third_party
/
gitea
1
0
Fork 0
Code Issues Pull Requests Packages Projects Releases Wiki Activity

Revert "Prevent possible XSS when using jQuery (#18289)" (#18293)

Browse Source 
This reverts commit 661d3d28e9.
tokarchuk/v1.17
wxiaoguang 3 years ago committed by GitHub
parent 72b3681648
commit 4d0a72a271
No known key found for this signature in database
GPG Key ID: 4AEE18F83AFDEB23
10 changed files with 34 additions and 39 deletions
Show all changes Ignore whitespace when comparing lines Ignore changes in amount of whitespace Ignore changes in whitespace at EOL
Show Stats Download Patch File Download Diff File
  1. 5
      docs/content/doc/developers/guidelines-frontend.md
  2. 2
      web_src/js/components/RepoBranchTagDropdown.js
  3. 14
      web_src/js/features/common-global.js
  4. 2
      web_src/js/features/comp/LabelEdit.js
  5. 2
      web_src/js/features/repo-branch.js
  6. 6
      web_src/js/features/repo-common.js
  7. 2
      web_src/js/features/repo-diff.js
  8. 4
      web_src/js/features/repo-issue.js
  9. 30
      web_src/js/features/repo-legacy.js
  10. 6
      web_src/js/features/repo-settings.js

5
docs/content/doc/developers/guidelines-frontend.md
Unescape View File

@ -127,8 +127,3 @@ We forbid `dataset` usage, its camel-casing behaviour makes it hard to grep for
### Vue2/Vue3 and JSX
Gitea is using Vue2 now, we plan to upgrade to Vue3. We decided not to introduce JSX to keep the HTML and the JavaScript code separated.
### jQuery's `$(...)`
jQuery's `$` function has a broad functionality depending on the input. Well, this can be seen as nice, it's also a fallpit for possible XSS attacks when the input is user-controlled.
The usage of the function can be correct in certain situations, but it is discourage and recommended to use a more specific function of jQuery(e.g. `$.find`, `$.parseHTML`).

2
web_src/js/components/RepoBranchTagDropdown.js
Unescape View File

@ -2,7 +2,7 @@ import Vue from 'vue';
import {vueDelimiters} from './VueComponentLoader.js';
export function initRepoBranchTagDropdown(selector) {
$.find(selector).each(function () {
$(selector).each(function () {
const $dropdown = $(this);
const $data = $dropdown.find('.data');
const data = {

14
web_src/js/features/common-global.js
Unescape View File

@ -124,7 +124,7 @@ export function initGlobalCommon() {
$('.tabable.menu .item').tab();
$('.toggle.button').on('click', function () {
$.find($(this).data('target')).slideToggle(100);
$($(this).data('target')).slideToggle(100);
});
// make table <tr> and <td> elements clickable like a link
@ -202,7 +202,7 @@ export function initGlobalLinkActions() {
closable: false,
onApprove() {
if ($this.data('type') === 'form') {
$.find($this.data('form')).trigger('submit');
$($this.data('form')).trigger('submit');
return;
}
@ -240,7 +240,7 @@ export function initGlobalLinkActions() {
closable: false,
onApprove() {
if ($this.data('type') === 'form') {
$.find($this.data('form')).trigger('submit');
$($this.data('form')).trigger('submit');
return;
}
@ -293,7 +293,7 @@ export function initGlobalLinkActions() {
export function initGlobalButtons() {
$('.show-panel.button').on('click', function () {
$.find($(this).data('panel')).show();
$($(this).data('panel')).show();
});
$('.hide-panel.button').on('click', function (event) {
@ -301,7 +301,7 @@ export function initGlobalButtons() {
event.preventDefault();
let sel = $(this).attr('data-panel');
if (sel) {
$.find(sel).hide();
$(sel).hide();
return;
}
sel = $(this).attr('data-panel-closest');
@ -314,8 +314,8 @@ export function initGlobalButtons() {
});
$('.show-modal.button').on('click', function () {
$.find($(this).data('modal')).modal('show');
const colorPickers = $.find($(this).data('modal')).find('.color-picker');
$($(this).data('modal')).modal('show');
const colorPickers = $($(this).data('modal')).find('.color-picker');
if (colorPickers.length > 0) {
initCompColorPicker();
}

