnerabilities, server side code/script execution will be with the rights of the author of the document (through XWiki syntax) which can include programming rights. $escapetool.xml() should be good for this use in the HTML macro, for plain XWiki syntax there is $services.rendering.escape($variable, 'xwiki/2.1').

3

Thank you for the answer and your help.