activeadmin 3.2.1 → 3.2.2

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: ff095f14bad831f14bf12c3da9123bae3311d3c94815a73ef3b8ab67d1ca985a
-  data.tar.gz: 1adb7fa85d65339b74b8a0c1ef45c6ba9be9031a743e144d0edf452064e31083
+  metadata.gz: a0548655f225688960699146ba45dcacd0b22375225cd51a835e0226a9347c0a
+  data.tar.gz: accc8e86bd98b8c7d2f1dca258f528e6a36941e3c7cc8633605cfbb05fd652d6
 SHA512:
-  metadata.gz: 54c3193a35539aeb1c6e094cdd7e03b335168116db76a8ab07eb5991de70cba0931d400840815014ee96bad801723fa628962924d3314e3aa855adebaa3d256d
-  data.tar.gz: 2f51a5be0b992925a0b8a77f62e68812ae19ea3d5666f2df514bbbf4b9a6ccb1c09639853878a8e02e4b9b59077f18ad3041642b6abc5ad8e39f0eec359d0db3
+  metadata.gz: 9fdd7e6072424d783695be0cf5887800d894bd83a18511177d06bd16604b99b04ae491bcd281efb4acffd425b95fc747e2ede748574c07adc507a18380096184
+  data.tar.gz: 3756bf37298eab6a6227e56a76cf4ebfa4563f718a9f8c67feeb34446c56e1b2bce8243cbf5f267801e3aa42ff12f56acf01e37bef409a80a1f6180072c2aa38

data/CHANGELOG.md

@@ -2,6 +2,17 @@
 
 ## Unreleased
 
+## 3.2.2 [☰](https://github.com/activeadmin/activeadmin/compare/v3.2.1..v3.2.2)
+
+### Security Fixes
+
+* Backport Fix potential XSS issue when rendering form legends [#8349] by
+  [@deivid-rodriguez]
+
+### Enhancements
+
+* Update vendored jQuery UI to 1.13.3 [#8329] by [@tagliala]
+
 ## 3.2.1 [☰](https://github.com/activeadmin/activeadmin/compare/v3.2.0..v3.2.1)
 
 ### Enhancements
@@ -907,6 +918,8 @@ Please check [0-6-stable] for previous changes.
 [#8167]: https://github.com/activeadmin/activeadmin/pull/8167
 [#8310]: https://github.com/activeadmin/activeadmin/pull/8310
 [#8311]: https://github.com/activeadmin/activeadmin/pull/8311
+[#8329]: https://github.com/activeadmin/activeadmin/pull/8329
+[#8349]: https://github.com/activeadmin/activeadmin/pull/8349
 
 [@1000ship]: https://github.com/1000ship
 [@5t111111]: https://github.com/5t111111

data/lib/active_admin/version.rb

@@ -1,4 +1,4 @@
 # frozen_string_literal: true
 module ActiveAdmin
-  VERSION = "3.2.1"
+  VERSION = "3.2.2"
 end

data/lib/active_admin/views/components/active_admin_form.rb

@@ -127,7 +127,7 @@ module ActiveAdmin
         html_options[:class] ||= "inputs"
         legend = args.shift if args.first.is_a?(::String)
         legend = html_options.delete(:name) if html_options.key?(:name)
-        legend_tag = legend ? "<legend><span>#{legend}</span></legend>" : ""
+        legend_tag = legend ? "<legend><span>#{ERB::Util.html_escape(legend)}</span></legend>" : ""
         fieldset_attrs = html_options.map { |k, v| %Q{#{k}="#{v}"} }.join(" ")
         @opening_tag = "<fieldset #{fieldset_attrs}>#{legend_tag}<ol>"
         @closing_tag = "</ol></fieldset>"

data/vendor/assets/javascripts/jquery-ui/data.js

@@ -1,20 +1,22 @@
 //= require jquery-ui/version
 
 /*!
- * jQuery UI :data 1.12.1
- * http://jqueryui.com
+ * jQuery UI :data 1.13.3
+ * https://jqueryui.com
  *
- * Copyright jQuery Foundation and other contributors
+ * Copyright OpenJS Foundation and other contributors
  * Released under the MIT license.
- * http://jquery.org/license
+ * https://jquery.org/license
  */
 
