Upgrading from DWR version 1.x to DWR version 2.0
There are a number of changes that you must make to upgrade from version 1.x:
- dwr.util defaults to mode that is safer from XSS attacks - it assumes that all text is free of HTML, and escapes any HTML characters. You can alter the default mode to allowing HTML with the following statement as part of the page setup:
dwr.util.setEscapeHtml(false);
A better solution is to escape only the cases that you know to validly include HTML. For example:
dwr.util.setValue('id', 'Some HTML' , { escapeHtml:false });
- Error handling has been improved by the addition of an exception handler. Most of the changes fix bugs and make the action in edge cases more logical, but error handling code should be reviewed.
- The callback-as-first-parameter system has been deprecated since version 0.9 in favor of the callback-as-last-parameter system. In version 2.0 we removed support for the first-parameter option because it caused some hard to detect bugs with null parameters. From version 2.0 the callback must be the last parameter, and can not be the first parameter.
There are a number of changes that are optional in that DWR will function just fine without these changes, however you are strongly recommended to check through this list. These changes may become mandatory in a future release:
- The DWR package has changed from uk.ltd.getahead to org.directwebremoting. There are deprecated stubs in place for backwards compatibility, however more future proof code will use the new package names. The change that will affect most people is the altered servlet name. The preferred name is now:
org.directwebremoting.servlet.DwrServlet
- The Javascript code has been altered to occupy a smaller part of the global namespace. DWRUtil is now deprecated and replaced with dwr.util and DWREngine is deprecated in favor of dwr.engine.