jodit 4.17.2 → 4.17.4
This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
- package/CHANGELOG.md +12 -0
- package/es2015/jodit.css +1 -1
- package/es2015/jodit.fat.min.js +5 -5
- package/es2015/jodit.js +60 -7
- package/es2015/jodit.min.js +10 -10
- package/es2015/plugins/debug/debug.css +1 -1
- package/es2015/plugins/debug/debug.js +1 -1
- package/es2015/plugins/debug/debug.min.js +1 -1
- package/es2015/plugins/speech-recognize/speech-recognize.css +1 -1
- package/es2015/plugins/speech-recognize/speech-recognize.js +1 -1
- package/es2015/plugins/speech-recognize/speech-recognize.min.js +1 -1
- package/es2018/jodit.fat.min.js +5 -5
- package/es2018/jodit.min.js +5 -5
- package/es2018/plugins/debug/debug.min.js +1 -1
- package/es2018/plugins/speech-recognize/speech-recognize.min.js +1 -1
- package/es2021/jodit.css +1 -1
- package/es2021/jodit.fat.min.js +6 -6
- package/es2021/jodit.js +60 -7
- package/es2021/jodit.min.js +6 -6
- package/es2021/plugins/debug/debug.css +1 -1
- package/es2021/plugins/debug/debug.js +1 -1
- package/es2021/plugins/debug/debug.min.js +1 -1
- package/es2021/plugins/speech-recognize/speech-recognize.css +1 -1
- package/es2021/plugins/speech-recognize/speech-recognize.js +1 -1
- package/es2021/plugins/speech-recognize/speech-recognize.min.js +1 -1
- package/es2021.en/jodit.css +1 -1
- package/es2021.en/jodit.fat.min.js +6 -6
- package/es2021.en/jodit.js +60 -7
- package/es2021.en/jodit.min.js +6 -6
- package/es2021.en/plugins/debug/debug.css +1 -1
- package/es2021.en/plugins/debug/debug.js +1 -1
- package/es2021.en/plugins/debug/debug.min.js +1 -1
- package/es2021.en/plugins/speech-recognize/speech-recognize.css +1 -1
- package/es2021.en/plugins/speech-recognize/speech-recognize.js +1 -1
- package/es2021.en/plugins/speech-recognize/speech-recognize.min.js +1 -1
- package/es5/jodit.css +2 -2
- package/es5/jodit.fat.min.js +2 -2
- package/es5/jodit.js +80 -7
- package/es5/jodit.min.css +2 -2
- package/es5/jodit.min.js +2 -2
- package/es5/plugins/debug/debug.css +1 -1
- package/es5/plugins/debug/debug.js +1 -1
- package/es5/plugins/debug/debug.min.js +1 -1
- package/es5/plugins/speech-recognize/speech-recognize.css +1 -1
- package/es5/plugins/speech-recognize/speech-recognize.js +1 -1
- package/es5/plugins/speech-recognize/speech-recognize.min.js +1 -1
- package/es5/polyfills.fat.min.js +1 -1
- package/es5/polyfills.js +1 -1
- package/es5/polyfills.min.js +1 -1
- package/esm/core/constants.js +1 -1
- package/esm/core/helpers/html/safe-html.js +15 -0
- package/esm/jodit.js +5 -0
- package/esm/modules/file-browser/data-provider.d.ts +1 -0
- package/esm/modules/file-browser/data-provider.js +26 -5
- package/esm/plugins/clean-html/clean-html.d.ts +8 -0
- package/esm/plugins/clean-html/clean-html.js +13 -0
- package/package.json +1 -1
- package/types/modules/file-browser/data-provider.d.ts +1 -0
- package/types/plugins/clean-html/clean-html.d.ts +8 -0
package/CHANGELOG.md
CHANGED
|
@@ -9,6 +9,18 @@
|
|
|
9
9
|
> - :house: [Internal]
|
|
10
10
|
> - :nail_care: [Polish]
|
|
11
11
|
|
|
12
|
+
## 4.17.4
|
|
13
|
+
|
|
14
|
+
#### :bug: Bug Fix
|
|
15
|
+
|
|
16
|
+
- File browser: removing several selected files sent one `fileRemove` per file and the data provider aborted every request but the last, because it keeps a single in-flight request per action and replaces it when the same action is asked for again. Aborting a request that changes server state does not undo it, the caller just never learns the result, so only the last file was ever removed. The replace-on-repeat behaviour now applies only to listings (`items`, `folder`, `permissions`, `getLocalFileByUrl`); every other action runs side by side and finishes. Reported by an OEM customer through the FileBrowserPro delete flow (fixed on the PRO side in jodit-pro 4.17.5 as well).
|
|
17
|
+
|
|
18
|
+
## 4.17.3
|
|
19
|
+
|
|
20
|
+
#### :bug: Bug Fix
|
|
21
|
+
|
|
22
|
+
- Security: mutation XSS on value assignment through a `<noscript>` carrier. The value is sanitized in an inert document, where scripting is off and `<noscript>` content is parsed as markup, then serialized and assigned to the live editor, where scripting is on and the same bytes are parsed as raw text ending at the first `</noscript>`. An `<img onerror>` hidden as inert text inside `<noscript><style>` therefore passed the sanitizer unchanged and became a live element whose handler fired as soon as the content loaded. `safeHTML` now removes `<noscript>` outright, and the editor fires a new synchronous `afterSetNativeEditorValue` event right after the assignment, on which `cleanHTML` sanitizes the live tree once more before any task can run, so other parse-context differences cannot leave a live handler either. Reported by Tan-JunWei.
|
|
23
|
+
|
|
12
24
|
## 4.17.2
|
|
13
25
|
|
|
14
26
|
#### :bug: Bug Fix
|
package/es2015/jodit.css
CHANGED