mirror_css/bootstrap
1
0
Fork 0
mirror of https://github.com/twbs/bootstrap.git synced 2025-08-20 20:31:26 +02:00
Code Issues Releases Wiki Activity

add html option back to tooltip and popover to explicitly prevent XSS #3421

Browse Source
This commit is contained in:
Jacob Thornton
2012-06-02 17:55:10 -07:00
parent fc96bc8bba
commit f836473129
8 changed files with 37 additions and 37 deletions
Download Patch File Download Diff File Expand all files Collapse all files

4
js/bootstrap-popover.js vendored
View File

@@ -43,8 +43,8 @@
, title = this.getTitle()
, content = this.getContent()
$tip.find('.popover-title')[this.isHTML(title) ? 'html' : 'text'](title)
$tip.find('.popover-content > *')[this.isHTML(content) ? 'html' : 'text'](content)
$tip.find('.popover-title')[this.options.html ? 'html' : 'text'](title)
$tip.find('.popover-content > *')[this.options.html ? 'html' : 'text'](content)
$tip.removeClass('fade top bottom left right in')
}

12
js/bootstrap-tooltip.js vendored
View File

@@ -148,20 +148,11 @@
}
}
, isHTML: function(text) {
// html string detection logic adapted from jQuery
return typeof text != 'string'
|| ( text.charAt(0) === "<"
&& text.charAt( text.length - 1 ) === ">"
&& text.length >= 3
) || /^(?:[^<]*<[\w\W]+>[^>]*$)/.exec(text)
}
, setContent: function () {
var $tip = this.tip()
, title = this.getTitle()
$tip.find('.tooltip-inner')[this.isHTML(title) ? 'html' : 'text'](title)
$tip.find('.tooltip-inner')[this.options.html ? 'html' : 'text'](title)
$tip.removeClass('fade in top bottom left right')
}
@@ -270,6 +261,7 @@
, trigger: 'hover'
, title: ''
, delay: 0
, html: true
}
}(window.jQuery);