Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Disabling Diazo creates invalid HTML (self-closing script tags) #159

Open
scy opened this issue May 8, 2019 · 1 comment

Comments

Projects
None yet
2 participants
@scy
Copy link

commented May 8, 2019

Not quite sure whether this is the right component, feel free to direct me to somewhere else.

In 5.2rc3, when I disable Diazo (to see the "vanilla" HTML), the <script> tags in the <head> are rendered as self-closing, i.e. <script src="…" /> instead of <script src="…"></script>. Since self-closing <script> tags are invalid, the browser ignores the closing / and thus starts interpreting everything following the first <script> tag as its contents. All of the <body> gets eaten by it and a white page is displayed.

To reproduce, use a buildout.cfg like this to install a simple Plone site:

[buildout]
extends =
    https://dist.plone.org/release/5.2rc3-pending/versions.cfg
parts =
    instance

[instance]
recipe = plone.recipe.zope2instance
user = admin:admin
http-address = 9080
eggs =
    Plone

Run bin/instance fg, then log in using admin:admin at localhost:9080. Create the default site. Then log out again, and make sure you're also logged out of HTTP Basic auth.

Now, you can either try accessing http://localhost:9080/Plone/?diazo.off=1 or, using the "hosts without theming" feature, open http://127.0.0.1:9080/Plone/. In both cases, you will end up with something like this:

screenshot of invalid HTML

Firefox 66, Chrome 74 and Edge 44 (I'm thorough…) all interpret the <script … /> tag as never being closed and don't display any content.

Funny enough, once you're logged in and the edit bar is displayed, you can access http://localhost:9080/Plone/?diazo.off=1 and it will output correct <script …></script> tags instead.

I've also tried using 5.2rc2 and 5.2rc1 (simply replace 5.2rc3-pending in the buildout.cfg with 5.2rc2 or 5.2rc and rebuild), both show the same result.

Edit: Forgot to mention, I'm running Python 3.7. My complete Version Overview:

  • Plone 5.2rc3 (5204)
  • CMF 2.4.0b8
  • Zope 4.0b10
  • Python 3.7.3rc1 (default, Mar 13 2019, 11:01:15) [GCC 8.3.0]
  • PIL 6.0.0 (Pillow)
  • WSGI: On
  • Server: waitress 1.2.1
@tmassman

This comment has been minimized.

Copy link
Member

commented May 15, 2019

Commit introduced this issue:
plone/Products.CMFPlone@181f52e

scy referenced this issue in plone/Products.CMFPlone May 15, 2019

Add async and defer attributes to bundles
Add ``load_async`` and ``load_defer`` attributes to resource registries bundle settings.
When set, ``<script>`` tags are rendered with ``async="async"`` resp. ``defer="defer"`` attributes.
In production mode, the setting from the ``plone`` resp. ``plone-logged-in`` bundles are used for the ``default`` resp. ``logged-in`` meta bundles (``merge_with`` setting).
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
You can’t perform that action at this time.