jodit 4.17.2 → 4.17.4

package/es5/plugins/debug/debug.css

@@ -1,7 +1,7 @@
 /*!
  * jodit - Jodit is an awesome and useful wysiwyg editor with filebrowser
  * Author: Chupurnov <chupurnov@gmail.com> (https://xdsoft.net/jodit/)
- * Version: v4.17.2
+ * Version: v4.17.4
  * Url: https://xdsoft.net/jodit/
  * License(s): MIT
  */

package/es5/plugins/debug/debug.js

@@ -1,7 +1,7 @@
 /*!
  * jodit - Jodit is an awesome and useful wysiwyg editor with filebrowser
  * Author: Chupurnov <chupurnov@gmail.com> (https://xdsoft.net/jodit/)
- * Version: v4.17.2
+ * Version: v4.17.4
  * Url: https://xdsoft.net/jodit/
  * License(s): MIT
  */

package/es5/plugins/debug/debug.min.js

@@ -1,7 +1,7 @@
 /*!
  * jodit - Jodit is an awesome and useful wysiwyg editor with filebrowser
  * Author: Chupurnov <chupurnov@gmail.com> (https://xdsoft.net/jodit/)
- * Version: v4.17.2
+ * Version: v4.17.4
  * Url: https://xdsoft.net/jodit/
  * License(s): MIT
  */

package/es5/plugins/speech-recognize/speech-recognize.css

@@ -1,7 +1,7 @@
 /*!
  * jodit - Jodit is an awesome and useful wysiwyg editor with filebrowser
  * Author: Chupurnov <chupurnov@gmail.com> (https://xdsoft.net/jodit/)
- * Version: v4.17.2
+ * Version: v4.17.4
  * Url: https://xdsoft.net/jodit/
  * License(s): MIT
  */

package/es5/plugins/speech-recognize/speech-recognize.js

@@ -1,7 +1,7 @@
 /*!
  * jodit - Jodit is an awesome and useful wysiwyg editor with filebrowser
  * Author: Chupurnov <chupurnov@gmail.com> (https://xdsoft.net/jodit/)
- * Version: v4.17.2
+ * Version: v4.17.4
  * Url: https://xdsoft.net/jodit/
  * License(s): MIT
  */

package/es5/plugins/speech-recognize/speech-recognize.min.js

@@ -1,7 +1,7 @@
 /*!
  * jodit - Jodit is an awesome and useful wysiwyg editor with filebrowser
  * Author: Chupurnov <chupurnov@gmail.com> (https://xdsoft.net/jodit/)
- * Version: v4.17.2
+ * Version: v4.17.4
  * Url: https://xdsoft.net/jodit/
  * License(s): MIT
  */

package/es5/polyfills.fat.min.js

@@ -1,7 +1,7 @@
 /*!
  * jodit - Jodit is an awesome and useful wysiwyg editor with filebrowser
  * Author: Chupurnov <chupurnov@gmail.com> (https://xdsoft.net/jodit/)
- * Version: v4.17.2
+ * Version: v4.17.4
  * Url: https://xdsoft.net/jodit/
  * License(s): MIT
  */

package/es5/polyfills.js

@@ -1,7 +1,7 @@
 /*!
  * jodit - Jodit is an awesome and useful wysiwyg editor with filebrowser
  * Author: Chupurnov <chupurnov@gmail.com> (https://xdsoft.net/jodit/)
- * Version: v4.17.2
+ * Version: v4.17.4
  * Url: https://xdsoft.net/jodit/
  * License(s): MIT
  */

package/es5/polyfills.min.js

@@ -1,7 +1,7 @@
 /*!
  * jodit - Jodit is an awesome and useful wysiwyg editor with filebrowser
  * Author: Chupurnov <chupurnov@gmail.com> (https://xdsoft.net/jodit/)
- * Version: v4.17.2
+ * Version: v4.17.4
  * Url: https://xdsoft.net/jodit/
  * License(s): MIT
  */

