• last updated 5 hours ago
Constraints
Constraints: committers
 
Constraints: files
Constraints: dates
Ensure chat javascript is executed only when the chat itself is actually a part of the DOM

This may not be the case at the time of rendering, e.g. because the chat is rendered inside of a <template> tag and appended to the document at a later moment.

    • -2
    • +19
    ./packages/xowiki/tcl/chat-procs.tcl
JS upstream updates

- Updated upstream library to 11.4.0

- Bumped version to 0.5

    • -2
    • +2
    ./packages/highcharts/tcl/resource-procs.tcl
JS upstream updates

- Updated jquery-3.6.3 to jquery-3.7.1.

- Bumped version to 5.10.1b2

JS upstream updates

- Updated boostrap5 to 5.3.3

- Updated jquery-3.6.3 to jquery-3.7.1.

- Bumped version to 5.10.1b4

file jquery-3.7.1.js was initially added on branch oacs-5-10.

    • -0
    • +0
    ./packages/xowiki/www/resources/jquery/jquery-3.7.1.js
file jquery-3.7.1.min.js was initially added on branch oacs-5-10.

    • -0
    • +0
    ./packages/xowiki/www/resources/jquery/jquery-3.7.1.min.js
Untangle if logics

    • -23
    • +30
    ./packages/acs-tcl/tcl/text-html-procs.tcl
Reject URLs displaying multiple protocols

    • -1
    • +27
    ./packages/acs-tcl/tcl/text-html-procs.tcl
Test further improvement of injection attempt by penetration tests

Harden page contract

    • -2
    • +2
    ./packages/acs-subsite/www/permissions/one.tcl
Strenghten validation against smarter attempts to disguise the javascript: protocol

    • -10
    • +17
    ./packages/acs-tcl/tcl/text-html-procs.tcl
Replicate a smarter attempt by a penetration tool to disguise the javascript: protocol

    • -11
    • +24
    ./packages/acs-tcl/tcl/test/text-html-procs.tcl
Add new extension mjs, for Javascript modules, to the Javascript mime type

file upgrade-5.10.1b3-5.10.1b4.sql was initially added on branch oacs-5-10.

file upgrade-0.6.2d6-0.6.2d7.sql was initially added on branch oacs-5-10.

added missing function args

reduce verbosity

    • -4
    • +4
    ./packages/xotcl-core/tcl/05-db-procs.tcl
Harden page contracts

    • -2
    • +16
    ./packages/calendar/www/cal-item-new.tcl
    • -2
    • +2
    ./packages/calendar/www/cal-item-view.tcl
Prefer more robust colon notation to quote database values

We replace spaces with "&nbsp" for Safari, but then convert will fail in the test... clean up the entities before trying to convert

    • -1
    • +15
    ./packages/captcha/tcl/test/captcha-procs.tcl
Fix variable name

    • -2
    • +2
    ./packages/xowiki/tcl/xowiki-www-procs.tcl
Calculate the width before quoting is applied and refine the heuristic

    • -7
    • +7
    ./packages/captcha/tcl/captcha-procs.tcl
Fix capctha rendering on iOS devices, where apparently spaces need to be translated to entities

    • -3
    • +10
    ./packages/captcha/tcl/captcha-procs.tcl
Fix captcha responsiveness

    • -4
    • +4
    ./packages/captcha/tcl/captcha-procs.tcl
Update italian localization

    • -2
    • +2
    ./packages/acs-subsite/acs-subsite.info
Introduce server-side validation for HTML5 date and time formfields

A "formats" parameter can be specified on the formfields indicating one or more formats that we want to enforce. The syntax for any of such format is that of the Tcl clock command.

Default values have been set according to the expected behavior of each form field type.

Empty values are always considered valid. If a field is required, this will be enforced in its own validator.

    • -11
    • +69
    ./packages/xowiki/tcl/form-field-procs.tcl
Test behavior of HTML5 date and time formfields when invalid values are submitted

    • -0
    • +186
    ./packages/xowiki/tcl/test/xowiki-test-procs.tcl
Quote error message to better protect against XSS attacks

    • -2
    • +2
    ./packages/xotcl-core/tcl/context-procs.tcl
Added default dbn to database drivers (acs::dc)

Align behavior with recent change in the xo::db inteface

    • -5
    • +12
    ./packages/acs-tcl/tcl/acs-db-00-procs.tcl
Added parameter to define a default dbn to a database connection

By this change, one can now define a default dbn at the creation time

of a database connection object. Before, it was necessary to pass

the "-dbn" value to every single command. The parameter can still be

used for particular queries as before to overrule the default.

Example for defining a connection context to a pool named "legacy"

using the PostgreSQL database interface

::xo::db::DB-postgresql create ::xo::dc1 -dialect postgresql -dbn legacy

lappend _ [::xo::dc1 get_value . {select count(*) from acs_objects}]

lappend _ [::xo::dc get_value . {select count(*) from acs_objects}]

#> 660 51606

    • -10
    • +15
    ./packages/xotcl-core/tcl/05-db-procs.tcl