jodit 4.13.5 → 4.13.6
This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
- package/CHANGELOG.md +7 -0
- package/es2015/jodit.css +1 -1
- package/es2015/jodit.fat.min.js +14 -14
- package/es2015/jodit.js +14 -6
- package/es2015/jodit.min.js +4 -4
- package/es2015/plugins/debug/debug.css +1 -1
- package/es2015/plugins/debug/debug.js +1 -1
- package/es2015/plugins/debug/debug.min.js +1 -1
- package/es2015/plugins/speech-recognize/speech-recognize.css +1 -1
- package/es2015/plugins/speech-recognize/speech-recognize.js +1 -1
- package/es2015/plugins/speech-recognize/speech-recognize.min.js +1 -1
- package/es2018/jodit.fat.min.js +4 -4
- package/es2018/jodit.min.js +4 -4
- package/es2018/plugins/debug/debug.min.js +1 -1
- package/es2018/plugins/speech-recognize/speech-recognize.min.js +1 -1
- package/es2021/jodit.css +1 -1
- package/es2021/jodit.fat.min.js +4 -4
- package/es2021/jodit.js +14 -6
- package/es2021/jodit.min.js +4 -4
- package/es2021/plugins/debug/debug.css +1 -1
- package/es2021/plugins/debug/debug.js +1 -1
- package/es2021/plugins/debug/debug.min.js +1 -1
- package/es2021/plugins/speech-recognize/speech-recognize.css +1 -1
- package/es2021/plugins/speech-recognize/speech-recognize.js +1 -1
- package/es2021/plugins/speech-recognize/speech-recognize.min.js +1 -1
- package/es2021.en/jodit.css +1 -1
- package/es2021.en/jodit.fat.min.js +4 -4
- package/es2021.en/jodit.js +14 -6
- package/es2021.en/jodit.min.js +4 -4
- package/es2021.en/plugins/debug/debug.css +1 -1
- package/es2021.en/plugins/debug/debug.js +1 -1
- package/es2021.en/plugins/debug/debug.min.js +1 -1
- package/es2021.en/plugins/speech-recognize/speech-recognize.css +1 -1
- package/es2021.en/plugins/speech-recognize/speech-recognize.js +1 -1
- package/es2021.en/plugins/speech-recognize/speech-recognize.min.js +1 -1
- package/es5/jodit.css +2 -2
- package/es5/jodit.fat.min.js +2 -2
- package/es5/jodit.js +14 -6
- package/es5/jodit.min.css +2 -2
- package/es5/jodit.min.js +2 -2
- package/es5/plugins/debug/debug.css +1 -1
- package/es5/plugins/debug/debug.js +1 -1
- package/es5/plugins/debug/debug.min.js +1 -1
- package/es5/plugins/speech-recognize/speech-recognize.css +1 -1
- package/es5/plugins/speech-recognize/speech-recognize.js +1 -1
- package/es5/plugins/speech-recognize/speech-recognize.min.js +1 -1
- package/es5/polyfills.fat.min.js +1 -1
- package/es5/polyfills.js +1 -1
- package/es5/polyfills.min.js +1 -1
- package/esm/core/constants.js +1 -1
- package/esm/modules/toolbar/button/button.js +2 -1
- package/esm/plugins/clean-html/helpers/visitor/filters/try-remove-node.js +10 -3
- package/package.json +1 -1
package/CHANGELOG.md
CHANGED
|
@@ -9,6 +9,13 @@
|
|
|
9
9
|
> - :house: [Internal]
|
|
10
10
|
> - :nail_care: [Polish]
|
|
11
11
|
|
|
12
|
+
## 4.13.6
|
|
13
|
+
|
|
14
|
+
#### :bug: Bug Fix
|
|
15
|
+
|
|
16
|
+
- **Security / clean-html**: a `<script>` nested directly inside `<svg>` (or MathML) is now removed by `denyTags`. The deny/allow tag filter matched `node.nodeName` against an upper-cased hash, but foreign-namespaced elements keep their original case (an SVG `<script>` reports `"script"`, not `"SCRIPT"`), so the script slipped through the default `denyTags` and executed when the value was loaded into the editor. The lookup now normalises the tag name to upper case, so namespace can't bypass the filter — while still honouring `allowTags`. Fixes GHSA-45qg-252v-3f7p. Thanks to Roman Kis for the report.
|
|
17
|
+
- **Toolbar**: fixed `TypeError: Cannot redefine property: component` thrown when the editor is created with `cache: false`. `ToolbarButton.createContainer` (decorated with `@cacheHTML`) defined the `component` back-reference on the button element without `configurable`, i.e. non-configurable. With caching enabled the container is cloned (which drops the property), hiding the problem; with `cache: false` the container isn't cloned, so a button built after an editor became ready reached the constructor still carrying that non-configurable property and the constructor's redefine threw. The property is now defined as configurable, matching the base `UIElement`.
|
|
18
|
+
|
|
12
19
|
## 4.13.5
|
|
13
20
|
|
|
14
21
|
#### :house: Internal
|
package/es2015/jodit.css
CHANGED