I installed the rails_xss plugin, for
the main purpose of seeing what will
break with Rails 3.0 (where the behaviour
of the plugin is the default). I think
I've fixed everything, but let me know if you
see stuff that is HTML-escaped, which
shouldn't be.
As a side benefit, we now use Erubis,
rather than ERB, to render templates.
They tell me it's faster ...
Sanitizer should recognize HTML elements
and attributes.
New Allowed Elements:
article aside audio canvas command details
dialog figcaption figure footer header
hgroup mark meter nav progress rp rt ruby
section source summary time video war
(OK, audio and video were already there)
New Allowed Attributes:
autocomplete contenteditable contextmenu
draggable formaction icon low max min
open optimum pattern placeholder preload
pubdate required reversed spellcheck step
wrap
Attributes removed:
abbr charset loopcount loopend loopstart
noshade nowrap rev rules
Maruku supports @start and @reversed on
ordered lists. It doesn't seem to support
IALs on li elements, so you still can't
attach @value to an li.
This gets around a dreaded
in `load_missing_constant': Rack
is not missing constant Handler! (ArgumentError)
error in latest Ruby 1.9.2-dev. (Ruby
1.8.x doesn't seem to care.)
Monkey patch to prevent ActionCache from overriding
the correct content-type header, when serving cached
pages with a "." in the name. (Thanks to Jason Blevins)
Also sync with latest SVG-Edit.
Firefox was too lenient, in allowing
you to append nodes from another document to
the svg canvas. Use adoptNode(), to do things
right. (Google Chrome is more strict about this.)
Since itex's \begin{svg}...\end{svg} syntax allows
the client to pass arbitrary junk through the document,
we need to check that the result is well-formed.
Use a pluggable XML parser: nokogiri, if installed,
REXML otherwise.
Make use of a nonce for setting SVG-Edit IDs
option. By default, SVG-Edit behaves as before.
Calling svgCanvas.randomizeIds(true) gives our
behaviour, instead.
Also, sync with latest SVG-Edit (but disable,
for now, manual editing of IDs).
Since we can have several SVG-Edit graphics
on a page, SVG-Edit should assign unique IDs
to elements, and do so in a fashion that survives
re-editing.
To do this, we use a nonce, and record its value in
a custom se:nonce attribute on the <svg> element.
(Is there a better way?).
Also, preserve the custom se:connector attribute for
later editing purposes.
Most of the DOM manipulations can be done
before doing the AJAX call. This leaves
just the insertion of the MathML nodes in the
mrow for the AJAX callback function.
Also, make the stroke-width for the connector tool
default to 2.
Ajax is asynchronous. Need to
sanitize in the callback function,
NOT when adding <math> to the DOM.
Need to unescape text for itex editor
window (since JQuery seems to take care
an 'extra' round of escaping).
Make the AJAX endpoint configurable (this could still be
done better).
Use POST, rather than GET for the AJAX request, so that
we don't have to worry about overly-long equations.
