UI Macros and JELLY the HTML and [code] tags in a field need to find a better output idea

[sla]

Recently I was trying to pull records from sys_journal_field table and display the content in a macro ui with a formatter.   I was able to grab the records I was interested in but when I attempted to publish the variable   journalString in the code my output contained HTML characters rather than interpreting them on the client side.   I know this is part of the Cross Side Scripting security and I realize it is a safety thing.   However if I was sure the content was ok how could I get it to display the output without it placing the [code]   tag in the output.   I tried striping the code tags out but it still showed the output with the <a> tags and <br> tags.   The other option I can do is remove all HTML tags but is there an easy way to get the value from the field with no HTML or sanitize it?   I read Eureka added this feature and I could turn it off for the entire system but I would rather not do it that way.   I figured there had to be a way to do it from Jelly.

       var journalString = "";
       var actObject = new GlideRecord('sys_journal_field');
       actObject.addQuery('element_id', ${ref_parent}.sys_id);     
       actObject.query();
       journalString = '';

       while( actObject.next() ) {

               journalString += actObject.sys_created_on + ' - ' +
                       actObject.sys_created_by + ' (' + actObject.element + ')<br/>' +
                       actObject.value + '<br/><br/>';

       }

Code sample was lifted from another forum example I saw and it works though I made minor changes to it.

The above is ran in a g2 evaluate and I included jelly true to get access to variable.   I would then place the $[journalString] outside of the g2 tag.   The following is the output I get now. I am also aware that the Activity Formatter deals with this but I need to do it in a UI Macro to display things a very specific way to my customer.   I am open to other ideas.jo]

2015-08-17 15:05:08 - zzzzzz (work_notes)<br></br>blah blah[code]<a href='change_task.do?sys_id=38f3913b0ffdc2003bb24f8ce1050ece&sysparm_stack=change_task_list.do?sysparm_query=active=true'>CTASK0023653</a>[/code] has been set to Closed Complete<br></br><br></br>2015-08-17 15:05:29 - zzzzzz (work_notes)<br></br>Development bla blah [code]<a href='change_task.do?sys_id=81f3913b0ffdc2003bb24f8ce1050ed1&sysparm_stack=change_task_list.do?sysparm_query=active=true'>CTASK0023658</a>[/code] has been set to Closed Incomplete<br></br>

[coryseering]

Hi Stephen,

If you are sure that the HTML is sanitary, you can use NOESC:

$[NOESC:journalString]

That tells Jelly not to do any escaping on the output. If there are invalid characters or tags in the journal field entry, it can break rendering of the page.

[sla]

I tried the $[NOESC:journalString] but nothing changed at all.   I wonder if that works in a UI Macro Formatter?

[sla]

<g2:evaluate var="jvar_ccejournalString" jelly="true">





       var journalString = "";

       var actObject = new GlideRecord('sys_journal_field');

       actObject.addQuery('element_id', ${ref_parent}.sys_id);



       actObject.query();

       journalString = '';



       while( actObject.next() ) {



               journalString += actObject.sys_created_on + ' - ' +

                       actObject.sys_created_by + ' (' + actObject.element + ')<br/>' +

                       actObject.value + '<br/><br/>';



       }





       journalString;





</g2:evaluate>

$[NOESC:journalString]

OUTPUT:

2015-08-17 15:05:08 - bbbbbb (work_notes)<br></br>Final Design [code]<a href='change_task.do?sys_id=38f3913b0ffdc2003bb24f8ce1050ece&sysparm_stack=change_task_list.do?sysparm_query=active=true'>CTASK0023653</a>[/code] has been set to wer dfsds<br></br><br></br>2015-08-17 15:05:29 - sdsd (work_notes)<br></br>df Complete [code]<a href='change_task.do?sys_id=81f3913b0ffdc2003bb24f8ce1050ed1&sysparm_stack=change_task_list.do?sysparm_query=active=true'>CTASK0023658</a>[/code] has been set to wer Incomplete<br></br><br></br>2015-08-18 17:33:32 - sdfsd (work_notes)<br></br>This is a test<br></br><br></br>2015-08-17 15:05:21 - sd (work_notes)<br></br>Critical Design Review [code]<a href='change_task.do?sys_id=fcf3913b0ffdc2003bb24f8ce1050ece&sysparm_stack=change_task_list.do?sysparm_query=active=true'>CTASK0023654</a>[/code] has been set to ffvdv Complete<br></br><br></br>2015-08-17 15:04:07 - sdf (work_notes)<br></br>System Readiness Review [code]<a href='change_task.do?sys_id=34f3913b0ffdc2003bb24f8ce1050ed0&sysparm_stack=change_task_list.do?sysparm_query=active=true'>CTASK0023656</a>[/code] has been set to dvdv wew<br></br><br></br>2015-08-17 15:04:53 - sdfsdf (work_notes)<br></br>wer wr Review [code]<a href='change_task.do?sys_id=70f3913b0ffdc2003bb24f8ce1050ece&sysparm_stack=change_task_list.do?sysparm_query=active=true'>CTASK0023652</a>[/code] has been set to df wer<br></br><br></br>2015-08-17 15:04:29 - fsdg (work_notes)<br></br>wer [code]<a href='change_task.do?sys_id=c9f3913b0ffdc2003bb24f8ce1050ed0&sysparm_stack=change_task_list.do?sysparm_query=active=true'>CTASK0023657</a>[/code] has been set to Closed Complete<br></br><br></br>2015-08-17 15:03:52 - fd (work_notes)<br></br>rw dg [code]<a href='change_task.do?sys_id=7cf3913b0ffdc2003bb24f8ce1050ecf&sysparm_stack=change_task_list.do?sysparm_query=active=true'>CTASK0023655</a>[/code] has been set to wrwreowrsed Complete<br></br><br></br>

[coryseering]

OK, let's back up for a second.

Why are you querying sys_journal_field rather than using the actual element on the current record, and getHTMLValue()?