package/esm/core/constants.js

@@ -3,7 +3,7 @@
  * Released under MIT see LICENSE.txt in the project root for license information.
  * Copyright (c) 2013-2026 Valerii Chupurnov. All rights reserved. https://xdsoft.net
  */
-export const APP_VERSION = "4.17.2";
+export const APP_VERSION = "4.17.4";
 // prettier-ignore
 export const ES = "es2020";
 export const IS_ES_MODERN = true;

package/esm/core/helpers/html/safe-html.js

@@ -60,6 +60,21 @@ export function safeHTML(box, options) {
             Dom.safeRemove(elm);
         }
     }
+    // `<noscript>` is parsed as markup in a document with scripting off (the
+    // inert document the value is sanitized in) and as raw text in one with
+    // scripting on (the live editor). The same serialized bytes therefore
+    // describe two different trees, and markup hidden as inert text in the
+    // first comes alive as elements in the second. The element has no use in
+    // editor content, so it goes, together with everything it carried.
+    const noscript = [];
+    Dom.each(box, node => {
+        if (Dom.isElement(node) && node.nodeName === 'NOSCRIPT') {
+            noscript.push(node);
+        }
+    });
+    for (const elm of noscript) {
+        Dom.safeRemove(elm);
+    }
     const removeEvents = (_a = options.removeEventAttributes) !== null && _a !== void 0 ? _a : options.removeOnError;
     // Single synchronous traversal of the subtree. Besides removing event
     // handlers and `javascript:` links, `sanitizeHTMLElement` neutralises

package/esm/jodit.js

@@ -333,6 +333,11 @@ let Jodit = Jodit_1 = class Jodit extends ViewWithToolbar {
         }
         if (this.editor) {
             this.editor.innerHTML = data.value;
+            // Fired synchronously, before any task can run: the value was
+            // sanitized in an inert document and re-parsed here with scripting
+            // on, and the two parsers do not always agree. Listeners get to
+            // look at the tree that actually exists.
+            this.e.fire('afterSetNativeEditorValue');
         }
     }
     /**

package/esm/modules/file-browser/data-provider.d.ts

@@ -27,6 +27,7 @@ export default class DataProvider implements IFileBrowserDataProvider {
      */
     get o(): this['options'];
     private __ajaxInstances;
+    private __requestSerial;
     protected get<T extends IFileBrowserAnswer = IFileBrowserAnswer>(name: keyof IFileBrowserOptions): Promise<T>;
     private progressHandler;
     onProgress(callback: (percentage: number) => void): void;

package/esm/modules/file-browser/data-provider.js

@@ -77,12 +77,24 @@ export function assertSourcesAnswer(resp, action, option) {
     });
     return resp;
 }
+/**
+ * Actions that only read from the connector. A newer request for one of them
+ * makes the older one pointless, so it is aborted; every other action changes
+ * server state and must be allowed to finish.
+ */
+const REPLACEABLE_ACTIONS = new Set([
+    'items',
+    'folder',
+    'permissions',
+    'getLocalFileByUrl'
+]);
 export default class DataProvider {
     constructor(parent, options) {
         this.parent = parent;
         this.options = options;
         this.__currentPermissions = null;
         this.__ajaxInstances = new Map();
+        this.__requestSerial = 0;
         this.progressHandler = (ignore) => { };
     }
     /**
@@ -93,10 +105,19 @@ export default class DataProvider {
     }
     get(name) {
         const instances = this.__ajaxInstances;
-        if (instances.has(name)) {
-            const ajax = instances.get(name);
+        // A listing asked for again supersedes the one still loading, so the
+        // earlier request is aborted. That must never happen to a request
+        // that changes something on the server: aborting it does not undo it,
+        // the caller just never hears the result. Removing several files at
+        // once used to send one `fileRemove` per file and abort all but the
+        // last, so only the last one was ever removed. Mutating requests get a
+        // key of their own and run side by side.
+        const replaceable = REPLACEABLE_ACTIONS.has(name);
+        const key = replaceable ? name : `${name}#${++this.__requestSerial}`;
+        if (replaceable && instances.has(key)) {
+            const ajax = instances.get(key);
             ajax === null || ajax === void 0 ? void 0 : ajax.abort();
-            instances.delete(name);
+            instances.delete(key);
         }
         const opts = ConfigProto(this.options[name] !== undefined
             ? this.options[name]
@@ -107,12 +128,12 @@ export default class DataProvider {
             opts.data = opts.prepareData.call(this, opts.data);
         }
         const ajax = new Ajax(opts);
-        instances.set(name, ajax);
+        instances.set(key, ajax);
         const promise = ajax.send();
         promise
             .finally(() => {
             ajax.destruct();
-            instances.delete(name);
+            instances.delete(key);
             this.progressHandler(100);
         })
             .catch(() => null);

