From b7c2e232885286298784e09648f8fd5fa90dcc3f Mon Sep 17 00:00:00 2001 From: Robin Rawson-Tetley Date: Thu, 8 Apr 2021 12:39:55 +0100 Subject: [PATCH] 44 release --- VERSION | 2 +- src/asm3/i18n.py | 4 +- src/static/pages/manual/_static/jquery.js | 80 +++++++++---------- src/static/pages/manual/_static/underscore.js | 23 +++++- 4 files changed, 61 insertions(+), 48 deletions(-) diff --git a/VERSION b/VERSION index 1b181b102..c739b42c4 100644 --- a/VERSION +++ b/VERSION @@ -1 +1 @@ -44u +44 diff --git a/src/asm3/i18n.py b/src/asm3/i18n.py index 99479e2b0..0bcfcc74f 100644 --- a/src/asm3/i18n.py +++ b/src/asm3/i18n.py @@ -6,8 +6,8 @@ # flake8: noqa - we have a lot of locales and this is convenient from asm3.locales import * -VERSION = "44u [Wed 7 Apr 08:33:29 BST 2021]" -BUILD = "04070833" +VERSION = "44 [Thu 8 Apr 12:24:26 BST 2021]" +BUILD = "04081224" DMY = ( "%d/%m/%Y", "%d/%m/%y" ) HDMY = ( "%d-%m-%Y", "%d-%m-%y" ) diff --git a/src/static/pages/manual/_static/jquery.js b/src/static/pages/manual/_static/jquery.js index 7e3291082..888a82f32 100644 --- a/src/static/pages/manual/_static/jquery.js +++ b/src/static/pages/manual/_static/jquery.js @@ -9,7 +9,7 @@ * Released under the MIT license * https://jquery.org/license * - * Date: 2019-04-19T06:52Z + * Date: 2021-03-09T19:42Z */ ( function( global, factory ) { @@ -4676,11 +4676,40 @@ var rscriptType = ( /^$|^module$|\/(?:java|ecma)script/i ); -// We have to close these tags to support XHTML (#13200) -var wrapMap = { +( function() { + var fragment = document.createDocumentFragment(), + div = fragment.appendChild( document.createElement( "div" ) ), + input = document.createElement( "input" ); + + // Support: Android 4.0 - 4.3 only + // Check state lost if the name is set (#11217) + // Support: Windows Web Apps (WWA) + // `name` and `type` must use .setAttribute for WWA (#14901) + input.setAttribute( "type", "radio" ); + input.setAttribute( "checked", "checked" ); + input.setAttribute( "name", "t" ); + + div.appendChild( input ); + + // Support: Android <=4.1 only + // Older WebKit doesn't clone checked state correctly in fragments + support.checkClone = div.cloneNode( true ).cloneNode( true ).lastChild.checked; + + // Support: IE <=11 only + // Make sure textarea (and checkbox) defaultValue is properly cloned + div.innerHTML = ""; + support.noCloneChecked = !!div.cloneNode( true ).lastChild.defaultValue; // Support: IE <=9 only - option: [ 1, "" ], + // IE <=9 replaces "; + support.option = !!div.lastChild; +} )(); + + +// We have to close these tags to support XHTML (#13200) +var wrapMap = { // XHTML parsers do not magically insert elements in the // same way that tag soup parsers do. So we cannot shorten @@ -4693,12 +4722,14 @@ var wrapMap = { _default: [ 0, "", "" ] }; -// Support: IE <=9 only -wrapMap.optgroup = wrapMap.option; - wrapMap.tbody = wrapMap.tfoot = wrapMap.colgroup = wrapMap.caption = wrapMap.thead; wrapMap.th = wrapMap.td; +// Support: IE <=9 only +if ( !support.option ) { + wrapMap.optgroup = wrapMap.option = [ 1, "" ]; +} + function getAll( context, tag ) { @@ -4829,32 +4860,6 @@ function buildFragment( elems, context, scripts, selection, ignored ) { return fragment; } - - -( function() { - var fragment = document.createDocumentFragment(), - div = fragment.appendChild( document.createElement( "div" ) ), - input = document.createElement( "input" ); - - // Support: Android 