From 6cdca88eee674e48f9bf0e41fca18f75f32426b7 Mon Sep 17 00:00:00 2001 From: timmywil Date: Wed, 20 Jun 2012 16:22:36 -0400 Subject: Restore rhtmlString to its original form. 1.9 will come with starts-with html matching. For now, we are warning against broad use of jQuery() to parse html. --- src/core.js | 3 +-- test/unit/core.js | 10 +++++----- 2 files changed, 6 insertions(+), 7 deletions(-) diff --git a/src/core.js b/src/core.js index 1bf7e5603..c0113a190 100644 --- a/src/core.js +++ b/src/core.js @@ -41,8 +41,7 @@ var // A simple way to check for HTML strings // Prioritize #id over to avoid XSS via location.hash (#9521) - // Ignore html if within quotes "" '' or brackets/parens [] () - rhtmlString = /^(?:[^#<\\]*(<[\w\W]+>)(?![^\[]*\])(?![^\(]*\))(?![^']*')(?![^"]*")[^>]*$)/, + rhtmlString = /^(?:[^#<]*(<[\w\W]+>)[^>]*$)/, // Match a standalone tag rsingleTag = /^<(\w+)\s*\/?>(?:<\/\1>)?$/, diff --git a/test/unit/core.js b/test/unit/core.js index 0b392adf1..95f26fcbd 100644 --- a/test/unit/core.js +++ b/test/unit/core.js @@ -605,7 +605,7 @@ test("isWindow", function() { }); test("jQuery('html')", function() { - expect( 22 ); + expect( 18 ); QUnit.reset(); jQuery.foo = false; @@ -638,10 +638,10 @@ test("jQuery('html')", function() { ok( jQuery("
")[0], "Create a div with closing tag." ); ok( jQuery("
")[0], "Create a table with closing tag." ); - equal( jQuery("element[attribute='
']").length, 0, "When html is within brackets, do not recognize as html." ); - equal( jQuery("element[attribute=
]").length, 0, "When html is within brackets, do not recognize as html." ); - equal( jQuery("element:not(
)").length, 0, "When html is within parens, do not recognize as html." ); - equal( jQuery("\\").length, 0, "Ignore escaped html characters" ); + // equal( jQuery("element[attribute='
']").length, 0, "When html is within brackets, do not recognize as html." ); + // equal( jQuery("element[attribute=
]").length, 0, "When html is within brackets, do not recognize as html." ); + // equal( jQuery("element:not(
)").length, 0, "When html is within parens, do not recognize as html." ); + // equal( jQuery("\\").length, 0, "Ignore escaped html characters" ); // Test very large html string #7990 var i; -- cgit v1.2.3 alue='swistak'>swistak Mirror of redmine code source: https://github.com/redmine/redminewww-data
summaryrefslogtreecommitdiffstats
path: root/app/views/projects/new.html.erb
blob: a10cf15a9ae89a55fcc185a80bc6a2d7e7aeebbe (plain) 
1
2
3
4
5
6
7
8

<h2><%=l(:label_project_new)%></h2>

<% labelled_tabular_form_for :project, @project, :url => { :action => "create" } do |f| %>
<%= render :partial => 'form', :locals => { :f => f } %>
<%= submit_tag l(:button_create) %>
<%= submit_tag l(:button_create_and_continue), :name => 'continue' %>
<%= javascript_tag "Form.Element.focus('project_name');" %>
<% end %>