<%@ include file="/portal/include/include_java.jsp" %> <%@ page import="com.appiancorp.process.analytics2.util.ProcessAnalyticsUtil"%> <%@ page import="com.appiancorp.suiteapi.process.ProcessVariable"%> <%@ page import="com.appiancorp.asi.components.display.Token"%> <%@ page import="com.appiancorp.asi.components.display.TokenDisplay"%> <%@ page import="com.appiancorp.security.util.StringSecurityUtils"%>

- <%/* Preview Form " alt="Preview Form" /> */%>

()

<% Token typeNameToken = new Token(); typeNameToken.setName("type_name"); typeNameToken.setValue("type"); ProcessVariable tokenPv = (ProcessVariable)pageContext.getAttribute("pv"); String typeNameString = TokenDisplay.getTokenContents(request, response, tokenPv, new Token[] {typeNameToken}, null, false).toString(); pageContext.setAttribute("displayString",typeNameString ); %> <% Token t = new Token(); t.setValue("value"); ProcessVariable pv = (ProcessVariable) pageContext.getAttribute("pv"); String displayString = null; if (pv.getExpression() != null && pv.getExpression().length() > 0) { displayString = StringSecurityUtils.encodeHtml(pv.getExpression()); } else { // This already escapes the values displayString = ProcessAnalyticsUtil.processVarsToString(pv, t, pv.getType().intValue(), false, request, response).toString(); } pageContext.setAttribute("displayString", displayString); %>

<%-- Calling localeString directly opens us up to javascript injection attacks. Setting --%> <%-- localeStrings as variables will correctly escape html tags --%>

(from lane) (from lane)

<%-- Calling localeString directly opens us up to javascript injection attacks. Setting --%> <%-- localeStrings as variables will correctly escape html tags --%>



	<% Token typeNameToken = new Token(); typeNameToken.setName("type_name"); typeNameToken.setValue("type"); ProcessVariable tokenPv = (ProcessVariable)pageContext.getAttribute("pv"); String typeNameString = TokenDisplay.getTokenContents(request, response, tokenPv, new Token[] {typeNameToken}, null, false).toString(); pageContext.setAttribute("displayString",typeNameString ); %>		<% Token t = new Token(); t.setValue("value"); ProcessVariable pv = (ProcessVariable) pageContext.getAttribute("pv"); String displayString = null; if (pv.getExpression() != null && pv.getExpression().length() > 0) { displayString = StringSecurityUtils.encodeHtml(pv.getExpression()); } else { // This already escapes the values displayString = ProcessAnalyticsUtil.processVarsToString(pv, t, pv.getType().intValue(), false, request, response).toString(); } pageContext.setAttribute("displayString", displayString); %>