CalvinBackup/iD
1
0
Fork 0
mirror of https://github.com/FoggedLens/iD.git synced 2026-05-21 07:46:58 +02:00
Code Issues Packages Projects Releases Wiki Activity

prevent html injection in combobox dopdowns

Browse Source 
and use returned wikidata label language for html `lang` metadata
This commit is contained in:
Martin Raifer
2022-06-06 12:42:27 +02:00
parent b44c7e8741
commit 8f79932ab1
4 changed files with 17 additions and 15 deletions
Download Patch File Download Diff File Expand all files Collapse all files
modules/ui/fields/combo.js
+2 -2
View File
@@ -140,7 +140,7 @@ export function uiFieldCombo(field, context) {
key: v,
value: field.t('options.' + v, { default: v }),
title: v,
display: field.t.html('options.' + v, { default: v }),
display: field.t.append('options.' + v, { default: v }),
klass: field.hasTextForStringId('options.' + v) ? '' : 'raw-option'
};
});
@@ -206,7 +206,7 @@ export function uiFieldCombo(field, context) {
return {
key: k,
value: label,
display: field.t.html('options.' + k, { default: k }),
display: field.t.append('options.' + k, { default: k }),
title: d.title || label,
klass: field.hasTextForStringId('options.' + k) ? '' : 'raw-option'
};
modules/ui/fields/wikidata.js
+7 -3
View File
@@ -150,9 +150,13 @@ export function uiFieldWikidata(field, context) {
var result = data.map(function (item) {
return {
id: item.id,
value: item.label + ' (' + item.id + ')',
title: item.description,
id: item.id,
value: item.display.label.value + ' (' + item.id + ')',
display: selection => selection.append('span')
.attr('class', 'localized-text')
.attr('lang', item.display.label.language)
.text(item.display.label.value),
title: item.display.description && item.display.description.value,
terms: item.aliases
};
});