From 62b2d31f9902ad17884dda4219e55c743ecf9ddd Mon Sep 17 00:00:00 2001
From: Oliver Hader <oliver@typo3.org>
Date: Sat, 18 Apr 2020 13:56:46 +0200
Subject: [PATCH] [TASK] Remove superfluous onclick events in FormEngine

Superfluous inline events have been removed or replaced
with native HTML functionality (location.href -> anchor).

Resolves: #91110
Releases: master
Change-Id: I594fe2df3c71234de096e437b5662867469ffbb7
Reviewed-on: https://review.typo3.org/c/Packages/TYPO3.CMS/+/64229
Reviewed-by: Oliver Klee <typo3-coding@oliverklee.de>
Reviewed-by: Jonas Eberle <flightvision@googlemail.com>
Reviewed-by: Alexander Schnitzler <git@alexanderschnitzler.de>
Reviewed-by: Oliver Bartsch <bo@cedev.de>
Reviewed-by: Oliver Hader <oliver.hader@typo3.org>
Tested-by: TYPO3com <noreply@typo3.com>
Tested-by: Jonas Eberle <flightvision@googlemail.com>
Tested-by: Alexander Schnitzler <git@alexanderschnitzler.de>
Tested-by: Oliver Bartsch <bo@cedev.de>
Tested-by: Oliver Hader <oliver.hader@typo3.org>
---
 .../Controller/EditDocumentController.php     | 23 ++++++-------------
 .../Form/Container/InlineControlContainer.php |  3 +--
 2 files changed, 8 insertions(+), 18 deletions(-)

diff --git a/typo3/sysext/backend/Classes/Controller/EditDocumentController.php b/typo3/sysext/backend/Classes/Controller/EditDocumentController.php
index b72eaf22b466..82a35487f759 100644
--- a/typo3/sysext/backend/Classes/Controller/EditDocumentController.php
+++ b/typo3/sysext/backend/Classes/Controller/EditDocumentController.php
@@ -1730,26 +1730,17 @@ class EditDocumentController
             && !empty($this->firstEl['table'])
             && $this->getTsConfigOption($this->firstEl['table'], 'showHistory')
         ) {
-            $historyButtonOnClick = 'window.location.href=' .
-                GeneralUtility::quoteJSvalue(
-                    (string)$this->uriBuilder->buildUriFromRoute(
-                        'record_history',
-                        [
-                            'element' => $this->firstEl['table'] . ':' . $this->firstEl['uid'],
-                            'returnUrl' => $this->R_URI,
-                        ]
-                    )
-                ) . '; return false;';
-
+            $historyUrl = (string)$this->uriBuilder->buildUriFromRoute('record_history', [
+                'element' => $this->firstEl['table'] . ':' . $this->firstEl['uid'],
+                'returnUrl' => $this->R_URI,
+            ]);
             $historyButton = $buttonBar->makeLinkButton()
-                ->setHref('#')
+                ->setHref($historyUrl)
+                ->setTitle('Open history of this record')
                 ->setIcon($this->moduleTemplate->getIconFactory()->getIcon(
                     'actions-document-history-open',
                     Icon::SIZE_SMALL
-                ))
-                ->setOnClick($historyButtonOnClick)
-                ->setTitle('Open history of this record')
-                ;
+                ));
 
             $buttonBar->addButton($historyButton, $position, $group);
         }
diff --git a/typo3/sysext/backend/Classes/Form/Container/InlineControlContainer.php b/typo3/sysext/backend/Classes/Form/Container/InlineControlContainer.php
index 06123aa3790e..99a449ce64df 100644
--- a/typo3/sysext/backend/Classes/Form/Container/InlineControlContainer.php
+++ b/typo3/sysext/backend/Classes/Form/Container/InlineControlContainer.php
@@ -598,7 +598,6 @@ class InlineControlContainer extends AbstractContainer
      */
     protected function renderPossibleRecordsSelectorTypeSelect(array $config, array $uniqueIds)
     {
-        $onChange = '';
         $possibleRecords = $config['selectorOrUniquePossibleRecords'];
         $nameObject = $this->inlineStackProcessor->getCurrentStructureDomObjectIdPrefix($this->data['inlineFirstPid']);
         // Create option tags:
@@ -628,7 +627,7 @@ class InlineControlContainer extends AbstractContainer
             }
             $item .= '
             <span class="input-group-btn">
-                <a href="#" class="btn btn-default" onclick="' . htmlspecialchars($onChange) . '" title="' . $createNewRelationText . '">
+                <a href="#" class="btn btn-default" title="' . $createNewRelationText . '">
                     ' . $this->iconFactory->getIcon('actions-add', Icon::SIZE_SMALL)->render() . $createNewRelationText . '
                 </a>
             </span>';
-- 
GitLab