From 1d98ca14eb790153538cae5d61b6e872dc83c13a Mon Sep 17 00:00:00 2001
From: Andrew Nicols <andrew@nicols.co.uk>
Date: Thu, 2 Jan 2014 14:58:31 +0800
Subject: [PATCH] MDL-43538 Javascript: Deprecate callback argument to
 confirm_action

As a precursor to deprecating M.util.show_confirm, this deprecates the
callback argment to the confirm_action class.

This is not currently used anywhere in core, and it's use leads to use of
eval in Javascript.
---
 lib/javascript-static.js |  4 ++--
 lib/outputactions.php    | 12 +++++++++---
 lib/upgrade.txt          |  3 +++
 3 files changed, 14 insertions(+), 5 deletions(-)

diff --git a/lib/javascript-static.js b/lib/javascript-static.js
index 066b625ba62..03c7193c293 100644
--- a/lib/javascript-static.js
+++ b/lib/javascript-static.js
@@ -256,12 +256,12 @@ M.util.show_confirm_dialog = function(e, args) {
             simpledialog.hide();
 
             if (args.callback) {
-                // args comes from PHP, so callback will be a string, needs to be evaluated by JS
                 var callback = null;
                 if (Y.Lang.isFunction(args.callback)) {
                     callback = args.callback;
                 } else {
-                    callback = eval('('+args.callback+')');
+                    Y.log('Callbacks to show_confirm_dialog must now be functions. Please update your code to pass in a function instead.',
+                            'warn', 'M.util.show_confirm_dialog');
                 }
 
                 if (Y.Lang.isObject(args.scope)) {
diff --git a/lib/outputactions.php b/lib/outputactions.php
index 12c10c36797..38c6fdb5c50 100644
--- a/lib/outputactions.php
+++ b/lib/outputactions.php
@@ -93,13 +93,19 @@ class confirm_action extends component_action {
      *
      * @param string $message The message to display to the user when they are shown
      *    the confirm dialogue.
-     * @param string $callback The method to call when the user confirms the action.
+     * @param string $callback Deprecated since 2.7
      * @param string $continuelabel The string to use for he continue button
      * @param string $cancellabel The string to use for the cancel button
      */
     public function __construct($message, $callback = null, $continuelabel = null, $cancellabel = null) {
+        if ($callback !== null) {
+            debugging('The callback argument to new confirm_action() has been deprecated.' .
+                    ' If you need to use a callback, please write Javascript to use moodle-core-notification-confirmation ' .
+                    'and attach to the provided events.',
+                    DEBUG_DEVELOPER);
+        }
         parent::__construct('click', 'M.util.show_confirm_dialog', array(
-                'message' => $message, 'callback' => $callback,
+                'message' => $message,
                 'continuelabel' => $continuelabel, 'cancellabel' => $cancellabel));
     }
 }
@@ -197,4 +203,4 @@ class popup_action extends component_action {
 
         return $jsoptions;
     }
-}
\ No newline at end of file
+}
diff --git a/lib/upgrade.txt b/lib/upgrade.txt
index bd1a65200c6..8327584e160 100644
--- a/lib/upgrade.txt
+++ b/lib/upgrade.txt
@@ -26,6 +26,9 @@ YUI:
 JavaSript:
     * The findChildNodes global function has been deprecated. Y.all should
       be used instead.
+    * The callback argument to confirm_action and M.util.show_confirm_dialog has been deprecated. If you need to write a
+      confirmation which includes a callback, please use moodle-core-notification-confirmation and attach callbacks to the
+      events provided.
 
 === 2.6 ===