Mirror
/
zulip
mirror of https://github.com/zulip/zulip.git
1
0
Fork 0
Code Issues Projects Releases Wiki Activity
zulip/static/js
History
Tim Abbott 1207a08b36 CVE-2018-9987: Fix XSS issue with muting notifications. 
This fixes an XSS issue with Zulip's muting UI, where if a stream or
topic name contained malicious HTML containing JavaScript, and the
user did a muting interaction, the malicious JavaScript could run when
rendering the "you just muted a topic" notification.

We did an audit for similarly problematic use of `.html`, and found
none; for the next release we'll be merging a series of changes to our
linter to prevent future instances of this being added.

Thanks to Suhas Sunil Gaikwad for reporting this issue.
 		2018-04-12 09:46:03 -07:00
..
portico desktop-app: Update app to latest v1.9.0. 2018-03-30 13:14:10 -07:00
stats lint: Fix errors with stats.js with new eslint. 2018-04-06 12:42:19 -07:00
.eslintrc.json
…
activity.js right-sidebar: Enable up and down arrow keys. 2018-02-12 15:38:23 -08:00
admin.js org settings: Add labels as a context to admin templates. 2018-04-01 14:52:12 +05:30
admin_sections.js settings: Add support for adding/removing custom profile fields. 2018-03-29 13:59:16 -07:00
alert_words.js Highlight alert words in mentions you send to yourself. 2017-10-12 14:03:36 -07:00
alert_words_ui.js urls: Change the method for adding alert words from PUT to POST. 2017-09-26 14:00:51 -07:00
attachments_ui.js attachments_ui: Remove unnecessary export of bytes_to_size. 2018-03-15 18:06:04 -07:00
avatar.js user settings: Display avatar source. 2018-03-05 09:12:59 -08:00
blueslip.js lint: Replace 'return undefined;' with 'return;'. 2018-03-13 08:22:42 -04:00
bot_data.js bots: Delete bot from bot_data set on realm_bot delete event. 2018-03-08 07:54:19 -08:00
channel.js middleware: Use a proper error code on CSRF failure. 2017-07-25 14:02:12 -07:00
click_handlers.js Extract info_overlay.js. 2018-03-30 09:07:23 -07:00
colorspace.js
…
common.js lint: Replace 'return undefined;' with 'return;'. 2018-03-13 08:22:42 -04:00
components.js Fix recent pitfall in toggle component. 2018-04-04 16:37:39 -07:00
compose.js cleanup: Remove the legacy Dropbox file upload integration. 2018-04-11 11:39:48 -07:00
compose_actions.js compose: Fix fading when topic changes on re-narrow. 2018-04-05 15:21:02 -07:00
compose_fade.js stream_data.js: Replace user_email with user_id in func is_user_subscribed. 2018-04-08 16:54:12 -07:00
compose_pm_pill.js compose: Add pills for typing in PM recipients. 2018-03-07 15:53:11 -08:00
compose_state.js compose: Add pills for typing in PM recipients. 2018-03-07 15:53:11 -08:00
compose_ui.js message edit: Allow uploading files. 2018-03-05 10:42:38 -08:00
composebox_typeahead.js markdown: Add @stream as an alias for @all. 2018-04-09 16:35:14 -07:00
condense.js frontend: Simplify saving collapsed/uncollapsed flags. 2017-12-26 09:01:21 -05:00
copy_and_paste.js copy_and_paste: Re-disable copy-paste handler in production. 2018-04-09 22:10:28 -07:00
debug.js
…
dict.js lint: Replace 'return undefined;' with 'return;'. 2018-03-13 08:22:42 -04:00
drafts.js drafts: Fix same day's timestamp when language is other than english. 2018-03-14 10:57:11 -07:00
dynamic_text.js
…
echo.js Revert "Suppress local echo when we are not caught up." 2018-03-30 11:51:52 -07:00
emoji.js emoji: Do selective local echo of emoticon conversions. 2018-03-27 17:16:55 -07:00
emoji_picker.js Refactor perfect-scrollbar: Call ui methods in emoji_picker.js. 2018-03-16 12:47:44 -07:00
favicon.js lint: Ban two spaces after comma in JS code. 2017-10-18 10:22:18 -07:00