 //>>label: :data Selector
 //>>group: Core
 //>>description: Selects elements which have data stored under the specified key.
-//>>docs: http://api.jqueryui.com/data-selector/
+//>>docs: https://api.jqueryui.com/data-selector/
 
 ( function( factory ) {
+	"use strict";
+
 	if ( typeof define === "function" && define.amd ) {
 
 		// AMD. Register as an anonymous module.
@@ -24,8 +26,10 @@
 		// Browser globals
 		factory( jQuery );
 	}
-} ( function( $ ) {
-return $.extend( $.expr[ ":" ], {
+} )( function( $ ) {
+"use strict";
+
+return $.extend( $.expr.pseudos, {
 	data: $.expr.createPseudo ?
 		$.expr.createPseudo( function( dataName ) {
 			return function( elem ) {
@@ -38,4 +42,4 @@ return $.extend( $.expr[ ":" ], {
 			return !!$.data( elem, match[ 3 ] );
 		}
 } );
-} ) );
+} );

data/vendor/assets/javascripts/jquery-ui/disable-selection.js

@@ -1,21 +1,23 @@
 //= require jquery-ui/version
 
 /*!
- * jQuery UI Disable Selection 1.12.1
- * http://jqueryui.com
+ * jQuery UI Disable Selection 1.13.3
+ * https://jqueryui.com
  *
- * Copyright jQuery Foundation and other contributors
+ * Copyright OpenJS Foundation and other contributors
  * Released under the MIT license.
- * http://jquery.org/license
+ * https://jquery.org/license
  */
 
 //>>label: disableSelection
 //>>group: Core
 //>>description: Disable selection of text content within the set of matched elements.
-//>>docs: http://api.jqueryui.com/disableSelection/
+//>>docs: https://api.jqueryui.com/disableSelection/
 
 // This file is deprecated
 ( function( factory ) {
+	"use strict";
+
 	if ( typeof define === "function" && define.amd ) {
 
 		// AMD. Register as an anonymous module.
@@ -25,7 +27,8 @@
 		// Browser globals
 		factory( jQuery );
 	}
-} ( function( $ ) {
+} )( function( $ ) {
+"use strict";
 
 return $.fn.extend( {
 	disableSelection: ( function() {
@@ -45,4 +48,4 @@ return $.fn.extend( {
 	}
 } );
 
-} ) );
+} );

data/vendor/assets/javascripts/jquery-ui/focusable.js

@@ -1,20 +1,22 @@
 //= require jquery-ui/version
 
 /*!
- * jQuery UI Focusable 1.12.1
- * http://jqueryui.com
+ * jQuery UI Focusable 1.13.3
+ * https://jqueryui.com
  *
- * Copyright jQuery Foundation and other contributors
+ * Copyright OpenJS Foundation and other contributors
  * Released under the MIT license.
- * http://jquery.org/license
+ * https://jquery.org/license
  */
 
 //>>label: :focusable Selector
 //>>group: Core
 //>>description: Selects elements which can be focused.
-//>>docs: http://api.jqueryui.com/focusable-selector/
+//>>docs: https://api.jqueryui.com/focusable-selector/
 
 ( function( factory ) {
+	"use strict";
+
 	if ( typeof define === "function" && define.amd ) {
 
 		// AMD. Register as an anonymous module.
@@ -24,7 +26,8 @@
 		// Browser globals
 		factory( jQuery );
 	}
-} ( function( $ ) {
+} )( function( $ ) {
+"use strict";
 
 // Selectors
 $.ui.focusable = function( element, hasTabindex ) {
@@ -72,10 +75,10 @@ function visible( element ) {
 		element = element.parent();
 		visibility = element.css( "visibility" );
 	}
-	return visibility !== "hidden";
+	return visibility === "visible";
 }
 
-$.extend( $.expr[ ":" ], {
+$.extend( $.expr.pseudos, {
 	focusable: function( element ) {
 		return $.ui.focusable( element, $.attr( element, "tabindex" ) != null );
 	}
@@ -83,4 +86,4 @@ $.extend( $.expr[ ":" ], {
 
 return $.ui.focusable;
 
