Using Global variables inside of Custom Metadata with Visualforce page Modal

Question

What are design options for the following requirements?

1. End user specifies the text of a Modal window to be something like: Hello [User Full Name], Because you chose [Case.FieldA] goto this <a href="hyperlink.html">hyperlink</a>.
2. A Visualforce page gets this text from either a Custom Metadata or email template or something declaratively accessible.
3. The Modal renders the text in pretty HTML.
4. The Modal will capture the onclick event of the hyperlink and create a custom object (CaseInfo__c) record with the HTML link, in the text, set in the CaseInfo__c.Link__c field. Would prefer to not use JS if possible.

My design (which I don't like):

• split the text message into the HTML portion and the dynamic portion (which contains the User Name and Case field info.)
• Create a Visualforce Form component which contains OutputPanels. The "Save" button in the first, initially visible OutputPanel, will rerender a second, initially hidden OutputPanel (Modal).

• Here's a portion of the code:

  <apex:outputPanel layout="block" styleClass="modalMessageText">
      Hello {!$User.FirstName},<p/>
      Because you chose, "{!Case.FieldA__c}",&nbsp;
    <apex:dynamicComponent componentValue="{!restOfMessage}"/>
  </apex:outputPanel>
  <apex:commandButton value="OK" title="Close the modal" action="{!closeModal}" rerender="modalWin"/>
  

The dynamicConmponent in the above page is supported by the associated page controller, which pulls the HTML portion of the message from the Custom Metadata record. This example has a simple link but the design should allow for a more complex (i.e. multiple links, multiple paragraphs, etc..) type of message. My current design doesn't address the forth bullet... besides being a hack.

Any helpful direction or insights would be most appreciated.

Answer 1

Without JS, if you want to capture the click and pass the parameter and take necessary actions in Controller then better to use apex:commandLink.

Use apex:param to pass the value of {!Case.FieldA__c} to Controller and assign that to caseFieldId through assignTo attribute.

Visualforce

<apex:outputPanel layout="block" styleClass="modalMessageText">
    Hello {!$User.FirstName},<p/>
    Because you chose, "{!Case.FieldA__c}" ,&nbsp; goto this 
        <apex:commandLink id="FieldA" value="{!yourLink}" id="theCommandLink" action="{!CreateCaseInfo}"> {!yourLink}
            <apex:param name="caseFieldId"
                value="{!Case.FieldA__c}"
                assignTo="{!caseFieldId}"/>
        </apex:commandLink>

  <apex:dynamicComponent componentValue="{!restOfMessage}"/>
</apex:outputPanel>
<apex:commandButton value="OK" title="Close the modal" action="{!closeModal}" rerender="modalWin"/>

Controller

public class MyController
{
    public String yourLink {get;set;}
    public String caseFieldId {get;set;}

    public void CreateCaseInfo()
    {
        //here you will have caseFieldId which is getting passed from CommandLink
        System.debug('caseFieldId: '+caseFieldId);
        //create Case Field Info record and take other actions.
    }

}

Answer 2

So, if you're an ISV, I can't tell you what the certification team would say about this (although they might be OK for the same reasons I am, as below; I just haven't specifically talked with them about this), but if you're an enterprise developer:

If you concatenate the static and dynamic parts in your Apex controller, you can use escape=false on your apex:outputText and the HTML bits will render as HTML.

Normally, this would be something to be really careful of--because if the dynamic part contained malicious Javascript, bad stuff could happen. But the fact that Admins are providing a gateway between the end user and the metadata means that as long as the admins check for that sort of thing before they enter it, I think the security risk here is pretty minimal.