From 83a9f219bf40ff834d660020bbfa7de550e48a0c Mon Sep 17 00:00:00 2001
From: Jörn Zaefferer <joern.zaefferer@gmail.com>
Date: Thu, 15 Nov 2012 22:29:24 +0100
Subject: Dialog: Use button widget for close button (was already listed as
 dependency)

---
 demos/dialog/animated.html           | 1 +
 demos/dialog/default.html            | 1 +
 demos/dialog/modal-confirmation.html | 1 +
 demos/dialog/modal-form.html         | 7 ++++---
 demos/dialog/modal-message.html      | 1 +
 demos/dialog/modal.html              | 1 +
 6 files changed, 9 insertions(+), 3 deletions(-)

(limited to 'demos')

diff --git a/demos/dialog/animated.html b/demos/dialog/animated.html
index 8e1daf131..061396548 100644
--- a/demos/dialog/animated.html
+++ b/demos/dialog/animated.html
@@ -11,6 +11,7 @@
 	<script src="../../ui/jquery.ui.draggable.js"></script>
 	<script src="../../ui/jquery.ui.position.js"></script>
 	<script src="../../ui/jquery.ui.resizable.js"></script>
+	<script src="../../ui/jquery.ui.button.js"></script>
 	<script src="../../ui/jquery.ui.dialog.js"></script>
 	<script src="../../ui/jquery.ui.effect.js"></script>
 	<script src="../../ui/jquery.ui.effect-blind.js"></script>
diff --git a/demos/dialog/default.html b/demos/dialog/default.html
index 214f41d0d..777921e48 100644
--- a/demos/dialog/default.html
+++ b/demos/dialog/default.html
@@ -11,6 +11,7 @@
 	<script src="../../ui/jquery.ui.draggable.js"></script>
 	<script src="../../ui/jquery.ui.position.js"></script>
 	<script src="../../ui/jquery.ui.resizable.js"></script>
+	<script src="../../ui/jquery.ui.button.js"></script>
 	<script src="../../ui/jquery.ui.dialog.js"></script>
 	<link rel="stylesheet" href="../demos.css">
 	<script>
diff --git a/demos/dialog/modal-confirmation.html b/demos/dialog/modal-confirmation.html
index e73c9ea2b..04f5d93fb 100644
--- a/demos/dialog/modal-confirmation.html
+++ b/demos/dialog/modal-confirmation.html
@@ -11,6 +11,7 @@
 	<script src="../../ui/jquery.ui.button.js"></script>
 	<script src="../../ui/jquery.ui.draggable.js"></script>
 	<script src="../../ui/jquery.ui.position.js"></script>
+	<script src="../../ui/jquery.ui.button.js"></script>
 	<script src="../../ui/jquery.ui.dialog.js"></script>
 	<link rel="stylesheet" href="../demos.css">
 	<script>
diff --git a/demos/dialog/modal-form.html b/demos/dialog/modal-form.html
index a779494a4..b1d4e52cc 100644
--- a/demos/dialog/modal-form.html
+++ b/demos/dialog/modal-form.html
@@ -12,6 +12,7 @@
 	<script src="../../ui/jquery.ui.draggable.js"></script>
 	<script src="../../ui/jquery.ui.position.js"></script>
 	<script src="../../ui/jquery.ui.resizable.js"></script>
+	<script src="../../ui/jquery.ui.button.js"></script>
 	<script src="../../ui/jquery.ui.dialog.js"></script>
 	<script src="../../ui/jquery.ui.effect.js"></script>
 	<link rel="stylesheet" href="../demos.css">
@@ -86,10 +87,10 @@
 
 					if ( bValid ) {
 						$( "#users tbody" ).append( "<tr>" +
-							"<td>" + name.val() + "</td>" + 
-							"<td>" + email.val() + "</td>" + 
+							"<td>" + name.val() + "</td>" +
+							"<td>" + email.val() + "</td>" +
 							"<td>" + password.val() + "</td>" +
-						"</tr>" ); 
+						"</tr>" );
 						$( this ).dialog( "close" );
 					}
 				},
diff --git a/demos/dialog/modal-message.html b/demos/dialog/modal-message.html
index 60b7c3e15..19fc0e829 100644
--- a/demos/dialog/modal-message.html
+++ b/demos/dialog/modal-message.html
@@ -12,6 +12,7 @@
 	<script src="../../ui/jquery.ui.draggable.js"></script>
 	<script src="../../ui/jquery.ui.position.js"></script>
 	<script src="../../ui/jquery.ui.resizable.js"></script>
+	<script src="../../ui/jquery.ui.button.js"></script>
 	<script src="../../ui/jquery.ui.dialog.js"></script>
 	<link rel="stylesheet" href="../demos.css">
 	<script>
diff --git a/demos/dialog/modal.html b/demos/dialog/modal.html
index 886a3516c..a59358d53 100644
--- a/demos/dialog/modal.html
+++ b/demos/dialog/modal.html
@@ -11,6 +11,7 @@
 	<script src="../../ui/jquery.ui.draggable.js"></script>
 	<script src="../../ui/jquery.ui.position.js"></script>
 	<script src="../../ui/jquery.ui.resizable.js"></script>
+	<script src="../../ui/jquery.ui.button.js"></script>
 	<script src="../../ui/jquery.ui.dialog.js"></script>
 	<link rel="stylesheet" href="../demos.css">
 	<script>
-- 
cgit v1.2.3


From f0c203a9a0cc7cbb70738436ed99c38b407e772a Mon Sep 17 00:00:00 2001
From: Scott González <scott.gonzalez@gmail.com>
Date: Mon, 26 Nov 2012 16:13:21 -0500
Subject: Autocomplete demo: Combobox cleanup.

