dojox.grid.DataGrid ignores escapeHTMLInData in 1.3.2

[Thomas Gelf]

Section "Options" on ​http://docs.dojocampus.org/dojox/grid explains that there would be "escapeHTMLInData" new in 1.3.2 - however there is no such option to be found in source code.

dojox.grid.DataGrid? now escapes HTML per default - protecting users from beginner errors, but breaking compatibility with existing code. While I'm not against doing so (is it always good to protect coders from themselves - even if such changes are not really welcome between minor releases) at least the (documented) escapeHTMLInData switch should be available.

Line 6845 in dojox/grid/DataGrid.js.uncompressed.js does this escape-alike-job as follows:

d = (d && d.replace) ? d.replace(/</g, '&lt;') : d;

While I'm not sure if this suffices to protect against all kinds of attacks it is pretty obvious that it has been forgotten to implement escapeHTMLInData.

Best regards, Thomas Gelf

NB: Bug is for 1.3.2 - as there is no such option available yet, I've chosen 1.3.1.

[Thomas Gelf]

See also Ticket #9308 (I didn't test 1.3.1)

[Adam Peller]

dup of #9533?

[Thomas Gelf]

dup of #9533 => yep :-)

[dante]

see #9533 then :)

[Thomas Gelf]

Added above details to #9533...