package/esm/plugins/clean-html/clean-html.d.ts

@@ -25,6 +25,14 @@ export declare class cleanHtml extends Plugin {
     private walker;
     protected startWalker(): void;
     protected beforeCommand(command: string): void | false;
+    /**
+     * The value was sanitized in an inert document and has just been re-parsed
+     * into the live editor with scripting on. Where the two parsers disagree
+     * (`<noscript>`, raw-text elements), markup that was inert text a moment
+     * ago is a real element now, so the live tree is sanitized once more, in
+     * the same call stack, before any handler it might carry can fire.
+     */
+    protected onAfterSetNativeEditorValue(): void;
     /**
      * Event handler when manually assigning a value to the HTML editor.
      */

package/esm/plugins/clean-html/clean-html.js

@@ -81,6 +81,16 @@ export class cleanHtml extends Plugin {
             return false;
         }
     }
+    /**
+     * The value was sanitized in an inert document and has just been re-parsed
+     * into the live editor with scripting on. Where the two parsers disagree
+     * (`<noscript>`, raw-text elements), markup that was inert text a moment
+     * ago is a real element now, so the live tree is sanitized once more, in
+     * the same call stack, before any handler it might carry can fire.
+     */
+    onAfterSetNativeEditorValue() {
+        safeHTML(this.j.editor, this.j.o.cleanHTML);
+    }
     /**
      * Event handler when manually assigning a value to the HTML editor.
      */
@@ -201,6 +211,9 @@ __decorate([
 __decorate([
     watch(':beforeCommand')
 ], cleanHtml.prototype, "beforeCommand", null);
+__decorate([
+    watch(':afterSetNativeEditorValue')
+], cleanHtml.prototype, "onAfterSetNativeEditorValue", null);
 __decorate([
     watch(':beforeSetNativeEditorValue')
 ], cleanHtml.prototype, "onBeforeSetNativeEditorValue", null);

package/package.json

@@ -1,6 +1,6 @@
 {
 	"name": "jodit",
-	"version": "4.17.2",
+	"version": "4.17.4",
 	"description": "Jodit is an awesome and useful wysiwyg editor with filebrowser",
 	"main": "esm/index.js",
 	"types": "types/index.d.ts",

package/types/modules/file-browser/data-provider.d.ts

@@ -27,6 +27,7 @@ export default class DataProvider implements IFileBrowserDataProvider {
      */
     get o(): this['options'];
     private __ajaxInstances;
+    private __requestSerial;
     protected get<T extends IFileBrowserAnswer = IFileBrowserAnswer>(name: keyof IFileBrowserOptions): Promise<T>;
     private progressHandler;
     onProgress(callback: (percentage: number) => void): void;

package/types/plugins/clean-html/clean-html.d.ts

@@ -25,6 +25,14 @@ export declare class cleanHtml extends Plugin {
     private walker;
     protected startWalker(): void;
     protected beforeCommand(command: string): void | false;
+    /**
+     * The value was sanitized in an inert document and has just been re-parsed
+     * into the live editor with scripting on. Where the two parsers disagree
+     * (`<noscript>`, raw-text elements), markup that was inert text a moment
+     * ago is a real element now, so the live tree is sanitized once more, in
+     * the same call stack, before any handler it might carry can fire.
+     */
+    protected onAfterSetNativeEditorValue(): void;
     /**
      * Event handler when manually assigning a value to the HTML editor.
      */