Error with shiny example about dt

[yihui]

Thanks for the feedback. You need the development version of shiny:

devtools::install_github('rstudio/shiny')

[pssguy]

Thanks
Is there something different I need to do with renderDataTable now?
in the development version
a shinyApp that works under the CRAN version 0.10.2.2 breaks, producing
cells showing the html text (<table cellpadding='4' etc.) rather than rendering it as below?

Whatcha Gonna Do About It
First Entered: 1965-09-11
Highest Position: 14
Weeks in Top 40: 10

"

[yihui]

Could you provide a minimal reproducible example?

[pssguy]

    ---
    title: "Untitled"
   author: "pssguy"
    date: "Monday, December 22, 2014"
    output: html_document
    runtime: shiny
    ---



    ```{r, echo=FALSE, message=FALSE}


    df <- data.frame(summary=c("<table cellpadding='4' style='line-height:1'><tr>\n                                 <th>Whatcha Gonna Do About It</th></tr>\n                        \n                      <tr align='left'>\n                          <td>First Entered: 1965-09-11</td></tr>\n  <tr align='left'><td>Highest Position: 14</td></tr>\n  <tr align='left'><td>Weeks in Top 40: 10</td></tr>\n                      \n                      \n                      </table>"), video=c("<iframe src='https://www.youtube.com/embed/mYvi-l2SRnA?wmode=opaque&amp;feature=oembed' frameborder='0' allowfullscreen=''></iframe>"))

     renderDataTable({df})
    ```

[pssguy]

BTW how do I avoid an R Markdown example rendering? Hope you can follow that there is a data.frame
with 1 row of 2 variables which is then just rendered

Confirmed that this code opens fine with CRAN shiny but not after

library(devtools)
install_github('rStudio/shiny')

[yihui]

@pssguy You need to indent the example by 4 spaces: https://github.com/yihui/knitr/blob/master/CONTRIBUTING.md

The Github version of shiny added an escape argument to renderDataTable(): https://github.com/rstudio/shiny/blob/master/NEWS You need to set it to FALSE. But note I have not added it to the DT package yet, which I should have done.

[pssguy]

@yihui
a)Thanks - corrected above

b)Guess I should have read the notes. My bad. What are the security implications?

[yihui]

@pssguy In general, you should not allow unescaped HTML content in your app, otherwise you might be subject to XSS attacks: http://en.wikipedia.org/wiki/Cross-site_scripting I guess I'd better not discuss it in detail in the public. In your case, the input is a fixed data frame, and it is probably safe.

[pssguy]

Thanks for link. Hopefully, this will be OK as is. Is there an alternative approach you know of if I want to embed a youtube video?

[yihui]

I do not see why embedding a Youtube video needs DataTables. Why not just something like

tags$iframe(src='https://www.youtube.com/embed/mYvi-l2SRnA?wmode=opaque&feature=oembed')

in ui.R? If you just need the table layout, you can use column() in fluidRow() (http://shiny.rstudio.com/articles/layout-guide.html), or write a plain table

tags$table(...)

instead of a DataTable.