search

daattali / timevis

📅 Create interactive timeline visualizations in R
http://daattali.com/shiny/timevis-demo/
Other
650 stars 157 forks source link

Handlebars Template stripped out of classes #147

Closed SirPhoros closed 7 months ago

SirPhoros commented 7 months ago

I am trying to use a custom handlebars template, but when it renders the timeline, the elements within the template are completely stripped out of their classes.

I have seen this behaviour before #846 (https://github.com/visjs/vis-timeline/issues/846), but it seemed to have been fixed in https://github.com/visjs/vis-timeline/pull/1010 However, it looks like the problem has returned?

Any clue on how to work around it?

daattali commented 7 months ago

Thanks for the report. It looks like your issue is with the xss protection that was added (it caused a lot of people issues). The fix you refer to is a way to disable the xss protection, but it's still enabled by default, and must be explicitly disabled.

However, the way it was implemented, the xss protection can only be disabled at initialization, and it cannot be disabled afterwards (see this comment). This is a problem because in {timevis} every timeline is initialized as empty initially, and then all the options get added to it afterwards. So disabling xss protection doesn't work.

I need to find a way to allow the widget to set a parameter on itself initially, which currently isn't supported. I've filed an issue with {htmlwidgets} to get help for this. https://github.com/ramnathv/htmlwidgets/issues/482

SirPhoros commented 7 months ago

Sweet!

Yeah, I realised I tried to change the xss protection once I created the timeline, and I didn't realise that I couldn't change it once it's created. It makes sense as it prevents further security issues.

Thank you so much!

daattali commented 7 months ago

If the issue in {htmlwidgets} gets resolved, I might be able to get this to work. I'll update you if that happens.