feature_flags.js cleanup: Remove the legacy Dropbox file upload integration. 2018-04-11 11:39:48 -07:00
fenced_code.js bugdown: Fix handling of nested fenced math blocks. 2017-11-22 12:19:43 -08:00
fetch_status.js Revert "Ignore new messages when lists are behind." 2018-03-30 11:52:14 -07:00
filter.js left sidebar: Change Home to All messages. 2017-11-28 15:42:58 -08:00
floating_recipient_bar.js Fix outerHeight to OR with 0 to not produce NaN. 2017-07-27 14:16:57 -07:00
gear_menu.js
…
hash_util.js Add stream ids to urls for stream-related narrows. 2018-02-19 09:03:11 -08:00
hashchange.js Extract info_overlay.js. 2018-03-30 09:07:23 -07:00
hotkey.js hotkeys: Replace C with x for composing PM. 2018-04-01 16:13:05 -07:00
hotspots.js hotspots: Fix real-time sync for dismissing hotspots. 2018-03-18 10:22:09 -07:00
info_overlay.js Fix keyboard handling for info overlays. 2018-04-04 16:37:39 -07:00
input_pill.js pills: Add exportable function for creating non-editable pills. 2018-04-05 17:40:12 -07:00
integration_bot_widget.js template context: Give better names to the URLs for the API. 2017-10-30 18:29:29 -07:00
invite.js invite: Update text of success message. 2017-12-19 17:46:36 -08:00
keydown_util.js Add keydown_util.js module. 2018-04-04 16:37:39 -07:00
lightbox.js lightbox: Add debugging code for unknown message IDs. 2018-03-23 15:17:21 -07:00
lightbox_canvas.js hotkeys: Add shortcuts for pan and zoom in lightbox view 2018-04-03 09:20:55 -07:00
list_render.js list_render: Add sorting reversal. 2017-11-01 13:26:40 -07:00
list_util.js
…
loading.js display_settings: Change success/failure feedback interface. 2018-03-04 17:47:05 -08:00
localstorage.js lint: Replace 'return undefined;' with 'return;'. 2018-03-13 08:22:42 -04:00
markdown.js markdown: Add @stream as an alias for @all. 2018-04-09 16:35:14 -07:00
message_edit.js clipboard: Update clipboard to v2.0.0 to avoid variable name conflict. 2018-04-05 15:09:00 -07:00
message_events.js messages: Make checking for status message consistent with backend. 2018-01-23 09:26:41 -05:00
message_fetch.js Fetch new messages when you scroll forward in narrows. 2018-03-28 09:12:59 -07:00
message_flags.js refactor: Rename mark_message(s)_as_read to notify_server_message(s)_read. 2018-04-05 09:54:48 -07:00
message_list.js message_list: Fix unnecessary work re-rendering all_msg_list. 2018-04-02 18:58:51 -07:00
message_list_view.js message_list_view: Add a workaround for Chrome scrolling down bug. 2018-03-27 13:51:28 -07:00
message_live_update.js message_live_update: Fix double re-rendering of home_msg_list. 2018-04-02 18:58:51 -07:00
message_scroll.js Fetch new messages when you scroll forward in narrows. 2018-03-28 09:12:59 -07:00
message_store.js refactor: Extract pm_conversations.recent. 2018-02-12 09:34:59 -08:00
message_util.js sending messages: Extract sent_messages.js. 2017-08-01 08:58:56 -07:00
message_viewport.js lint: Ban two spaces after comma in JS code. 2017-10-18 10:22:18 -07:00
muting.js
…
muting_ui.js CVE-2018-9987: Fix XSS issue with muting notifications. 2018-04-12 09:46:03 -07:00
narrow.js refactor: Rename mark_message(s)_as_read to notify_server_message(s)_read. 2018-04-05 09:54:48 -07:00
narrow_state.js lint: Replace 'return undefined;' with 'return;'. 2018-03-13 08:22:42 -04:00
navigate.js Have home key go to actual first message in the list. 2017-10-03 11:28:28 -07:00
night_mode.js styles: Rename dark-mode to night-mode. 2018-03-28 10:41:26 -07:00
notifications.js electron_bridge: Send unread count to electron app on update. 2018-03-09 14:12:33 -08:00
