Package overit.geocall.ux.config

Class PropertiesUI

java.lang.Object
overit.geocall.ux.config.PropertiesUI
public class PropertiesUI extends Object
class containing the configurations related to the user interface

  • Field Summary

    Fields
    Modifier and Type
    Field
    Description
    static final overit.geocall.config.Property<Boolean>
    CONTEXT_MENU
    enables the standard web page context menu.
    static final overit.geocall.config.Property<List<String>>
    DEFAULT_SEEK
    define the default configuration for the form's fields seek
    static final overit.geocall.config.Property<String>
    DOC_TYPE
    define the html page document type tag
    static final overit.geocall.config.Property<Boolean>
    ENABLE_COLUMN_CONTROL_DD
    enable TableView columns reordering through columns' header drag and drop
    static final overit.geocall.config.Property<String>
    GATEWAY_TIMEOUT_HANDLER
    defines the mode with which manage the 504 Gateway timeout HTTP code raised by WAF, after 60 seconds of elaboration.
    static final overit.geocall.config.Property<Boolean>
    HIDE_AREA_TITLE
    Defines if the area title on the application pages must be hidden or not.
    static final overit.geocall.config.Property<Boolean>
    INFO_COMMENT
    defines the possibility to allow generating a comment in the HTML page reporting the information on the current node
    static final overit.geocall.config.Property<String>
    LOGIN_PAGE
    defines the path of the html file of the customized login window.
    static final overit.geocall.config.Property<String>
    LOGIN_PAGE_BACKGROUND
    defines the login page's background image.
    Possible values are: standard (default one) wfm plant
    static final overit.geocall.config.Property<String>
    LOGIN_PAGE_FAVICON
    defines the src path of the favicon image to set into the login page browser's tab.
    static final overit.geocall.config.Property<String>
    LOGIN_PAGE_LOGO
    defines the src path of the logo image to set into the login page.
    static final overit.geocall.config.Property<String>
    LOGIN_PAGE_MOBILE
    defines the path of the html file of the customized login window for mobile devices.
    static final overit.geocall.config.Property<String>
    LOGIN_PAGE_MOBILE_BACKGROUND
    defines the mobile login page's background image.
    Possible values are: standard (default one) wfm plant
    static final overit.geocall.config.Property<String>
    LOGIN_PAGE_MOBILE_FAVICON
    defines the src path of the favicon image to set into the mobile login page browser's tab.
    static final overit.geocall.config.Property<String>
    LOGIN_PAGE_MOBILE_LOGO
    defines the src path of the logo image to set into the mobile login page.
    static final overit.geocall.config.Property<String>
    LOGIN_PAGE_MOBILE_TITLE
    defines the page's title to set into the mobile login page browser's tab.
    static final overit.geocall.config.Property<String>
    LOGIN_PAGE_TITLE
    defines the page's title to set into the login page browser's tab.
    static final overit.geocall.config.Property<String>
    LOGOUT_RESOURCE
    defines the name of the web page (or servlet) the user is redirected to when logging out
    static final overit.geocall.config.Property<String>
    MENU
    the name of the xml file containing the menu entries The file is solved through the factory and must be placed in the root of the application layer.
    static final overit.geocall.config.Property<String>
    MENU_WA
    the name of the xml file containing the web application menu entries The file is solved through the factory and must be placed in the root of the application layer.
    static final overit.geocall.config.Property<String>
    PERSISTENCE
    defines the type of session persistence (inner at the moment)
    static final overit.geocall.config.Property<String>
    PROCESSOR
    defines the event processor for the current UI.
    static final overit.geocall.config.Property<Boolean>
    SAFE_CSP
    Controls the activation of the SafeInlineEngine JavaScript module that provides a secure alternative to inline event handlers and style attributes.
    When set to true, the system will: Replace traditional inline event handlers (like onclick="..."
    static final overit.geocall.config.Property<Boolean>
    SAFE_EVAL
    Controls the activation of the SafeInlineEngine JavaScript module that provides a secure alternative to Window.eval() function call.
    When set to true, the system will: Replace traditional window.eval() function calls with a custom and safe management of the function This approach allows the application to function properly while maintaining compatibility with strict Content Security Policy (CSP) settings that forbid the use of 'unsafe-eval' directive, significantly enhancing security against Cross-Site Scripting (XSS) attacks.
    When enabled, the script-src 'unsafe-eval' CSP directives can be removed from the CSP policy.
    static final overit.geocall.config.Property<Boolean>
    SAFE_INLINE_EVENT_HANDLERS
    Controls the activation of the SafeInlineEngine JavaScript module that provides a secure alternative to inline event handlers and style attributes.
    When set to true, the system will: Replace traditional inline event handlers (like onclick="..."
    static final overit.geocall.config.Property<Boolean>
    SAFE_INLINE_SCRIPT
    Defines if it's active or not, the injection of the nonce into the script-src CSP directive to allow the execution of the inline script tags.
    static final overit.geocall.config.Property<Boolean>
    SAFE_INLINE_STYLE
    Defines if it's active or not, the injection of the nonce into the style-src CSP directive to allow the execution of the inline style tags.
    static final overit.geocall.config.Property<Integer>
    SEARCH_THRESHOLD
    define the threshold beyond which the InputLookup components allow to search among the options defined, using an input filter field.
    static final overit.geocall.config.Property<String>
    SERIALIZATION
    defines the user session serialization type, it can be k,kd,s,sd (s for standard, k for kryo, d for deflated)
    static final overit.geocall.config.Property<Boolean>
    SERIALIZATION_TEST
    enables continuous serialization testing
    static final overit.geocall.config.Property<Boolean>
    SHOW_ID
    displays the component-id beside each ux component

