jodit 4.13.5 → 4.13.7

package/es5/jodit.js

@@ -1,7 +1,7 @@
 /*!
  * jodit - Jodit is an awesome and useful wysiwyg editor with filebrowser
  * Author: Chupurnov <chupurnov@gmail.com> (https://xdsoft.net/jodit/)
- * Version: v4.13.5
+ * Version: v4.13.7
  * Url: https://xdsoft.net/jodit/
  * License(s): MIT
  */
@@ -2107,7 +2107,7 @@ __webpack_require__.r(__webpack_exports__);
  * @packageDocumentation
  * @module constants
  */ 
-var APP_VERSION = "4.13.5";
+var APP_VERSION = "4.13.7";
 // prettier-ignore
 var ES = "es5";
 var IS_ES_MODERN = false;
@@ -22792,6 +22792,12 @@ var Dialog = /*#__PURE__*/ function(ViewWithToolbar) {
 	 */ (0,_swc_helpers_define_property__WEBPACK_IMPORTED_MODULE_3__._)(_this, "isOpened", false);
         var self1 = _this;
         self1.options = (0,jodit_core_helpers_utils__WEBPACK_IMPORTED_MODULE_17__.ConfigProto)(options, (0,jodit_core_helpers_utils__WEBPACK_IMPORTED_MODULE_17__.ConfigProto)(jodit_config__WEBPACK_IMPORTED_MODULE_22__.Config.prototype.dialog, Dialog.defaultOptions));
+        // Attach event handlers passed via `options.events` to the dialog's own
+        // emitter (as FileBrowser already does), so a consumer — e.g. a plugin
+        // forwarding the editor's `events` config — can observe `afterOpen` /
+        // `beforeClose`. Unlike popups, the dialog fires these on its own
+        // emitter, so without this they were unreachable from the editor.
+        self1.attachEvents(self1.options);
         jodit_core_dom_dom__WEBPACK_IMPORTED_MODULE_13__.Dom.safeRemove(self1.container);
         var n = _this.getFullElName.bind(_this);
         self1.container = _this.c.fromHTML('<div class="jodit jodit-dialog '.concat(_this.componentName, '">\n				<div class="').concat(n('overlay'), '"></div>\n				<div class="').concat(_this.getFullElName('panel'), '">\n					<div class="').concat(n('header'), '">\n						<div class="').concat(n('header-title'), '"></div>\n						<div class="').concat(n('header-toolbar'), '"></div>\n					</div>\n					<div class="').concat(n('content'), '"></div>\n					<div class="').concat(n('footer'), '"></div>\n					<div class="').concat(n('resizer'), '">').concat(jodit_core_ui__WEBPACK_IMPORTED_MODULE_19__.Icon.get('resize_handler'), "</div>\n				</div>\n			</div>"));
@@ -28892,7 +28898,8 @@ var ToolbarButton = /*#__PURE__*/ function(UIButton) {
                 button.classList.remove(cn);
                 button.classList.add(cn + '__button');
                 Object.defineProperty(button, 'component', {
-                    value: this
+                    value: this,
+                    configurable: true
                 });
                 container.appendChild(button);
                 var trigger = this.j.c.fromHTML('<span role="button" aria-haspopup="true" aria-expanded="false" class="'.concat(cn, '__trigger">').concat(jodit_core_ui_icon__WEBPACK_IMPORTED_MODULE_30__.Icon.get('chevron'), "</span>"));
@@ -34418,15 +34425,22 @@ function filterStyleProperties(style, allowed) {
  * @private
  */ function isRemovableNode(jodit, node, current, allow, deny) {
     if (!jodit_core_dom_dom__WEBPACK_IMPORTED_MODULE_1__.Dom.isText(node)) {
-        if (allow && !allow[node.nodeName]) {
+        // The allow/deny hashes are keyed by upper-cased tag name. HTML
+        // `nodeName` is already upper-case, but foreign (SVG/MathML) elements
+        // keep their original case — an SVG `<script>` reports `"script"`, so a
+        // case-sensitive lookup let it slip past `denyTags` and execute. Normalise
+        // to upper case so namespace can't bypass the filter. See
+        // GHSA-45qg-252v-3f7p.
+        var name = node.nodeName.toUpperCase();
+        if (allow && !allow[name]) {
             return true;
         }
         // A YouTube/Vimeo player inserted through the Video button is trusted
         // editor content, so keep it even though `iframe` is denied by default
         // — otherwise the embed is stripped ~300ms after insertion (#1381).
         // Arbitrary/bare iframes stay denied.
-        var isTrustedEmbed = node.nodeName === 'IFRAME' && (0,_is_allowed_media_embed__WEBPACK_IMPORTED_MODULE_4__.isAllowedMediaEmbed)((0,jodit_core_helpers_utils_attr__WEBPACK_IMPORTED_MODULE_3__.attr)(node, 'src') || '');
-        if (!allow && deny && deny[node.nodeName] && !isTrustedEmbed) {
+        var isTrustedEmbed = name === 'IFRAME' && (0,_is_allowed_media_embed__WEBPACK_IMPORTED_MODULE_4__.isAllowedMediaEmbed)((0,jodit_core_helpers_utils_attr__WEBPACK_IMPORTED_MODULE_3__.attr)(node, 'src') || '');
+        if (!allow && deny && deny[name] && !isTrustedEmbed) {
             return true;
         }
     }

package/es5/jodit.min.css

@@ -1,14 +1,14 @@
 /*!
  * jodit - Jodit is an awesome and useful wysiwyg editor with filebrowser
  * Author: Chupurnov <chupurnov@gmail.com> (https://xdsoft.net/jodit/)
- * Version: v4.13.5
+ * Version: v4.13.7
  * Url: https://xdsoft.net/jodit/
  * License(s): MIT
  */
 	/*!
  * jodit - Jodit is an awesome and useful wysiwyg editor with filebrowser
  * Author: Chupurnov <chupurnov@gmail.com> (https://xdsoft.net/jodit/)
- * Version: v4.13.5
+ * Version: v4.13.7
  * Url: https://xdsoft.net/jodit/
  * License(s): MIT
  */