overlays.js settings: When overlay modal opens, remove previous alert messages. 2018-01-23 14:38:59 -05:00
panels.js notifications: Check if localstorage is enabled. 2018-03-18 12:54:11 -07:00
people.js people: Clean up now-unnecessary url variable. 2018-04-09 12:12:44 -07:00
pm_conversations.js Add pm_conversations.recent.get_strings(). 2018-02-12 09:34:59 -08:00
pm_list.js refactor: Extract pm_conversations.recent. 2018-02-12 09:34:59 -08:00
pointer.js refactor: Rename mark_message(s)_as_read to notify_server_message(s)_read. 2018-04-05 09:54:48 -07:00
popovers.js clipboard: Update clipboard to v2.0.0 to avoid variable name conflict. 2018-04-05 15:09:00 -07:00
presence.js presence: Change "unknown" to "offline". 2017-10-12 10:42:06 -07:00
reactions.js emoji: Migrate realm emoji to be addressed by `id` rather than `name`. 2018-03-20 22:24:44 -07:00
realm_icon.js
…
recent_senders.js recent senders: Use message ids instead of timestamps for sorting. 2018-02-08 18:39:10 -08:00
reload.js reload: Handle errors with compose_actions.start(). 2018-03-07 15:53:11 -08:00
resize.js condense: Re-condense all messages on window resize. 2018-03-27 09:53:45 -07:00
rows.js js: Remove a few spurious arguments. 2017-08-22 09:37:17 -07:00
rtl.js eslint: Add and enforce space-in-parens lint rule. 2017-10-06 12:36:59 -07:00
scroll_bar.js Refactor perfect-scrollbar: Call ui methods in scroll_bar.js. 2018-03-16 12:47:46 -07:00
search.js eslint: Add and enforce space-in-parens lint rule. 2017-10-06 12:36:59 -07:00
search_suggestion.js left sidebar: Change Home to All messages. 2017-11-28 15:42:58 -08:00
sent_messages.js urls: Move the report endpoints to be API-style routes. 2017-10-17 22:05:56 -07:00
server_events.js local echo: Bypass message.flags array. 2017-12-26 09:01:21 -05:00
server_events_dispatch.js custom fields: Clean custom fields to use existing defined function. 2018-04-12 09:40:09 -07:00
settings.js settings: Fix label for message_content_in_email_notifications. 2018-04-07 20:22:33 -07:00
settings_account.js custom fields: Fix error in rendering long textual custom fields. 2018-04-04 10:46:18 -07:00
settings_bots.js settings: Remove obsolete lines of code. 2018-03-30 16:07:53 +05:30
settings_display.js settings: Change save and discard button look and feel. 2018-04-05 21:49:12 -07:00
settings_emoji.js settings: Clean up repeating code in error callbacks. 2018-03-25 10:40:40 -07:00
settings_filters.js settings: Clean up repeating code in error callbacks. 2018-03-25 10:40:40 -07:00
settings_invites.js settings: Clean up repeating code in error callbacks. 2018-03-25 10:40:40 -07:00
settings_lab.js settings: Remove autoscroll_forever setting. 2018-01-02 10:35:49 -05:00
settings_muting.js
…
settings_notifications.js settings: Refactor to use pluck to extract `setting` attribute. 2018-03-27 18:01:03 -07:00
settings_org.js settings: Change save and discard button look and feel. 2018-04-05 21:49:12 -07:00
settings_profile_fields.js custom fields: Clean custom fields to use existing defined function. 2018-04-12 09:40:09 -07:00
settings_sections.js settings_ui: Move main function for new settings system to library code. 2018-03-04 18:26:27 -08:00
settings_streams.js stream settings: Make deactivate stream handler global. 2018-04-06 12:25:42 -07:00
settings_ui.js settings: Changed checkbox and close icons on settings. 2018-04-05 21:49:13 -07:00
settings_user_groups.js settings: Avoid duplicate form handlers. 2018-03-25 08:28:04 -07:00
settings_users.js settings_users: Fix sending queries to /json/bots endpoint. 2018-04-02 18:48:55 -07:00
setup.js Fix outerHeight to OR with 0 to not produce NaN. 2017-07-27 14:16:57 -07:00
socket.js local echo: Remove buggy restart-related code. 2017-07-18 12:03:16 -07:00
stream_color.js Revert "Make recipient bar styling more compact and clean." 2018-02-16 11:55:00 -08:00
stream_create.js stream_create: Finish handler cleanup. 2018-03-26 06:44:19 -04:00
stream_data.js subscription: Add real time sync for user-just-deactivated case. 2018-04-08 16:54:12 -07:00
stream_edit.js subscription: Show current user on top of subscribers list if present. 2018-04-11 09:54:42 -07:00
stream_events.js stream_data: Move calls to update_calculated_fields to events layer. 2018-03-09 18:00:31 -08:00
stream_list.js Refactor perfect-scrollbar: Call ui methods in stream_list.js. 2018-03-16 12:47:47 -07:00
stream_muting.js
…
stream_popover.js bankruptcy: Add UI widget to mark all messages as read. 2018-02-15 18:01:03 -08:00
stream_sort.js Fix issues with left-sidebar stream search and multiple words. 2017-09-15 00:22:59 -07:00
subs.js subscription: Show current user on top of subscribers list if present. 2018-04-11 09:54:42 -07:00
tab_bar.js left sidebar: Change Home to All messages. 2017-11-28 15:42:58 -08:00
templates.js
…
timerender.js drafts: Add timestamps showing when last modified. 2018-02-19 09:55:50 -08:00
top_left_corner.js Extract top_left_corner.js. 2017-08-14 13:03:57 -07:00
topic_data.js Add topic_data.get_server_history(). 2017-08-08 17:07:09 -04:00
topic_generator.js Add topic_generator.get_next_unread_pm_string(). 2018-02-12 09:34:59 -08:00
topic_list.js Refactor perfect-scrollbar: Call ui methods in topic_list.js. 2018-03-16 12:47:46 -07:00
translations.js i18n: Flag emojiset type name string for translation. 2018-02-22 05:36:03 -08:00
transmit.js websockets: Fix race condition in CSRF token initialization. 2018-03-31 09:29:56 -07:00
tutorial.js urls: Move the json/tutorial_status endpoint to be an API-style route. 2017-10-09 15:13:33 -07:00
typeahead_helper.js markdown: Add @stream as an alias for @all. 2018-04-09 16:35:14 -07:00
typing.js Add typing.initialize() to prevent tracebacks. 2018-03-16 09:23:23 -07:00
typing_data.js docs: Reorganize developer docs to improve navigation. 2017-11-16 09:45:08 -08:00
typing_events.js docs: Reorganize developer docs to improve navigation. 2017-11-16 09:45:08 -08:00
typing_status.js docs: Reorganize developer docs to improve navigation. 2017-11-16 09:45:08 -08:00
ui.js ui.js: Add minimum scrollbar length. 2018-04-02 10:48:28 -07:00
ui_init.js Extract info_overlay.js. 2018-03-30 09:07:23 -07:00
ui_report.js ui: Add ability to hide ui feedback messages. 2018-04-05 17:17:08 -07:00
ui_util.js ui_util: Move `place_caret_at_end` to ui_util module. 2018-01-23 15:00:11 -08:00
unread.js unread: Fix confusing aliasing of variable names. 2018-03-28 12:21:36 -07:00
unread_ops.js refactor: Rename mark_message(s)_as_read to notify_server_message(s)_read. 2018-04-05 09:54:48 -07:00
unread_ui.js bug: Show the count in the bankruptcy modal. 2017-08-17 23:30:41 -04:00
upload.js uploads: Fix the upload progress bar. 2018-04-09 22:53:06 -07:00
upload_widget.js settings ui: Restrict file type for image file pickers. 2017-10-27 10:21:36 -07:00
user_events.js custom profile data: Send event to active user on update. 2018-03-21 16:08:12 -07:00
user_groups.js user-groups: Update user_group_name_dict, when name/description is edited. 2018-03-15 10:09:28 -07:00
user_pill.js pills: Add exportable function for creating non-editable pills. 2018-04-05 17:40:12 -07:00
util.js markdown: Add @stream as an alias for @all. 2018-04-09 16:35:14 -07:00
zulip.js night-mode: Add custom CSS through JS. 2017-11-29 23:06:11 -08:00