mirrors/bootstrap
2
0
Fork 0
mirror of https://github.com/tenrok/bootstrap.git synced 2026-05-15 11:59:39 +03:00
Code Activity

add html option back to tooltip and popover to explicitly prevent XSS #3421

Browse Source
This commit is contained in:
Jacob Thornton
2012-06-02 17:55:10 -07:00
parent fc96bc8bba
commit f836473129
8 changed files with 37 additions and 37 deletions
Download Patch File Download Diff File Expand all files Collapse all files
docs/assets/js/bootstrap-popover.js
Vendored
+2 -2
View File
@@ -43,8 +43,8 @@
, title = this.getTitle()
, content = this.getContent()
$tip.find('.popover-title')[this.isHTML(title) ? 'html' : 'text'](title)
$tip.find('.popover-content > *')[this.isHTML(content) ? 'html' : 'text'](content)
$tip.find('.popover-title')[this.options.html ? 'html' : 'text'](title)
$tip.find('.popover-content > *')[this.options.html ? 'html' : 'text'](content)
$tip.removeClass('fade top bottom left right in')
}
docs/assets/js/bootstrap-tooltip.js
Vendored
+2 -10
View File
@@ -148,20 +148,11 @@
}
}
, isHTML: function(text) {
// html string detection logic adapted from jQuery
return typeof text != 'string'
|| ( text.charAt(0) === "<"
&& text.charAt( text.length - 1 ) === ">"
&& text.length >= 3
) || /^(?:[^<]*<[\w\W]+>[^>]*$)/.exec(text)
}
, setContent: function () {
var $tip = this.tip()
, title = this.getTitle()
$tip.find('.tooltip-inner')[this.isHTML(title) ? 'html' : 'text'](title)
$tip.find('.tooltip-inner')[this.options.html ? 'html' : 'text'](title)
$tip.removeClass('fade in top bottom left right')
}
@@ -270,6 +261,7 @@
, trigger: 'hover'
, title: ''
, delay: 0
, html: true
}
}(window.jQuery);
docs/assets/js/bootstrap.js
Vendored
+4 -12
View File
@@ -1092,20 +1092,11 @@
}
}
, isHTML: function(text) {
// html string detection logic adapted from jQuery
return typeof text != 'string'
|| ( text.charAt(0) === "<"
&& text.charAt( text.length - 1 ) === ">"
&& text.length >= 3
) || /^(?:[^<]*<[\w\W]+>[^>]*$)/.exec(text)
}
, setContent: function () {
var $tip = this.tip()
, title = this.getTitle()
$tip.find('.tooltip-inner')[this.isHTML(title) ? 'html' : 'text'](title)
$tip.find('.tooltip-inner')[this.options.html ? 'html' : 'text'](title)
$tip.removeClass('fade in top bottom left right')
}
@@ -1214,6 +1205,7 @@
, trigger: 'hover'
, title: ''
, delay: 0
, html: true
}
}(window.jQuery);
@@ -1262,8 +1254,8 @@
, title = this.getTitle()
, content = this.getContent()
$tip.find('.popover-title')[this.isHTML(title) ? 'html' : 'text'](title)
$tip.find('.popover-content > *')[this.isHTML(content) ? 'html' : 'text'](content)
$tip.find('.popover-title')[this.options.html ? 'html' : 'text'](title)
$tip.find('.popover-content > *')[this.options.html ? 'html' : 'text'](content)
$tip.removeClass('fade top bottom left right in')
}
docs/assets/js/bootstrap.min.js
Vendored
+1 -1
View File
File diff suppressed because one or more lines are too long
docs/javascript.html
+12
View File
@@ -771,6 +771,12 @@ $('a[data-toggle="tab"]').on('shown', function (e) {
<td>true</td>
<td>apply a css fade transition to the tooltip</td>
</tr>
<tr>
<td>html</td>
<td>boolean</td>
<td>true</td>
<td>Insert html into the tooltip. If false, jquery's <code>text</code> method will be used to insert content into the dom. Use text if you're worried about XSS attacks.</td>
</tr>
<tr>
<td>placement</td>
<td>string|function</td>
@@ -874,6 +880,12 @@ $('a[data-toggle="tab"]').on('shown', function (e) {
<td>true</td>
<td>apply a css fade transition to the tooltip</td>
</tr>
<tr>
<td>html</td>
<td>boolean</td>
<td>true</td>
<td>Insert html into the tooltip. If false, jquery's <code>text</code> method will be used to insert content into the dom. Use text if you're worried about XSS attacks.</td>
</tr>
<tr>
<td>placement</td>
<td>string|function</td>
docs/templates/pages/javascript.mustache
Vendored
+12
View File
@@ -693,6 +693,12 @@ $('a[data-toggle="tab"]').on('shown', function (e) {
<td>true</td>
<td>{{_i}}apply a css fade transition to the tooltip{{/i}}</td>
</tr>
<tr>
<td>{{_i}}html{{/i}}</td>
<td>{{_i}}boolean{{/i}}</td>
<td>true</td>
<td>{{_i}}Insert html into the tooltip. If false, jquery's <code>text</code> method will be used to insert content into the dom. Use text if you're worried about XSS attacks.{{/i}}</td>
</tr>
<tr>
<td>{{_i}}placement{{/i}}</td>
<td>{{_i}}string|function{{/i}}</td>
@@ -796,6 +802,12 @@ $('a[data-toggle="tab"]').on('shown', function (e) {
<td>true</td>
<td>{{_i}}apply a css fade transition to the tooltip{{/i}}</td>
</tr>
<tr>
<td>{{_i}}html{{/i}}</td>
<td>{{_i}}boolean{{/i}}</td>
<td>true</td>
<td>{{_i}}Insert html into the popover. If false, jquery's <code>text</code> method will be used to insert content into the dom. Use text if you're worried about XSS attacks.{{/i}}</td>
</tr>
<tr>
<td>{{_i}}placement{{/i}}</td>
<td>{{_i}}string|function{{/i}}</td>
js/bootstrap-popover.js
Vendored
+2 -2
View File
@@ -43,8 +43,8 @@
, title = this.getTitle()
, content = this.getContent()
$tip.find('.popover-title')[this.isHTML(title) ? 'html' : 'text'](title)
$tip.find('.popover-content > *')[this.isHTML(content) ? 'html' : 'text'](content)
$tip.find('.popover-title')[this.options.html ? 'html' : 'text'](title)
$tip.find('.popover-content > *')[this.options.html ? 'html' : 'text'](content)
$tip.removeClass('fade top bottom left right in')
}
js/bootstrap-tooltip.js
Vendored
+2 -10
View File
@@ -148,20 +148,11 @@
}
}
, isHTML: function(text) {
// html string detection logic adapted from jQuery
return typeof text != 'string'
|| ( text.charAt(0) === "<"
&& text.charAt( text.length - 1 ) === ">"
&& text.length >= 3
) || /^(?:[^<]*<[\w\W]+>[^>]*$)/.exec(text)
}
, setContent: function () {
var $tip = this.tip()
, title = this.getTitle()
$tip.find('.tooltip-inner')[this.isHTML(title) ? 'html' : 'text'](title)
$tip.find('.tooltip-inner')[this.options.html ? 'html' : 'text'](title)
$tip.removeClass('fade in top bottom left right')
}
@@ -270,6 +261,7 @@
, trigger: 'hover'
, title: ''
, delay: 0
, html: true
}
}(window.jQuery);