  • Method Summary

    Modifier and Type
    Method
    Description
    static String
    cspAddition(Company company)
    defines additional Content Security Policy (CSP) directives that will be combined with the default ones.
    CSP enables control over the resources the browser is allowed to load for a given page.
    static String
    cspDefault(Company company)
    defines CSP (Content Security Policy) directives that will replace the default ones.
    CSP enables control over the resources the browser is allowed to load for a given page.
    static String
    fieldCleaner(String fieldName)
    defines the cleaner that must be used for a specific input field (sanitizing fields against xss attacks).
    static String
    fieldDisplayUnit(String fieldName)
     
    static String
    fieldLetterCase(String fieldName)
    defines whether the value entered the field must be turned into uppercase or lowercase letters
    static String
    fieldUnit(String fieldName)
     

    Methods inherited from class java.lang.Object

    clone, equals, finalize, getClass, hashCode, notify, notifyAll, toString, wait, wait, wait

  • Field Details

    • CONTEXT_MENU

      public static final overit.geocall.config.Property<Boolean> CONTEXT_MENU
      enables the standard web page context menu.

    • SHOW_ID

      public static final overit.geocall.config.Property<Boolean> SHOW_ID
      displays the component-id beside each ux component

    • INFO_COMMENT

      public static final overit.geocall.config.Property<Boolean> INFO_COMMENT
      defines the possibility to allow generating a comment in the HTML page reporting the information on the current node

    • PROCESSOR

      public static final overit.geocall.config.Property<String> PROCESSOR
      defines the event processor for the current UI.

    • SERIALIZATION

      public static final overit.geocall.config.Property<String> SERIALIZATION
      defines the user session serialization type, it can be k,kd,s,sd (s for standard, k for kryo, d for deflated)

    • SERIALIZATION_TEST

      public static final overit.geocall.config.Property<Boolean> SERIALIZATION_TEST
      enables continuous serialization testing

    • PERSISTENCE

      public static final overit.geocall.config.Property<String> PERSISTENCE
      defines the type of session persistence (inner at the moment)

    • DOC_TYPE

      public static final overit.geocall.config.Property<String> DOC_TYPE
      define the html page document type tag

    • LOGIN_PAGE

      public static final overit.geocall.config.Property<String> LOGIN_PAGE
      defines the path of the html file of the customized login window.

    • LOGIN_PAGE_TITLE

      public static final overit.geocall.config.Property<String> LOGIN_PAGE_TITLE
      defines the page's title to set into the login page browser's tab.