2
web_src/js/features/comp/LabelEdit.js
Unescape View File

@ -1,7 +1,7 @@
import {initCompColorPicker} from './ColorPicker.js';
export function initCompLabelEdit(selector) {
if (!$.find(selector).length) return;
if (!$(selector).length) return;
// Create label
const $newLabelPanel = $('.new-label.segment');
$('.new-label.button').on('click', () => {

2
web_src/js/features/repo-branch.js
Unescape View File

@ -2,6 +2,6 @@ export function initRepoBranchButton() {
$('.show-create-branch-modal.button').on('click', function () {
$('#create-branch-form')[0].action = $('#create-branch-form').data('base-action') + $(this).data('branch-from-urlcomponent');
$('#modal-create-branch-from-span').text($(this).data('branch-from'));
$.find($(this).data('modal')).modal('show');
$($(this).data('modal')).modal('show');
});
}

6
web_src/js/features/repo-common.js
Unescape View File

@ -65,18 +65,18 @@ export function initRepoClone() {
}
export function initRepoCommonBranchOrTagDropdown(selector) {
$.find(selector).each(function () {
$(selector).each(function () {
const $dropdown = $(this);
$dropdown.find('.reference.column').on('click', function () {
$dropdown.find('.scrolling.reference-list-menu').hide();
$.find($(this).data('target')).show();
$($(this).data('target')).show();
return false;
});
});
}
export function initRepoCommonFilterSearchDropdown(selector) {
const $dropdown = $.find(selector);
const $dropdown = $(selector);
$dropdown.dropdown({
fullTextSearch: true,
selectOnKeydown: false,

2
web_src/js/features/repo-diff.js
Unescape View File

@ -15,7 +15,7 @@ export function initRepoDiffFileViewToggle() {
$this.parent().children().removeClass('active');
$this.addClass('active');
const $target = $.find($this.data('toggle-selector'));
const $target = $($this.data('toggle-selector'));
$target.parent().children().addClass('hide');
$target.removeClass('hide');
});

4
web_src/js/features/repo-issue.js
Unescape View File

@ -28,7 +28,7 @@ export function initRepoIssueTimeTracking() {
});
$(document).on('click', 'button.issue-delete-time', function () {
const sel = `.issue-delete-time-modal[data-id="${$(this).data('id')}"]`;
$.find(sel).modal({
$(sel).modal({
duration: 200,
onApprove() {
$(`${sel} form`).trigger('submit');
@ -535,7 +535,7 @@ export function initRepoIssueReferenceIssue() {
const content = $(`#comment-${$this.data('target')}`).text();
const poster = $this.data('poster-username');
const reference = $this.data('reference');
const $modal = $.find($this.data('modal'));
const $modal = $($this.data('modal'));
$modal.find('textarea[name="content"]').val(`${content}\n\n_Originally posted by @${poster} in ${reference}_`);
$modal.modal('show');