4.0 - 4.3 only - // Check state lost if the name is set (#11217) - // Support: Windows Web Apps (WWA) - // `name` and `type` must use .setAttribute for WWA (#14901) - input.setAttribute( "type", "radio" ); - input.setAttribute( "checked", "checked" ); - input.setAttribute( "name", "t" ); - - div.appendChild( input ); - - // Support: Android <=4.1 only - // Older WebKit doesn't clone checked state correctly in fragments - support.checkClone = div.cloneNode( true ).cloneNode( true ).lastChild.checked; - - // Support: IE <=11 only - // Make sure textarea (and checkbox) defaultValue is properly cloned - div.innerHTML = ""; - support.noCloneChecked = !!div.cloneNode( true ).lastChild.defaultValue; -} )(); var documentElement = document.documentElement; @@ -5591,13 +5596,6 @@ jQuery.fn.extend( { var - /* eslint-disable max-len */ - - // See https://github.com/eslint/eslint/issues/3229 - rxhtmlTag = /<(?!area|br|col|embed|hr|img|input|link|meta|param)(([a-z][^\/\0>\x20\t\r\n\f]*)[^>]*)\/>/gi, - - /* eslint-enable */ - // Support: IE <=10 - 11, Edge 12 - 13 only // In IE/Edge using regex groups here causes severe slowdowns. // See https://connect.microsoft.com/IE/feedback/details/1736512/ @@ -5794,7 +5792,7 @@ function remove( elem, selector, keepData ) { jQuery.extend( { htmlPrefilter: function( html ) { - return html.replace( rxhtmlTag, "<$1>" ); + return html; }, clone: function( elem, dataAndEvents, deepDataAndEvents ) { diff --git a/src/static/pages/manual/_static/underscore.js b/src/static/pages/manual/_static/underscore.js index 8219dc508..709ae8e30 100644 --- a/src/static/pages/manual/_static/underscore.js +++ b/src/static/pages/manual/_static/underscore.js @@ -1550,6 +1550,13 @@ return '\\' + escapes[match]; }; + // In order to prevent third-party code injection through + // `_.templateSettings.variable`, we test it against the following regular + // expression. It is intentionally a bit more liberal than just matching valid + // identifiers, but still prevents possible loopholes through defaults or + // destructuring assignment. + var bareIdentifier = /^\s*(\w|\$)+\s*$/; + // JavaScript micro-templating, similar to John Resig's implementation. // Underscore templating handles arbitrary delimiters, preserves whitespace, // and correctly escapes quotes within interpolated code. @@ -1585,8 +1592,17 @@ }); source += "';\n"; - // If a variable is not specified, place data values in local scope. - if (!settings.variable) source = 'with(obj||{}){\n' + source + '}\n'; + var argument = settings.variable; + if (argument) { + // Insure against third-party code injection. + if (!bareIdentifier.test(argument)) throw new Error( + 'variable is not a bare identifier: ' + argument + ); + } else { + // If a variable is not specified, place data values in local scope. + source = 'with(obj||{}){\n' + source + '}\n'; + argument = 'obj'; + } source = "var __t,__p='',__j=Array.prototype.join," + "print=function(){__p+=__j.call(arguments,'');};\n" + @@ -1594,7 +1610,7 @@ var render; try { - render = new Function(settings.variable || 'obj', '_', source); + render = new Function(argument, '_', source); } catch (e) { e.source = source; throw e; @@ -1605,7 +1621,6 @@ }; // Provide the compiled source as a convenience for precompilation. - var argument = settings.variable || 'obj'; template.source = 'function(' + argument + '){\n' + source + '}'; return template;