    • LOGIN_PAGE_FAVICON

      public static final overit.geocall.config.Property<String> LOGIN_PAGE_FAVICON
      defines the src path of the favicon image to set into the login page browser's tab.

    • LOGIN_PAGE_BACKGROUND

      public static final overit.geocall.config.Property<String> LOGIN_PAGE_BACKGROUND
      defines the login page's background image.
      Possible values are:
      • standard (default one)
      • wfm
      • plant

    • LOGIN_PAGE_MOBILE

      public static final overit.geocall.config.Property<String> LOGIN_PAGE_MOBILE
      defines the path of the html file of the customized login window for mobile devices.

    • LOGIN_PAGE_MOBILE_TITLE

      public static final overit.geocall.config.Property<String> LOGIN_PAGE_MOBILE_TITLE
      defines the page's title to set into the mobile login page browser's tab.

    • LOGIN_PAGE_MOBILE_FAVICON

      public static final overit.geocall.config.Property<String> LOGIN_PAGE_MOBILE_FAVICON
      defines the src path of the favicon image to set into the mobile login page browser's tab.

    • LOGIN_PAGE_MOBILE_BACKGROUND

      public static final overit.geocall.config.Property<String> LOGIN_PAGE_MOBILE_BACKGROUND
      defines the mobile login page's background image.
      Possible values are:
      • standard (default one)
      • wfm
      • plant

    • LOGOUT_RESOURCE

      public static final overit.geocall.config.Property<String> LOGOUT_RESOURCE
      defines the name of the web page (or servlet) the user is redirected to when logging out

    • ENABLE_COLUMN_CONTROL_DD

      public static final overit.geocall.config.Property<Boolean> ENABLE_COLUMN_CONTROL_DD
      enable TableView columns reordering through columns' header drag and drop

    • DEFAULT_SEEK

      public static final overit.geocall.config.Property<List<String>> DEFAULT_SEEK
      define the default configuration for the form's fields seek

    • SEARCH_THRESHOLD

      public static final overit.geocall.config.Property<Integer> SEARCH_THRESHOLD
      define the threshold beyond which the InputLookup components allow to search among the options defined, using an input filter field.

    • GATEWAY_TIMEOUT_HANDLER

      public static final overit.geocall.config.Property<String> GATEWAY_TIMEOUT_HANDLER
      defines the mode with which manage the 504 Gateway timeout HTTP code raised by WAF, after 60 seconds of elaboration.

    • HIDE_AREA_TITLE

      public static final overit.geocall.config.Property<Boolean> HIDE_AREA_TITLE
      Defines if the area title on the application pages must be hidden or not.

    • SAFE_CSP

      public static final overit.geocall.config.Property<Boolean> SAFE_CSP
      Controls the activation of the SafeInlineEngine JavaScript module that provides a secure alternative to inline event handlers and style attributes.
      When set to true, the system will:
      1. Replace traditional inline event handlers (like onclick="...") with data attributes (data-event-click="...")
      2. Replace inline style attributes (style="...") with data attributes (data-style="...")
      3. Add special CSS classes (activableScripting and activableStyling) to elements
      4. Use JavaScript to apply these handlers and styles at runtime
      5. Use JavaScript to safe evaluate js code instead using the window.eval() function
      6. Add a nonce to the script-src CSP directive to allow the execution of the inline script and style tags
      This approach allows the application to function properly while maintaining compatibility with strict Content Security Policy (CSP) settings that forbid the use of 'unsafe-inline' directive, significantly enhancing security against Cross-Site Scripting (XSS) attacks.
      When enabled, the script-src 'unsafe-inline' 'unsafe-eval' and style-src 'unsafe-inline' CSP directives can be removed from the CSP policy.

      Default: false (traditional inline handlers are used)

    • SAFE_INLINE_SCRIPT

      public static final overit.geocall.config.Property<Boolean> SAFE_INLINE_SCRIPT
      Defines if it's active or not, the injection of the nonce into the script-src CSP directive to allow the execution of the inline script tags.

    • SAFE_INLINE_STYLE

      public static final overit.geocall.config.Property<Boolean> SAFE_INLINE_STYLE
      Defines if it's active or not, the injection of the nonce into the style-src CSP directive to allow the execution of the inline style tags.

