Input on ajax callbacks not working

[MJS@mjs.us]

I just implemented a new callback and all worked as designed on my dev machine.  I'm passing one parameter, in this case '06:00'.  Below is the callback output, looks normal:





After I moved this app to my server the callback seemed to stop working and this is the output:

• The 1st entry looks ok but returns a 302, not 200.
  
• Following 6 entries immediately come from the app and the parameters are munged starting with the ':' also returning a 302. 
  

Thinking it's a parsing issue I base64 encoded the parameter (then decode it to use it).





Now everything works.  Don't know if this is related to the other callback issues but maybe it's a clue.

[Alexandre Machado]

How's exactly your JavaScript call?

[MJS@mjs.us]

Problem code without Base64 encoding the parameter '05:30'
 
 
 Added to the form via ExtraHeader:  

Code:

<script language="javascript" type="text/javascript">function EditSchedule(d) { ajaxCall("EditSchedule","&1="+d, true); }</script>

 
 
 What is rendered in the browser: 

Code:

<button class="btn btn-outline-info" onClick="EditSchedule('05:30');">*</button>

 
 
 onClick then spawns six subsequent ajax calls returning 302 (as in the screen captures).

[Alexandre Machado]

Are you calling itself recursively?

EditSchedule() calls ajaxCall which calls EditSchedule which calls ajaxCall which calls EditSchedule....?

[MJS@mjs.us]

No, it's just a simple one click one call (otherwise it shouldn't have worked on my dev machine).   Turns out it only happens in SSL mode and the ajax processing doesn't like the ':' character.  Attached is a sample project demonstrating the issue.  

http.sys mode
IW 15.1.7
C++ Builder 10.3.2

[Alexandre Machado]

I'll test it but ajaxCall() doesn't escape the input when it sends a GET request. It is up to the developer to encode it properly.

You might ask "why does it work when I type 06:20 in an input?".

Because in this case, a POST request is generated and the browser does most of the work.

I believe it will work if you use encodeURIComponent() on your parameters. It should be like:

Code:

<script language="javascript" type="text/javascript">function EditSchedule(d) { ajaxCall("EditSchedule","&1="+encodeURIComponent(d), true); }</script>

IntraWeb will decode them properly on the other side

[MJS@mjs.us]

>>I believe it will work if you use encodeURIComponent() on your parameters...

Yes, it works as the Base64 encoding (but without the need to decode).

Here's what's happening with SSL on the IW side with a single ':' as an ajax callback parameter:  The ':' is removed then the parameter string is inserted back into the parameter string recursively until it breaks a 4K limit.  In my case the ajax call repeated 6 times from a single click until the 4k limit is reached.  Probably would keep repeating otherwise.  Attached is the IW output from a test and you can absolutely see what's happening.  

[Alexandre Machado]

Yes, I'll have a look at your demo

[Alexandre Machado]

I tested your application and seems that this problem only occurs in C++ Builder. The exact same code when ported to a Delphi project doesn't behave the same (it works as expected).
We had some weird bugs in the past which were happening in C++ Builder and not in Delphi due to C++Builder compiler bugs... not sure yet. I'm still investigating the issue.

[MJS@mjs.us]

Interesting... makes me want to learn Delphi.