3

Background

We have a custom application which we need to support in multiple languages. Visualforce is our main UI framework.

For internationalization we will use Custom Labels. One of the possible formats we would like to use is as follows:

"Admin sent file1.pdf to the following recipients:"

Note that Admin and file1.pdf should be bold.

I tried creating a custom label with value:

enter image description here

And the result is kind of "expected":

enter image description here

Question

Is it possible, if at all, to use Custom Labels and format part of its text in bold?

Improve this question

2 Answers 2

Reset to default
3

If you're displaying it in Visualforce maybe try something like:

<apex:outputText value="{!label}" escape="false"/>

An alternative would be to create multiple labels for the different parts of the string and then manually bold them yourself.

For instance you'd have labels for the following text:

  • sent
  • to the following recipients:

Then output the text in chucnks:

<apex:outputText value="{!userName}" style="font-weight:bold;"/>
<apex:outputText value="{!label1}"><apex:outputtext value="{!fileName}" style="font-weight:bold;"/>
<apex:outputText value="{!label2}"/>

My concern here would be translation as it would be seen as two seperate... sentences? which could create issues in grammar.

Improve this answer
7
  • 4
    @Eduard But, a word of caution, make sure you escape any user input values to avoid script injection attacks.
    – sfdcfox
    Aug 30, 2018 at 15:34
  • @sfdcfox, thanks for your comment. I was also thinking that escape="false" might not be a really good option, but is there an alternative? Also could you please provide an example in which script injection attack would be possible in my case. I am honestly struggling with figuring this out.
    – Eduard
    Aug 30, 2018 at 15:42
  • 1
    It would depend on where you're getting the username and the file name. If you fill them yourself in the code it's probably fine but if you're getting them from the end user you could run into an issue (based on the little information your post offers I don't think it'd be a big concern). I think it would also depend on the audience. If it's internal users its probably a much smaller concern than if you were exposing the page via a community.
    – gNerb
    Aug 30, 2018 at 15:44
  • Updated to provide an alternative, although, I'm not sure if it's any better.
    – gNerb
    Aug 30, 2018 at 15:49
  • Thanks @gNerb. In my case the input for apex:outputText's value parameter will be the custom label, for example <apex:outputText value="{! $Label.Paragraph_Text }" escape="false">. I don't think someone inside the org would change a custom label with a malicious intent making script injection possible.
    – Eduard
    Aug 30, 2018 at 16:10
0

To add to @gNerb's answer, the JSINHTMLENCODE Visualforce expression function can be used to prevent potential script injections.

Instead of writing this:

<apex:outputText value="{! $Label.PARAGRAPH_SENT_TO_RECIPIENTS }" escape="false">
    <apex:param value="{! document.SubmitterName }"/>
    <apex:param value="{! document.Name }"/>
</apex:outputText>

which results in:

enter image description here

We can write this:

<apex:outputText value="{! $Label.PARAGRAPH_SENT_TO_RECIPIENTS }" escape="false">
    <apex:param value="{! JSINHTMLENCODE(document.SubmitterName) }"/>
    <apex:param value="{! JSINHTMLENCODE(document.Name) }"/>
</apex:outputText>

and have malicious injections knocked out:

enter image description here

Improve this answer

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .