Prevent HTML and JS injection in section names

Before this change, HTML and some JS code (as far as it was not escaped
by json_encode) could be injected into the output as the closing pattern
that i

Prevent HTML and JS injection in section names

Before this change, HTML and some JS code (as far as it was not escaped
by json_encode) could be injected into the output as the closing pattern
that is checked by the regex is not escaped in JSON (see test case).

show more ...

fallback for new section editing. fixes #2311

The displayed message now shows the target that was passed, which should
help identifying the troubling plugin.

Instead of failing, we fix the data our

fallback for new section editing. fixes #2311

The displayed message now shows the target that was passed, which should
help identifying the troubling plugin.

Instead of failing, we fix the data ourselves - this code will be
removed in the future.

show more ...

Merge branch 'private_testing' into geshi_features

* private_testing: (375 commits)
make testing of inaccessible methods easier
updated composer dependencies
renamed ActionRouter::checkPermiss

Merge branch 'private_testing' into geshi_features

* private_testing: (375 commits)
make testing of inaccessible methods easier
updated composer dependencies
renamed ActionRouter::checkPermissions to checkPreconditions
shortened new search configs
Section edit: corrected pattern 'SEC_EDIT_PATTERN'
fix regex character class. fixes #2301
fix: switch extensions if stylesheet in style.ini doesn't exist
refactor: rename and move function to set $JSINFO
typo. capital P for class name
fix: add missing global $ACT for $JSINFO
refactor: use native json_encode for $JSINFO
refactor: rename JSINFO.DOKU_UHN and JSINFO.DOKU_UHC
refactor: extract $JSINFO initialization into tpl_ function
refactor: rename dta and dtb parameters
doc(search): parameter must be string or false
doc(search): highlight is expected to be an array
show adavanced tools with JavaScript only
adjusted language files to remove outdated string
removed sub header from all languages
added aria attributes
...

show more ...

Refactored section edit

The data for the section edit button is now passed as an assoziative array which is
encoded in the '#<!-- EDIT(.*) -->#' placeholder as an JSON array.

Merge pull request #2077 from schplurtz/vtt-tracks

Support Web Video Text Tracks Format subtitles

fix inconsistent use of rawurlencode

fix xhtml:internallink $params usage, fixes #2188
not perfect, but it works

protect strings that depend on uploaded file name

fix: fix regex to return table secedit buttons

Since the hid is optional, it must also be optional in the regex. Also
this commit introduced named capture groups to make it more obvious
which part o

fix: fix regex to return table secedit buttons

Since the hid is optional, it must also be optional in the regex. Also
this commit introduced named capture groups to make it more obvious
which part of the regex captures what.

Also there is now an explicit hid generated for tables, to enable
jumping to the correct section after finishing editing.

This was broken in 2571786c763e04c7abbf27c2245a5720878dc3f1 or #1966
respectively.

Known Issues:
* since both title and hid are optional, a hid may be misinterpreted as
a title if the title is not generated.

show more ...

use only language code, no language name

Merge pull request #1933 from splitbrain/actionrefactor

Action Dispatch Refactoring

Merge pull request #2089 from phy25/fix-2080

Fix rendering null $language going to GeSHi (fixes #2088)

Fix rendering null $language going to GeSHi (fixes #2088)

Merge pull request #2086 from phy25/fix-2081 CVE-2017-12980

Fix RSS syntax XSS bug (#2081)

Fix RSS syntax XSS bug (#2081)

Fix sanitation of $language for code highlighting (fixes #2080)

Support Web Video Text Tracks Format subtitles

Merge branch 'master' into actionrefactor

* master: (65 commits)
updated composer dependencies
Release preparation
translation update
do not disclose email or IP addresses of users through R

Merge branch 'master' into actionrefactor

* master: (65 commits)
updated composer dependencies
Release preparation
translation update
do not disclose email or IP addresses of users through RSS
small fix
Make default encapsulation more readable and less duplicate.
Replace htmlspecialchars to hsc in core
Add the preview-bool for the cache file.
Add htmlspecialchars when showing $DATE_AT
#2021 broken links to W3C validators also dokuwiki and php are on https
made bin/wantedpage.php more flexible
doc abbreviation
Fix PHP Notices: Reduce error log noise
Create valid empty options
translation update
doc fix
translation update
using $options->getCmd to retrieve show-pages parameter
added option to wantedpages.php to show or not show pages where broken links occur
show pages where broken links occur: page_id => broken_link
...

show more ...

Fix PHP Notices: Reduce error log noise

While DokuWiki suppresses PHP Notices they are still a code smell and
should be fixed. This fixes some PHP Notices that occurred.

Some of these fixes could b

Fix PHP Notices: Reduce error log noise

While DokuWiki suppresses PHP Notices they are still a code smell and
should be fixed. This fixes some PHP Notices that occurred.

Some of these fixes could be refactored into nicer code once we move to
PHP 7 and get access to the `??` operator.

show more ...

Added support for additional geshi options using an extendable options array.

always redirect to correct section

Across workflow 'show - sectionedit - save/cancel' explicitly
transmit header id to the server. So the server can always redirect to
the correct section even if he

always redirect to correct section

Across workflow 'show - sectionedit - save/cancel' explicitly
transmit header id to the server. So the server can always redirect to
the correct section even if headings have the same name. Fixes #1364.

show more ...

Merge pull request #1771 from splitbrain/blanktitles

fix problems with header that look falsy. fixes #1770

Merge pull request #1548 from splitbrain/fix-broken-js-in-xhtml

Fix broken JS in xhtml

misspelled foot

added table footer support to renderer

This allows plugins to easily render a <tfoot> element in a table, even
though it's not used in standard table syntax it makes sense to have it
available.