mirrors/TiddlyWiki5
1
0
Fork 0
mirror of https://github.com/Jermolene/TiddlyWiki5 synced 2025-08-07 14:23:53 +00:00
Code Issues Releases Wiki Activity

Exclude attributes starting "on" on HTML elements

Browse Source 
Because:

* It doesn't work well with TW5's refresh mechanism, which relies on
being able to regenerate any portion of the DOM as required; this
frequently causes inline handlers to be re-executed at unexpected times
(see
http://tiddlywiki.com/static/TiddlyWiki%2520for%2520Developers.html)
* It mixes TW5 version-specific JavaScript with user content
* In multiuser environments there is a security risk to importing or
viewing tiddlers you didn't author if they can have JavaScript in them
This commit is contained in:
Jermolene 2014-03-12 16:39:18 +00:00
parent 0d18f3cc5d
commit d0caf21b2d
2 changed files with 10 additions and 3 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

4
core/modules/widgets/element.js
View File

@ -31,7 +31,7 @@ ElementWidget.prototype.render = function(parent,nextSibling) {
this.computeAttributes(); this.computeAttributes();
this.execute(); this.execute();
var domNode = this.document.createElementNS(this.namespace,this.parseTreeNode.tag); var domNode = this.document.createElementNS(this.namespace,this.parseTreeNode.tag);
this.assignAttributes(domNode); this.assignAttributes(domNode,{excludeEventAttributes: true});
parent.insertBefore(domNode,nextSibling); parent.insertBefore(domNode,nextSibling);
this.renderChildren(domNode,null); this.renderChildren(domNode,null);
this.domNodes.push(domNode); this.domNodes.push(domNode);
@ -65,7 +65,7 @@ ElementWidget.prototype.refresh = function(changedTiddlers) {
hasChangedAttributes = $tw.utils.count(changedAttributes) > 0; hasChangedAttributes = $tw.utils.count(changedAttributes) > 0;
if(hasChangedAttributes) { if(hasChangedAttributes) {
// Update our attributes // Update our attributes
this.assignAttributes(this.domNodes[0]); this.assignAttributes(this.domNodes[0],{excludeEventAttributes: true});
} }
return this.refreshChildren(changedTiddlers) || hasChangedAttributes; return this.refreshChildren(changedTiddlers) || hasChangedAttributes;
}; };

9
core/modules/widgets/widget.js
View File

@ -252,10 +252,17 @@ Widget.prototype.getAttribute = function(name,defaultText) {
/* /*
Assign the computed attributes of the widget to a domNode Assign the computed attributes of the widget to a domNode
options include:
excludeEventAttributes: ignores attributes whose name begins with "on"
*/ */
Widget.prototype.assignAttributes = function(domNode) { Widget.prototype.assignAttributes = function(domNode,options) {
options = options || {};
var self = this; var self = this;
$tw.utils.each(this.attributes,function(v,a) { $tw.utils.each(this.attributes,function(v,a) {
// Check exclusions
if(options.excludeEventAttributes && a.substr(0,2) === "on") {
v = undefined;
}
if(v !== undefined) { if(v !== undefined) {
// Setting certain attributes can cause a DOM error (eg xmlns on the svg element) // Setting certain attributes can cause a DOM error (eg xmlns on the svg element)
try { try {