30
web_src/js/features/repo-legacy.js
Unescape View File

@ -42,7 +42,7 @@ export function initRepoCommentForm() {
$branchMenu.find('.item:not(.no-select)').click(function () {
const selectedValue = $(this).data('id');
const editMode = $('#editing_mode').val();
$.find($(this).data('id-selector')).val(selectedValue);
$($(this).data('id-selector')).val(selectedValue);
if ($isNewIssue) {
$selectBranch.find('.ui .branch-name').text($(this).data('name'));
return;
@ -58,7 +58,7 @@ export function initRepoCommentForm() {
$selectBranch.find('.reference.column').on('click', function () {
$selectBranch.find('.scrolling.reference-list-menu').css('display', 'none');
$selectBranch.find('.reference .text').removeClass('black');
$.find($(this).data('target')).css('display', 'block');
$($(this).data('target')).css('display', 'block');
$(this).find('.text').addClass('black');
return false;
});
@ -145,9 +145,9 @@ export function initRepoCommentForm() {
$(this).parent().find('.item').each(function () {
if ($(this).hasClass('checked')) {
listIds.push($(this).data('id'));
$.find($(this).data('id-selector')).removeClass('hide');
$($(this).data('id-selector')).removeClass('hide');
} else {
$.find($(this).data('id-selector')).addClass('hide');
$($(this).data('id-selector')).addClass('hide');
}
});
if (listIds.length === 0) {
@ -155,7 +155,7 @@ export function initRepoCommentForm() {
} else {
$noSelect.addClass('hide');
}
$.find($(this).parent().data('id')).val(listIds.join(','));
$($(this).parent().data('id')).val(listIds.join(','));
return false;
});
$listMenu.find('.no-select.item').on('click', function (e) {
@ -182,7 +182,7 @@ export function initRepoCommentForm() {
$(this).addClass('hide');
});
$noSelect.removeClass('hide');
$.find($(this).parent().data('id')).val('');
$($(this).parent().data('id')).val('');
});
}
@ -247,7 +247,7 @@ export function initRepoCommentForm() {
$list.find('.selected').html('');
$list.find('.no-select').removeClass('hide');
$.find(input_id).val('');
$(input_id).val('');
});
}
@ -450,20 +450,20 @@ export function initRepository() {
// Enable or select internal/external wiki system and issue tracker.
$('.enable-system').on('change', function () {
if (this.checked) {
$.find($(this).data('target')).removeClass('disabled');
if (!$(this).data('context')) $.find($(this).data('context')).addClass('disabled');
$($(this).data('target')).removeClass('disabled');
if (!$(this).data('context')) $($(this).data('context')).addClass('disabled');
} else {
$.find($(this).data('target')).addClass('disabled');
if (!$(this).data('context')) $.find($(this).data('context')).removeClass('disabled');
$($(this).data('target')).addClass('disabled');
if (!$(this).data('context')) $($(this).data('context')).removeClass('disabled');
}
});
$('.enable-system-radio').on('change', function () {
if (this.value === 'false') {
$.find($(this).data('target')).addClass('disabled');
if (typeof $(this).data('context') !== 'undefined') $.find($(this).data('context')).removeClass('disabled');
$($(this).data('target')).addClass('disabled');
if (typeof $(this).data('context') !== 'undefined') $($(this).data('context')).removeClass('disabled');
} else if (this.value === 'true') {
$.find($(this).data('target')).removeClass('disabled');
if (typeof $(this).data('context') !== 'undefined') $.find($(this).data('context')).addClass('disabled');
$($(this).data('target')).removeClass('disabled');
if (typeof $(this).data('context') !== 'undefined') $($(this).data('context')).addClass('disabled');
}
});
}

6
web_src/js/features/repo-settings.js
Unescape View File

@ -52,14 +52,14 @@ export function initRepoSettingBranches() {
initRepoCommonFilterSearchDropdown('.protected-branches .dropdown');
$('.enable-protection, .enable-whitelist, .enable-statuscheck').on('change', function () {
if (this.checked) {
$.find($(this).data('target')).removeClass('disabled');
$($(this).data('target')).removeClass('disabled');
} else {
$.find($(this).data('target')).addClass('disabled');
$($(this).data('target')).addClass('disabled');
}
});
$('.disable-whitelist').on('change', function () {
if (this.checked) {
$.find($(this).data('target')).addClass('disabled');
$($(this).data('target')).addClass('disabled');
}
});
}

Write Preview
Loading…
Cancel
Save