---
 demos/autocomplete/combobox.html | 28 ++++++++++++----------------
 1 file changed, 12 insertions(+), 16 deletions(-)

(limited to 'demos')

diff --git a/demos/autocomplete/combobox.html b/demos/autocomplete/combobox.html
index 9fd5d4050..6229d47b2 100644
--- a/demos/autocomplete/combobox.html
+++ b/demos/autocomplete/combobox.html
@@ -24,7 +24,7 @@
 		bottom: 0;
 		margin-left: -1px;
 		padding: 0;
-		/* adjust styles for IE 6/7 */
+		/* support: IE7 */
 		*height: 1.7em;
 		*top: 0.1em;
 	}
@@ -46,7 +46,7 @@
 						.addClass( "ui-combobox" )
 						.insertAfter( select );
 
-				function removeIfInvalid(element) {
+				function removeIfInvalid( element ) {
 					var value = $( element ).val(),
 						matcher = new RegExp( "^" + $.ui.autocomplete.escapeRegex( value ) + "$", "i" ),
 						valid = false;
@@ -56,6 +56,7 @@
 							return false;
 						}
 					});
+
 					if ( !valid ) {
 						// remove invalid value, as it didn't match anything
 						$( element )
@@ -66,8 +67,7 @@
 						setTimeout(function() {
 							input.tooltip( "close" ).attr( "title", "" );
 						}, 2500 );
-						input.data( "autocomplete" ).term = "";
-						return false;
+						input.data( "ui-autocomplete" ).term = "";
 					}
 				}
 
@@ -103,13 +103,14 @@
 							});
 						},
 						change: function( event, ui ) {
-							if ( !ui.item )
-								return removeIfInvalid( this );
+							if ( !ui.item ) {
+								removeIfInvalid( this );
+							}
 						}
 					})
 					.addClass( "ui-widget ui-widget-content ui-corner-left" );
 
-				input.data( "autocomplete" )._renderItem = function( ul, item ) {
+				input.data( "ui-autocomplete" )._renderItem = function( ul, item ) {
 					return $( "<li>" )
 						.append( "<a>" + item.label + "</a>" )
 						.appendTo( ul );
@@ -144,19 +145,14 @@
 						input.focus();
 					});
 
-					input
-						.tooltip({
-							position: {
-								of: this.button
-							},
-							tooltipClass: "ui-state-highlight"
-						});
+				input.tooltip({
+					tooltipClass: "ui-state-highlight"
+				});
 			},
 
-			destroy: function() {
+			_destroy: function() {
 				this.wrapper.remove();
 				this.element.show();
-				$.Widget.prototype.destroy.call( this );
 			}
 		});
 	})( jQuery );
-- 
cgit v1.2.3


From 5fee6fd5000072ff32f2d65b6451f39af9e0e39e Mon Sep 17 00:00:00 2001
From: Scott González <scott.gonzalez@gmail.com>
Date: Tue, 27 Nov 2012 10:52:19 -0500
Subject: Autocomplete demo: Combobox: Encode search term inside tooltips.
 Fixes #8859 - Autocomplete: XSS in combobox demo.

---
 demos/autocomplete/combobox.html | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

(limited to 'demos')

diff --git a/demos/autocomplete/combobox.html b/demos/autocomplete/combobox.html
index 6229d47b2..8c6f59fc1 100644
--- a/demos/autocomplete/combobox.html
+++ b/demos/autocomplete/combobox.html
@@ -61,7 +61,7 @@
 						// remove invalid value, as it didn't match anything
 						$( element )
 							.val( "" )
-							.attr( "title", value + " didn't match any item" )
+							.attr( "title", $( "<a>" ).text( value ).html() + " didn't match any item" )
 							.tooltip( "open" );
 						select.val( "" );
 						setTimeout(function() {
-- 
cgit v1.2.3


From f2854408cce7e4b7fc6bf8676761904af9c96bde Mon Sep 17 00:00:00 2001
From: Scott González <scott.gonzalez@gmail.com>
Date: Tue, 27 Nov 2012 11:21:33 -0500
Subject: Tooltip: Escape the title attribute so that it's treated as text and
 not HTML. Fixes #8861 - Tooltip: XSS vulnerability in default content.