    • SAFE_INLINE_EVENT_HANDLERS

      public static final overit.geocall.config.Property<Boolean> SAFE_INLINE_EVENT_HANDLERS
      Controls the activation of the SafeInlineEngine JavaScript module that provides a secure alternative to inline event handlers and style attributes.
      When set to true, the system will:
      1. Replace traditional inline event handlers (like onclick="...") with data attributes (data-event-click="...")
      2. Replace inline style attributes (style="...") with data attributes (data-style="...")
      3. Add special CSS classes (activableScripting and activableStyling) to elements
      4. Use JavaScript to apply these handlers and styles at runtime
      This approach allows the application to function properly while maintaining compatibility with strict Content Security Policy (CSP) settings that forbid the use of 'unsafe-inline' directive, significantly enhancing security against Cross-Site Scripting (XSS) attacks.
      When enabled, the script-src 'unsafe-inline' and style-src 'unsafe-inline' CSP directives can be removed from the CSP policy.

      Default: false (traditional inline handlers are used)

    • SAFE_EVAL

      public static final overit.geocall.config.Property<Boolean> SAFE_EVAL
      Controls the activation of the SafeInlineEngine JavaScript module that provides a secure alternative to Window.eval() function call.
      When set to true, the system will: Replace traditional window.eval() function calls with a custom and safe management of the function This approach allows the application to function properly while maintaining compatibility with strict Content Security Policy (CSP) settings that forbid the use of 'unsafe-eval' directive, significantly enhancing security against Cross-Site Scripting (XSS) attacks.
      When enabled, the script-src 'unsafe-eval' CSP directives can be removed from the CSP policy.

      Default: false (traditional eval call is used)

  • Method Details

    • cspDefault

      public static String cspDefault(Company company)
      defines CSP (Content Security Policy) directives that will replace the default ones.
      CSP enables control over the resources the browser is allowed to load for a given page. This property can be used to specify new directives or modify existing ones, thus providing fine-grained control over security policies.

      This property allows configuring only a subset of CSP directives, which will then replace the following default directives: 

           default-src 'self';
     img-src * data:;
     font-src * data:;
     script-src 'self' 'unsafe-inline' 'unsafe-eval';
     style-src 'self' 'unsafe-inline';
     connect-src 'self';

    • cspAddition

      public static String cspAddition(Company company)
      defines additional Content Security Policy (CSP) directives that will be combined with the default ones.
      CSP enables control over the resources the browser is allowed to load for a given page. This property can be used to specify new directives or modify existing ones, thus providing fine-grained control over security policies.

      This property allows configuring additional CSP directives that will be added to the default directives configured.

    • fieldLetterCase

      public static String fieldLetterCase(String fieldName)
      defines whether the value entered the field must be turned into uppercase or lowercase letters
      Parameters:
      fieldName - The field whose LetterCase we want to know.
      Returns:
      • u for upper case
      • l for lower case

    • fieldCleaner

      public static String fieldCleaner(String fieldName)
      defines the cleaner that must be used for a specific input field (sanitizing fields against xss attacks).
      Parameters:
      fieldName - The field whose cleaner we want to know.
      Returns:
      The name of the cleaner to use for the passed field
      • none: No preventive measures are taken therefore the field allows entering any type of text, formatting, active and/or malicious html code, script, etc.
      • rtf: The content of the field will be sanitized by deleting the entire html code, though RTF text is left, thus requiring minimum formatting. This type of cleaner relies on all the policies defined by OWASP policies.
      • html: The content of the field will be sanitized, leaving the html code and deleting the active or possibly malicious html code. This type of cleaner relies on all the policies defined by OWASP policies, too.
      • text: The content of the field will be sanitized by deleting all formatting and codes and will then be handled as mere plain text. This is the strongest preventive measure and it relies on a technique known as character escaping (which will soon replace certain special characters that may be interpreted differently).

    • fieldUnit

      public static String fieldUnit(String fieldName)

    • fieldDisplayUnit

      public static String fieldDisplayUnit(String fieldName)