-} ) );
+} );

data/vendor/assets/javascripts/jquery-ui/form-reset-mixin.js

@@ -2,79 +2,82 @@
 //= require jquery-ui/version
 
 /*!
- * jQuery UI Form Reset Mixin 1.12.1
- * http://jqueryui.com
+ * jQuery UI Form Reset Mixin 1.13.3
+ * https://jqueryui.com
  *
- * Copyright jQuery Foundation and other contributors
+ * Copyright OpenJS Foundation and other contributors
  * Released under the MIT license.
- * http://jquery.org/license
+ * https://jquery.org/license
  */
 
 //>>label: Form Reset Mixin
 //>>group: Core
 //>>description: Refresh input widgets when their form is reset
-//>>docs: http://api.jqueryui.com/form-reset-mixin/
+//>>docs: https://api.jqueryui.com/form-reset-mixin/
 
 ( function( factory ) {
-  if ( typeof define === "function" && define.amd ) {
+	"use strict";
 
-    // AMD. Register as an anonymous module.
-    define( [
-      "jquery",
-      "./form",
-      "./version"
-    ], factory );
-  } else {
+	if ( typeof define === "function" && define.amd ) {
 
-    // Browser globals
-    factory( jQuery );
-  }
-}( function( $ ) {
+		// AMD. Register as an anonymous module.
+		define( [
+			"jquery",
+			"./form",
+			"./version"
+		], factory );
+	} else {
 
-  return $.ui.formResetMixin = {
-    _formResetHandler: function() {
-      var form = $( this );
+		// Browser globals
+		factory( jQuery );
+	}
+} )( function( $ ) {
+"use strict";
 
-      // Wait for the form reset to actually happen before refreshing
-      setTimeout( function() {
-        var instances = form.data( "ui-form-reset-instances" );
-        $.each( instances, function() {
-          this.refresh();
-        } );
-      } );
-    },
+return $.ui.formResetMixin = {
+	_formResetHandler: function() {
+		var form = $( this );
 
-    _bindFormResetHandler: function() {
-      this.form = this.element.form();
-      if ( !this.form.length ) {
-        return;
-      }
+		// Wait for the form reset to actually happen before refreshing
+		setTimeout( function() {
+			var instances = form.data( "ui-form-reset-instances" );
+			$.each( instances, function() {
+				this.refresh();
+			} );
+		} );
+	},
 
-      var instances = this.form.data( "ui-form-reset-instances" ) || [];
-      if ( !instances.length ) {
+	_bindFormResetHandler: function() {
+		this.form = this.element._form();
+		if ( !this.form.length ) {
+			return;
+		}
 
-        // We don't use _on() here because we use a single event handler per form
-        this.form.on( "reset.ui-form-reset", this._formResetHandler );
-      }
-      instances.push( this );
-      this.form.data( "ui-form-reset-instances", instances );
-    },
+		var instances = this.form.data( "ui-form-reset-instances" ) || [];
+		if ( !instances.length ) {
 
-    _unbindFormResetHandler: function() {
-      if ( !this.form.length ) {
-        return;
-      }
+			// We don't use _on() here because we use a single event handler per form
+			this.form.on( "reset.ui-form-reset", this._formResetHandler );
+		}
+		instances.push( this );
+		this.form.data( "ui-form-reset-instances", instances );
+	},
 
-      var instances = this.form.data( "ui-form-reset-instances" );
-      instances.splice( $.inArray( this, instances ), 1 );
-      if ( instances.length ) {
-        this.form.data( "ui-form-reset-instances", instances );
-      } else {
-        this.form
-            .removeData( "ui-form-reset-instances" )
-            .off( "reset.ui-form-reset" );
-      }
-    }
-  };
+	_unbindFormResetHandler: function() {
+		if ( !this.form.length ) {
+			return;
+		}
 
