From 8cf115081e7a168eb3f3c74b279dac7f4e258287 Mon Sep 17 00:00:00 2001 From: cash Date: Thu, 10 Nov 2011 21:24:47 -0500 Subject: Fixes #4010 not sending naked query strings into add ajax tokens and also fixed a few related bugs in JavaScript --- js/lib/ajax.js | 6 ++++- js/lib/elgglib.js | 68 +++++++++++------------------------------------------- js/lib/security.js | 18 +++++++-------- 3 files changed, 28 insertions(+), 64 deletions(-) (limited to 'js/lib') diff --git a/js/lib/ajax.js b/js/lib/ajax.js index 6f6ae052f..b3f39cc42 100644 --- a/js/lib/ajax.js +++ b/js/lib/ajax.js @@ -187,7 +187,11 @@ elgg.action = function(action, options) { options = elgg.ajax.handleOptions(action, options); - options.data = elgg.security.addToken(options.data); + // This is a misuse of elgg.security.addToken() because it is not always a + // full query string with a ?. As such we need a special check for the tokens. + if (!elgg.isString(options.data) || options.data.indexOf('__elgg_ts') == -1) { + options.data = elgg.security.addToken(options.data); + } options.dataType = 'json'; //Always display system messages after actions diff --git a/js/lib/elgglib.js b/js/lib/elgglib.js index ca7914e7c..81209ebd0 100644 --- a/js/lib/elgglib.js +++ b/js/lib/elgglib.js @@ -410,16 +410,6 @@ elgg.parse_url = function(url, component, expand) { // fragment + '(?:#(.*))?)', keys = { - 'mailto': { - 4: "scheme", - 5: "user", - 6: "host", - 9: "path", - 12: "query", - 13: "fragment" - }, - - 'standard': { 1: "scheme", 4: "user", 5: "pass", @@ -428,58 +418,28 @@ elgg.parse_url = function(url, component, expand) { 9: "path", 12: "query", 13: "fragment" - } }, - results = {}, - match_keys, - is_mailto = false; + results = {}; - var re = new RegExp(re_str); - var matches = re.exec(url); - - // if the scheme field is undefined it means we're using a protocol - // without :// and an @. Feel free to fix this in the re if you can >:O - if (matches[1] == undefined) { - match_keys = keys['mailto']; - is_mailto = true; - } else { - match_keys = keys['standard']; + if (url.indexOf('mailto:') === 0) { + results['scheme'] = 'mailto'; + results['path'] = url.replace('mailto:', ''); + return results; } - for (var i in match_keys) { - if (matches[i]) { - results[match_keys[i]] = matches[i]; - } + if (url.indexOf('javascript:') === 0) { + results['scheme'] = 'javascript'; + results['path'] = url.replace('javascript:', ''); + return results; } - // merge everything to path if not standard - if (is_mailto) { - var path = '', - new_results = {}; - - if (typeof(results['user']) != 'undefined' && typeof(results['host']) != 'undefined') { - path = results['user'] + '@' + results['host']; - delete results['user']; - delete results['host']; - } else if (typeof(results['user'])) { - path = results['user']; - delete results['user']; - } else if (typeof(results['host'])) { - path = results['host']; - delete results['host']; - } - - if (typeof(results['path']) != 'undefined') { - results['path'] = path + results['path']; - } else { - results['path'] = path; - } + var re = new RegExp(re_str); + var matches = re.exec(url); - for (var prop in results) { - new_results[prop] = results[prop]; + for (var i in keys) { + if (matches[i]) { + results[keys[i]] = matches[i]; } - - results = new_results; } if (expand && typeof(results['query']) != 'undefined') { diff --git a/js/lib/security.js b/js/lib/security.js index 726c6b767..61aa1cfcd 100644 --- a/js/lib/security.js +++ b/js/lib/security.js @@ -60,7 +60,7 @@ elgg.security.refreshToken = function() { /** - * Add elgg action tokens to an object, URL, or query string. + * Add elgg action tokens to an object, URL, or query string (with a ?). * * @param {Object|string} data * @return {Object} The new data object including action tokens @@ -75,17 +75,17 @@ elgg.security.addToken = function(data) { args = {}, base = ''; - if (parts['host'] == data) { - if (data.indexOf('=') > -1) { + if (parts['host'] == undefined) { + if (data.indexOf('?') === 0) { // query string - args = elgg.parse_str(data); - } else { - // relative URL - base = data + '?'; + base = '?'; + args = elgg.parse_str(parts['query']); } } else { - // a URL - if (typeof parts['query'] != 'undefined') { + // full or relative URL + + if (parts['query'] != undefined) { + // with query string args = elgg.parse_str(parts['query']); } var split = data.split('?'); -- cgit v1.2.3 From fbbed3deaa0090173d398587cfea4af144d062a2 Mon Sep 17 00:00:00 2001 From: Cash Costello Date: Tue, 15 Nov 2011 20:03:52 -0500 Subject: atleast renaming the ui js libs --- engine/lib/elgglib.php | 8 +-- js/lib/autocomplete.js | 14 ------ js/lib/avatar_cropper.js | 76 ---------------------------- js/lib/friends_picker.js | 91 ---------------------------------- js/lib/ui.autocomplete.js | 14 ++++++ js/lib/ui.avatar_cropper.js | 76 ++++++++++++++++++++++++++++ js/lib/ui.friends_picker.js | 91 ++++++++++++++++++++++++++++++++++ js/lib/ui.userpicker.js | 117 ++++++++++++++++++++++++++++++++++++++++++++ js/lib/userpicker.js | 117 -------------------------------------------- 9 files changed, 302 insertions(+), 302 deletions(-) delete mode 100644 js/lib/autocomplete.js delete mode 100644 js/lib/avatar_cropper.js delete mode 100644 js/lib/friends_picker.js create mode 100644 js/lib/ui.autocomplete.js create mode 100644 js/lib/ui.avatar_cropper.js create mode 100644 js/lib/ui.friends_picker.js create mode 100644 js/lib/ui.userpicker.js delete mode 100644 js/lib/userpicker.js (limited to 'js/lib') diff --git a/engine/lib/elgglib.php b/engine/lib/elgglib.php index 47ca157e1..08b346960 100644 --- a/engine/lib/elgglib.php +++ b/engine/lib/elgglib.php @@ -2048,12 +2048,12 @@ function elgg_init() { elgg_register_page_handler('css', 'elgg_css_page_handler'); elgg_register_page_handler('ajax', 'elgg_ajax_page_handler'); - elgg_register_js('elgg.autocomplete', 'js/lib/autocomplete.js'); + elgg_register_js('elgg.autocomplete', 'js/lib/ui.autocomplete.js'); elgg_register_js('jquery.ui.autocomplete.html', 'vendors/jquery/jquery.ui.autocomplete.html.js'); - elgg_register_js('elgg.userpicker', 'js/lib/userpicker.js'); - elgg_register_js('elgg.friendspicker', 'js/lib/friends_picker.js'); + elgg_register_js('elgg.userpicker', 'js/lib/ui.userpicker.js'); + elgg_register_js('elgg.friendspicker', 'js/lib/ui.friends_picker.js'); elgg_register_js('jquery.easing', 'vendors/jquery/jquery.easing.1.3.packed.js'); - elgg_register_js('elgg.avatar_cropper', 'js/lib/avatar_cropper.js'); + elgg_register_js('elgg.avatar_cropper', 'js/lib/ui.avatar_cropper.js'); elgg_register_js('jquery.imgareaselect', 'vendors/jquery/jquery.imgareaselect-0.9.8/scripts/jquery.imgareaselect.min.js'); elgg_register_css('jquery.imgareaselect', 'vendors/jquery/jquery.imgareaselect-0.9.8/css/imgareaselect-deprecated.css'); diff --git a/js/lib/autocomplete.js b/js/lib/autocomplete.js deleted file mode 100644 index 46d72d146..000000000 --- a/js/lib/autocomplete.js +++ /dev/null @@ -1,14 +0,0 @@ -/** - * - */ -elgg.provide('elgg.autocomplete'); - -elgg.autocomplete.init = function() { - $('.elgg-input-autocomplete').autocomplete({ - source: elgg.autocomplete.url, //gets set by input/autocomplete view - minLength: 2, - html: "html" - }) -}; - -elgg.register_hook_handler('init', 'system', elgg.autocomplete.init); \ No newline at end of file diff --git a/js/lib/avatar_cropper.js b/js/lib/avatar_cropper.js deleted file mode 100644 index fc32a0832..000000000 --- a/js/lib/avatar_cropper.js +++ /dev/null @@ -1,76 +0,0 @@ -/** - * Avatar cropping - */ - -elgg.provide('elgg.avatarCropper'); - -/** - * Register the avatar cropper. - * - * If the hidden inputs have the coordinates from a previous cropping, begin - * the selection and preview with that displayed. - */ -elgg.avatarCropper.init = function() { - var params = { - selectionOpacity: 0, - aspectRatio: '1:1', - onSelectEnd: elgg.avatarCropper.selectChange, - onSelectChange: elgg.avatarCropper.preview - }; - - if ($('input[name=x2]').val()) { - params.x1 = $('input[name=x1]').val(); - params.x2 = $('input[name=x2]').val(); - params.y1 = $('input[name=y1]').val(); - params.y2 = $('input[name=y2]').val(); - } - - $('#user-avatar-cropper').imgAreaSelect(params); - - if ($('input[name=x2]').val()) { - var ias = $('#user-avatar-cropper').imgAreaSelect({instance: true}); - var selection = ias.getSelection(); - elgg.avatarCropper.preview($('#user-avatar-cropper'), selection); - } -}; - -/** - * Handler for changing select area. - * - * @param {Object} reference to the image - * @param {Object} imgareaselect selection object - * @return void - */ -elgg.avatarCropper.preview = function(img, selection) { - // catch for the first click on the image - if (selection.width == 0 || selection.height == 0) { - return; - } - - var origWidth = $("#user-avatar-cropper").width(); - var origHeight = $("#user-avatar-cropper").height(); - var scaleX = 100 / selection.width; - var scaleY = 100 / selection.height; - $('#user-avatar-preview > img').css({ - width: Math.round(scaleX * origWidth) + 'px', - height: Math.round(scaleY * origHeight) + 'px', - marginLeft: '-' + Math.round(scaleX * selection.x1) + 'px', - marginTop: '-' + Math.round(scaleY * selection.y1) + 'px' - }); -}; - -/** - * Handler for updating the form inputs after select ends - * - * @param {Object} reference to the image - * @param {Object} imgareaselect selection object - * @return void - */ -elgg.avatarCropper.selectChange = function(img, selection) { - $('input[name=x1]').val(selection.x1); - $('input[name=x2]').val(selection.x2); - $('input[name=y1]').val(selection.y1); - $('input[name=y2]').val(selection.y2); -}; - -elgg.register_hook_handler('init', 'system', elgg.avatarCropper.init); \ No newline at end of file diff --git a/js/lib/friends_picker.js b/js/lib/friends_picker.js deleted file mode 100644 index 9257c40fc..000000000 --- a/js/lib/friends_picker.js +++ /dev/null @@ -1,91 +0,0 @@ -/* - elgg friendsPicker plugin - adapted from Niall Doherty's excellent Coda-Slider - http://www.ndoherty.com/coda-slider - */ - - -jQuery.fn.friendsPicker = function(iterator) { - - var settings; - settings = $.extend({ easeFunc: "easeOutExpo", easeTime: 1000, toolTip: false }, settings); - - return this.each(function() { - - var container = $(this); - container.addClass("friends-picker"); - // set panelwidth manually as it's hidden initially - adjust this value for different themes/pagewidths - var panelWidth = 730; - - // count the panels in the container - var panelCount = container.find("div.panel").size(); - // calculate the width of all the panels lined up end-to-end - var friendsPicker_containerWidth = panelWidth*panelCount; - // specify width for the friendsPicker_container - container.find("div.friends-picker-container").css("width" , friendsPicker_containerWidth); - - // global variables for container.each function below - var friendsPickerNavigationWidth = 0; - var currentPanel = 1; - - // generate appropriate nav for each container - container.each(function(i) { - // generate Left and Right arrows - $(this).before("
Left<\/div>"); - $(this).after("
Right<\/div>"); - - // generate a-z tabs - $(this).before("