Culprit: WrappedCredentialsStore/dialog.jelly#L48-L50

The onclick events are "inline", meaning that the JavaScript is executed directly from the HTML.

Due to the yui-button transformation, I am not sure if the current code is compliant or not.

Reproduction steps:

• Clone https://github.com/jenkinsci/credentials-plugin
• Change current directory into the repository just cloned, execute mvn hpi:run
• Preparation steps
  • Click on "New Item"
  • Put a name, select "Freestyle project", save
  • Check "This project is parameterized"
  • Click on "Add Parameter"
  • Click on "Credentials Parameter"
  • Save the job
• Usage
  • Click on "Build with Parameters"
  • Click on "+ Add" then "Jenkins"
  • It opens the dialog (which renders the dialog.jelly)
  • Fill the form
  • The click on "Add" or "Cancel" will trigger the onclick scripts

Proposal

• Transform the onclick approach into a call from an external JavaScript file that is adding the listening, from the script and not inlined.
• Perhaps, to reduce the potential impacts on other features, adding a new JavaScript file specific to that dialog could be interesting.

Testing notes

• Ensure to reproduce the feature before any change
• Ensure that you reproduce the feature after you have made the change
• Ensure that when you are triggering the dialog multiple times in the same page, there is only one call each time. Depending on the approach chosen, the event listener could be added 1 time, then 2 times, etc, duplicating the effects.