-} ) );
+		var instances = this.form.data( "ui-form-reset-instances" );
+		instances.splice( $.inArray( this, instances ), 1 );
+		if ( instances.length ) {
+			this.form.data( "ui-form-reset-instances", instances );
+		} else {
+			this.form
+				.removeData( "ui-form-reset-instances" )
+				.off( "reset.ui-form-reset" );
+		}
+	}
+};
+
+} );

data/vendor/assets/javascripts/jquery-ui/form.js

@@ -1,22 +1,25 @@
 //= require jquery-ui/version
 
 ( function( factory ) {
-  if ( typeof define === "function" && define.amd ) {
+	"use strict";
 
-    // AMD. Register as an anonymous module.
-    define( [ "jquery", "./version" ], factory );
-  } else {
+	if ( typeof define === "function" && define.amd ) {
 
-    // Browser globals
-    factory( jQuery );
-  }
-} ( function( $ ) {
+		// AMD. Register as an anonymous module.
+		define( [ "jquery", "./version" ], factory );
+	} else {
+
+		// Browser globals
+		factory( jQuery );
+	}
+} )( function( $ ) {
+"use strict";
 
 // Support: IE8 Only
 // IE8 does not support the form attribute and when it is supplied. It overwrites the form prop
 // with a string, so we need to find the proper form.
-  return $.fn.form = function() {
-    return typeof this[ 0 ].form === "string" ? this.closest( "form" ) : $( this[ 0 ].form );
-  };
+return $.fn._form = function() {
+	return typeof this[ 0 ].form === "string" ? this.closest( "form" ) : $( this[ 0 ].form );
+};
 
-} ) );
+} );

data/vendor/assets/javascripts/jquery-ui/ie.js

@@ -1,6 +1,8 @@
 //= require jquery-ui/version
 
 ( function( factory ) {
+	"use strict";
+
 	if ( typeof define === "function" && define.amd ) {
 
 		// AMD. Register as an anonymous module.
@@ -10,8 +12,9 @@
 		// Browser globals
 		factory( jQuery );
 	}
-} ( function( $ ) {
+} )( function( $ ) {
+"use strict";
 
 // This file is deprecated
 return $.ui.ie = !!/msie [\w.]+/.exec( navigator.userAgent.toLowerCase() );
-} ) );
+} );

data/vendor/assets/javascripts/jquery-ui/keycode.js

@@ -1,20 +1,22 @@
 //= require jquery-ui/version
 
 /*!
- * jQuery UI Keycode 1.12.1
- * http://jqueryui.com
+ * jQuery UI Keycode 1.13.3
+ * https://jqueryui.com
  *
- * Copyright jQuery Foundation and other contributors
+ * Copyright OpenJS Foundation and other contributors
  * Released under the MIT license.
- * http://jquery.org/license
+ * https://jquery.org/license
  */
 
 //>>label: Keycode
 //>>group: Core
 //>>description: Provide keycodes as keynames
-//>>docs: http://api.jqueryui.com/jQuery.ui.keyCode/
+//>>docs: https://api.jqueryui.com/jQuery.ui.keyCode/
 
 ( function( factory ) {
+	"use strict";
+
 	if ( typeof define === "function" && define.amd ) {
 
 		// AMD. Register as an anonymous module.
@@ -24,7 +26,9 @@
 		// Browser globals
 		factory( jQuery );
 	}
-} ( function( $ ) {
+} )( function( $ ) {
+"use strict";
+
 return $.ui.keyCode = {
 	BACKSPACE: 8,
 	COMMA: 188,
@@ -44,4 +48,4 @@ return $.ui.keyCode = {
 	UP: 38
 };
 
-} ) );
+} );

data/vendor/assets/javascripts/jquery-ui/labels.js

@@ -1,65 +1,71 @@
 //= require jquery-ui/version
-//= require jquery-ui/escape-selector
 
 /*!
- * jQuery UI Labels 1.12.1
- * http://jqueryui.com
+ * jQuery UI Labels 1.13.3
+ * https://jqueryui.com
  *
- * Copyright jQuery Foundation and other contributors
+ * Copyright OpenJS Foundation and other contributors
  * Released under the MIT license.
- * http://jquery.org/license
+ * https://jquery.org/license
  */
 
