fix(editor): give toolbar and picker buttons an explicit type

Toolbar and picker buttons are created as <button> elements with no type
attribute, so they default to type="submit". When a plugin rend

fix(editor): give toolbar and picker buttons an explicit type

Toolbar and picker buttons are created as <button> elements with no type
attribute, so they default to type="submit". When a plugin renders the
toolbar into a container inside its own form, clicking any button (e.g. a
smiley picker) submits that form. Set type="button" so the buttons never
trigger a submit.

show more ...

Harden media manager select callback (defense-in-depth)

The media manager popup derives the select callback name and the target
edit-field id from URL parameters (onselect, edid) and calls
opener[cb

Harden media manager select callback (defense-in-depth)

The media manager popup derives the select callback name and the target
edit-field id from URL parameters (onselect, edid) and calls
opener[cb](edid, ...). Tighten this handling:

- sanitize edid to word characters and hyphens
- strip all non-word characters from the callback name (global replace,
not just the first run)
- refuse to call anything that is not a page-script function, rejecting
browser/JS built-ins such as eval, Function, setTimeout and open

This is a precaution, not a fix for an exploitable vulnerability. In core
the popup is only ever opened by the trusted, same-origin editor, which
builds the URL itself and never sets onselect; a directly loaded popup has
no opener and a cross-origin opener is blocked by the same-origin policy,
so an attacker cannot reach the sink. The change removes the reliance on
that ambient browser protection and guards plugins that open the popup
with their own callback.

show more ...

Preserve edid and onselect across media manager search (#4608)

The media manager popup search reloads the whole page, dropping the
edid and onselect parameters that plugins (e.g. struct, prosemirror

Preserve edid and onselect across media manager search (#4608)

The media manager popup search reloads the whole page, dropping the
edid and onselect parameters that plugins (e.g. struct, prosemirror)
rely on to insert media and run their callback. Carry them over in the
search form action URL so they survive the reload, and match them in
media.js regardless of their position in the query string.

show more ...

(security) Require a security token for the lock AJAX call

The lock AJAX call refreshes the edit lock and saves a draft, both of
which change server state. It was gated only by the write ACL and,
un

(security) Require a security token for the lock AJAX call

The lock AJAX call refreshes the edit lock and saves a draft, both of
which change server state. It was gated only by the write ACL and,
unlike the sibling draft-delete call, did not verify a security token
(low severity).

A cross-site forged POST against a logged-in user could, within that
user's own write permissions, take or hold an edit lock and store
attacker-controlled draft content under their name.

The call now verifies the security token before taking the lock or
saving the draft. Logged out users are unaffected, as no token is
issued or checked for them. The edit lock timer now always sends the
token with its refresh request, including when draft saving is
disabled.

show more ...

fix(locktimer): reset lock timer on paste and other input events

The lock-timer handler was bound only to `keypress`, which fires for
character key presses but not for paste via right-click menu,
dr

fix(locktimer): reset lock timer on paste and other input events

The lock-timer handler was bound only to `keypress`, which fires for
character key presses but not for paste via right-click menu,
drag-and-drop, or other non-keyboard input methods. Users editing a
page solely by pasting could therefore lose their page lock after the
configured timeout despite active editing.

Switch the binding to the `input` event, which fires on every value
change of the textarea regardless of source (typing, paste via any
method, cut, drag-drop, undo/redo). This is a superset of the previous
behaviour, so no editing action regresses.

Fixes #3714

show more ...

fix: don't move the editor textarea into the toolbar

addBtnActionSignature() returns the edid (wiki__text) as its "pickerid"
so the signature button gets aria-controls set correctly. Since 7e35897a

fix: don't move the editor textarea into the toolbar

addBtnActionSignature() returns the edid (wiki__text) as its "pickerid"
so the signature button gets aria-controls set correctly. Since 7e35897a
that return value is also used to re-parent the element into the toolbar,
which pulled the textarea out of the edit form. Form submissions then
carried no wikitext, breaking preview and silently deleting the page on
save. Any plugin toolbar button registered after the signature button
(e.g. vshare) also ended up below the textarea instead of in the toolbar.

Skip the append when the returned id matches the editor id.

closes #4623

show more ...

fix: avoid picker close/reopen race on toggle button click

When focus was inside the picker and the toolbar toggle button was
clicked, focusout would close the picker before the click handler
toggle

fix: avoid picker close/reopen race on toggle button click

When focus was inside the picker and the toolbar toggle button was
clicked, focusout would close the picker before the click handler
toggled it, causing an immediate reopen. Skip the focusout-triggered
close when focus moves to a picker toggle button.

show more ...

fix code copy button copying its own text, closes #4617

Hide the button before reading innerText so the button label
is not included in the copied text.

close picker on focusout and escape

a11y: rm picker from tab order when hidden

effect on accesskey:

- firefox: works either way
- chrome: does not work either way

a11y: tweak picker aria attributes

inspired by https://github.com/twbs/bootstrap/pull/33624

a11y: move picker after the relevant button

fix: set aria-hidden in pickerClose()

replace size control icons by svg

do not wrap code blocks for copybutton #4534

Add copy-to-clipboard functionality to code blocks

add alt texts for size ctl images

wrap size ctl images in buttons

to make them keyboard-accessible

updated jquery and jquery-ui versions

register linkwizard in window

This fixes a backwards compatibility issue with the changes made in
PR #4329. Plugins rely on the wizard being a globally registered object.

LinkWizard: fix multilevel parents in references

use relative links in LinkWizard

When the linked page has a common prefix with the current page,
construct a relative link instead of always inserting absolute links.

LinkWizard: add method to create a relative link

This is not used, yet. Usage will be added in a future commit.

Since we don't have a proper testing framework in place, yet. Tests have
been added a

LinkWizard: add method to create a relative link

This is not used, yet. Usage will be added in a future commit.

Since we don't have a proper testing framework in place, yet. Tests have
been added as a standalone script that can be run manually.

show more ...

doc blocks in link wizard

Linkwizard: use strict comparisons