---
 demos/autocomplete/combobox.html      |  2 +-
 tests/unit/tooltip/tooltip_options.js | 14 ++++++++++++++
 ui/jquery.ui.tooltip.js               |  4 +++-
 3 files changed, 18 insertions(+), 2 deletions(-)

(limited to 'demos')

diff --git a/demos/autocomplete/combobox.html b/demos/autocomplete/combobox.html
index 8c6f59fc1..6229d47b2 100644
--- a/demos/autocomplete/combobox.html
+++ b/demos/autocomplete/combobox.html
@@ -61,7 +61,7 @@
 						// remove invalid value, as it didn't match anything
 						$( element )
 							.val( "" )
-							.attr( "title", $( "<a>" ).text( value ).html() + " didn't match any item" )
+							.attr( "title", value + " didn't match any item" )
 							.tooltip( "open" );
 						select.val( "" );
 						setTimeout(function() {
diff --git a/tests/unit/tooltip/tooltip_options.js b/tests/unit/tooltip/tooltip_options.js
index f9da27fb7..01ac25040 100644
--- a/tests/unit/tooltip/tooltip_options.js
+++ b/tests/unit/tooltip/tooltip_options.js
@@ -16,6 +16,20 @@ test( "content: default", function() {
 	deepEqual( $( "#" + element.data( "ui-tooltip-id" ) ).text(), "anchortitle" );
 });
 
+test( "content: default; HTML escaping", function() {
+	expect( 2 );
+	var scriptText = "<script>$.ui.tooltip.hacked = true;</script>",
+		element = $( "#tooltipped1" );
+
+	$.ui.tooltip.hacked = false;
+	element.attr( "title", scriptText )
+		.tooltip()
+		.tooltip( "open" );
+	equal( $.ui.tooltip.hacked, false, "script did not execute" );
+	deepEqual( $( "#" + element.data( "ui-tooltip-id" ) ).text(), scriptText,
+		"correct tooltip text" );
+});
+
 test( "content: return string", function() {
 	expect( 1 );
 	var element = $( "#tooltipped1" ).tooltip({
diff --git a/ui/jquery.ui.tooltip.js b/ui/jquery.ui.tooltip.js
index 2ccd61f46..ab8d5173c 100644
--- a/ui/jquery.ui.tooltip.js
+++ b/ui/jquery.ui.tooltip.js
@@ -46,7 +46,9 @@ $.widget( "ui.tooltip", {
 	version: "@VERSION",
 	options: {
 		content: function() {
-			return $( this ).attr( "title" );
+			var title = $( this ).attr( "title" );
+			// Escape title, since we're going from an attribute to raw HTML
+			return $( "<a>" ).text( title ).html();
 		},
 		hide: true,
 		// Disabled elements have inconsistent behavior across browsers (#8661)
-- 
cgit v1.2.3


From e77edc60991dc0d9908e056aa05adc49b9daa7cd Mon Sep 17 00:00:00 2001
From: Pawel Maruszczyk <lord_t@o2.pl>
Date: Tue, 27 Nov 2012 21:37:44 +0100
Subject: Button: Strange space between buttons in IE 7. Fixed #5253 - Toolbar
 demo ugly in IE

---
 demos/button/toolbar.html        | 7 ++++++-
 themes/base/jquery.ui.button.css | 2 +-
 themes/base/jquery.ui.theme.css  | 1 +
 3 files changed, 8 insertions(+), 2 deletions(-)

(limited to 'demos')

diff --git a/demos/button/toolbar.html b/demos/button/toolbar.html
index eb1d2c3ea..5be3668f6 100644
--- a/demos/button/toolbar.html
+++ b/demos/button/toolbar.html
@@ -11,7 +11,12 @@
 	<link rel="stylesheet" href="../demos.css">
 	<style>
 	#toolbar {
-		padding: 10px 4px;
+		padding: 11px 4px 9px 4px;
+	}
+
+	/* support: IE7 */
+	*:first-child+html #toolbar {
+		padding: 4px 0px 4px 5px;
 	}
 	</style>
 	<script>
diff --git a/themes/base/jquery.ui.button.css b/themes/base/jquery.ui.button.css
index e0f91a82b..5588eb42c 100644
--- a/themes/base/jquery.ui.button.css
+++ b/themes/base/jquery.ui.button.css
@@ -42,7 +42,7 @@ button.ui-button-icons-only {
 
 /* button text element */
 .ui-button .ui-button-text {
-	display: block;
+	display: inline-block;
 	line-height: 1.4;
 }
 .ui-button-text-only .ui-button-text {
diff --git a/themes/base/jquery.ui.theme.css b/themes/base/jquery.ui.theme.css
index f1e4adf08..6388885c2 100644
--- a/themes/base/jquery.ui.theme.css
+++ b/themes/base/jquery.ui.theme.css
@@ -41,6 +41,7 @@
 	background: #cccccc/*{bgColorHeader}*/ url(images/ui-bg_highlight-soft_75_cccccc_1x100.png)/*{bgImgUrlHeader}*/ 50%/*{bgHeaderXPos}*/ 50%/*{bgHeaderYPos}*/ repeat-x/*{bgHeaderRepeat}*/;
 	color: #222222/*{fcHeader}*/;
 	font-weight: bold;
+	zoom: 1;
 }
 .ui-widget-header a { color: #222222/*{fcHeader}*/; }
 
-- 
cgit v1.2.3