From Documentation

Jump to: navigation, search


Before enabling this feature upgrade to the latest available versions (older versions contain a critical security vulnerability).

The latest versions containing a fix are:


Dndsmalltalk-check-icon.png globally in zk.xml via <library-property>
Dndsmalltalk-cross-icon.png not as <custom-attribute>
Default: none
[Since 5.0.0]

It specifies a directory, where ZK will load the so-called Class-Web Resources (CWR), in addition to the class path. CWR includes JavaScript files, CSS files, and other resources that are specified in the form of ~./xxx.

By default, ZK only searches the class path for the required CWR. By specifying a directory here, ZK will search the directory first and then the class path. This implies that a developer can override the default behavior by providing a file with the same name.

Notice: never put security sensitive files in the directory specified here, since they can be accessed externally.

For example, assuming that we have a JavaScript package called foo.great and we want to put it to WEB-INF/cwr, we have to specify the following in WEB-INF/zk.xml:


You can place zk.wpd and the required JavaScript files under the WEB-INF/cwr/js/foo/great directory.

Overriding JAR's JavaScript Files

Though rarely needed, you could still override a JavaScript file of a JAR file with this option. One example is that you don't have to re-package zul.jar when replacing zul/inp/Textbox.js that is part of zul.jar.

Rather, you could specify this library property as described above, and place the modified version of Textbox.js under the /WEB-INF/cwr/js/zul/inp directory. Then, ZK will load /WEB-INF/cwr/js/zul/inp/Textbox.js you placed rather than the default one in zul.jar.

Notice that if debug-js is turned on, ZK will actually look for Textbox.src.js rather than Textbox.js in the above example. Thus, it is suggested to put both Textbox.src.js and Textbox.js the /WEB-INF/cwr/js/zul/inp directories. In addition, Textbox.src.js is suggested to be the readable one (for debugging purpose), while Textbox.js is the compressed one (for production purpose).

Copyright © Potix Corporation. This article is licensed under GNU Free Documentation License.

You got stuck here?
Let us know how we can improve this page
For specific questions please use the forum