 //>>label: labels
 //>>group: Core
 //>>description: Find all the labels associated with a given input
-//>>docs: http://api.jqueryui.com/labels/
+//>>docs: https://api.jqueryui.com/labels/
 
 ( function( factory ) {
-  if ( typeof define === "function" && define.amd ) {
+	"use strict";
 
-    // AMD. Register as an anonymous module.
-    define( [ "jquery", "./version", "./escape-selector" ], factory );
-  } else {
+	if ( typeof define === "function" && define.amd ) {
 
-    // Browser globals
-    factory( jQuery );
-  }
-} ( function( $ ) {
+		// AMD. Register as an anonymous module.
+		define( [ "jquery", "./version" ], factory );
+	} else {
 
-  return $.fn.labels = function() {
-    var ancestor, selector, id, labels, ancestors;
+		// Browser globals
+		factory( jQuery );
+	}
+} )( function( $ ) {
+"use strict";
 
-    // Check control.labels first
-    if ( this[ 0 ].labels && this[ 0 ].labels.length ) {
-      return this.pushStack( this[ 0 ].labels );
-    }
+return $.fn.labels = function() {
+	var ancestor, selector, id, labels, ancestors;
 
-    // Support: IE <= 11, FF <= 37, Android <= 2.3 only
-    // Above browsers do not support control.labels. Everything below is to support them
-    // as well as document fragments. control.labels does not work on document fragments
-    labels = this.eq( 0 ).parents( "label" );
+	if ( !this.length ) {
+		return this.pushStack( [] );
+	}
 
-    // Look for the label based on the id
-    id = this.attr( "id" );
-    if ( id ) {
+	// Check control.labels first
+	if ( this[ 0 ].labels && this[ 0 ].labels.length ) {
+		return this.pushStack( this[ 0 ].labels );
+	}
 
-      // We don't search against the document in case the element
-      // is disconnected from the DOM
-      ancestor = this.eq( 0 ).parents().last();
+	// Support: IE <= 11, FF <= 37, Android <= 2.3 only
+	// Above browsers do not support control.labels. Everything below is to support them
+	// as well as document fragments. control.labels does not work on document fragments
+	labels = this.eq( 0 ).parents( "label" );
 
-      // Get a full set of top level ancestors
-      ancestors = ancestor.add( ancestor.length ? ancestor.siblings() : this.siblings() );
+	// Look for the label based on the id
+	id = this.attr( "id" );
+	if ( id ) {
 
-      // Create a selector for the label based on the id
-      selector = "label[for='" + $.ui.escapeSelector( id ) + "']";
+		// We don't search against the document in case the element
+		// is disconnected from the DOM
+		ancestor = this.eq( 0 ).parents().last();
 
-      labels = labels.add( ancestors.find( selector ).addBack( selector ) );
+		// Get a full set of top level ancestors
+		ancestors = ancestor.add( ancestor.length ? ancestor.siblings() : this.siblings() );
 
-    }
+		// Create a selector for the label based on the id
+		selector = "label[for='" + $.escapeSelector( id ) + "']";
 
-    // Return whatever we have found for labels
-    return this.pushStack( labels );
-  };
+		labels = labels.add( ancestors.find( selector ).addBack( selector ) );
 
-} ) );
+	}
+
+	// Return whatever we have found for labels
+	return this.pushStack( labels );
+};
+
+} );

data/vendor/assets/javascripts/jquery-ui/plugin.js

@@ -1,6 +1,8 @@
 //= require jquery-ui/version
 
 ( function( factory ) {
+	"use strict";
+
 	if ( typeof define === "function" && define.amd ) {
 
 		// AMD. Register as an anonymous module.
@@ -10,7 +12,8 @@
 		// Browser globals
 		factory( jQuery );
 	}
-} ( function( $ ) {
+} )( function( $ ) {
+"use strict";
 
 // $.ui.plugin is deprecated. Use $.widget() extensions instead.
 return $.ui.plugin = {
@@ -43,4 +46,4 @@ return $.ui.plugin = {
 	}
 };
 
-} ) );
+} );