From 4e174ae3bcd2a9bc75a62df0f1b6973ee0dc521d Mon Sep 17 00:00:00 2001 From: dtbuild Date: Wed, 10 Apr 2024 15:50:16 +0000 Subject: [PATCH] c02a88c3882a49f96f422743e43382586ef12c3e Fix: Potential XSS for HTML in a state name Sync to source repo @c02a88c3882a49f96f422743e43382586ef12c3e --- datatables.json | 2 +- js/StateRestore.js | 20 +++++++++++++++-- js/StateRestoreCollection.js | 8 +++---- js/dataTables.stateRestore.js | 36 +++++++++++++++++++++--------- js/dataTables.stateRestore.min.js | 2 +- js/dataTables.stateRestore.min.mjs | 4 ++-- js/dataTables.stateRestore.mjs | 36 +++++++++++++++++++++--------- js/index.js | 8 +++---- 8 files changed, 82 insertions(+), 34 deletions(-) diff --git a/datatables.json b/datatables.json index aa5e5c2..97a71c0 100644 --- a/datatables.json +++ b/datatables.json @@ -18,5 +18,5 @@ ], "src-repo": "http://github.com/DataTables/StateRestore", "last-tag": "1.4.0", - "last-sync": "04ce891c83e54ac114ad999d3ae09a6939a91a18" + "last-sync": "c02a88c3882a49f96f422743e43382586ef12c3e" } \ No newline at end of file diff --git a/js/StateRestore.js b/js/StateRestore.js index 6350725..23a35b9 100644 --- a/js/StateRestore.js +++ b/js/StateRestore.js @@ -45,7 +45,7 @@ var StateRestore = /** @class */ (function () { removeContents: $('
' + this.s.dt .i18n('stateRestore.removeConfirm', this.c.i18n.removeConfirm) - .replace(/%s/g, this.s.identifier) + + .replace(/%s/g, StateRestore.entityEncode(this.s.identifier)) + '
'), removeError: $('' + this.s.dt.i18n('stateRestore.removeError', this.c.i18n.removeError) + @@ -57,7 +57,7 @@ var StateRestore = /** @class */ (function () { '' + ''), renameInput: $(''), @@ -525,6 +525,22 @@ var StateRestore = /** @class */ (function () { this.c.ajax.call(this.s.dt, ajaxData, successCallback); } }; + /** + * Encode HTML entities + * + * @param d String to encode + * @returns Encoded string + * @todo When DT1 support is dropped, switch to using `DataTable.util.escapeHtml` + */ + StateRestore.entityEncode = function (d) { + return typeof d === 'string' ? + d + .replace(/&/g, '&') + .replace(//g, '>') + .replace(/"/g, '"') : + d; + }; /** * Performs a deep compare of two state objects, returning true if they match * diff --git a/js/StateRestoreCollection.js b/js/StateRestoreCollection.js index 7cf3f81..fcde135 100644 --- a/js/StateRestoreCollection.js +++ b/js/StateRestoreCollection.js @@ -525,8 +525,8 @@ var StateRestoreCollection = /** @class */ (function () { split: split }, extend: 'stateRestore', - text: state.s.identifier, - popoverTitle: state.s.identifier + text: StateRestore.entityEncode(state.s.identifier), + popoverTitle: StateRestore.entityEncode(state.s.identifier) }); } } @@ -876,8 +876,8 @@ var StateRestoreCollection = /** @class */ (function () { var keys = Object.keys(localStorage); var _loop_2 = function (key) { // eslint-disable-next-line no-useless-escape - if (key.match(new RegExp('^DataTables_stateRestore_.*_' + location.pathname.replace(/\//g, '/') + '$')) || - key.match(new RegExp('^DataTables_stateRestore_.*_' + location.pathname.replace(/\//g, '/') + + if (key.match(new RegExp('^DataTables_stateRestore_.*_' + location.pathname + '$')) || + key.match(new RegExp('^DataTables_stateRestore_.*_' + location.pathname + '_' + this_2.s.dt.table().node().id + '$'))) { var loadedState_1 = JSON.parse(localStorage.getItem(key)); if (loadedState_1.stateRestore.isPreDefined || diff --git a/js/dataTables.stateRestore.js b/js/dataTables.stateRestore.js index afc09f6..2cde061 100644 --- a/js/dataTables.stateRestore.js +++ b/js/dataTables.stateRestore.js @@ -98,7 +98,7 @@ var DataTable = $.fn.dataTable; removeContents: $$2('
' + this.s.dt .i18n('stateRestore.removeConfirm', this.c.i18n.removeConfirm) - .replace(/%s/g, this.s.identifier) + + .replace(/%s/g, StateRestore.entityEncode(this.s.identifier)) + '
'), removeError: $$2('' + this.s.dt.i18n('stateRestore.removeError', this.c.i18n.removeError) + @@ -110,7 +110,7 @@ var DataTable = $.fn.dataTable; '' + ''), renameInput: $$2(''), @@ -578,6 +578,22 @@ var DataTable = $.fn.dataTable; this.c.ajax.call(this.s.dt, ajaxData, successCallback); } }; + /** + * Encode HTML entities + * + * @param d String to encode + * @returns Encoded string + * @todo When DT1 support is dropped, switch to using `DataTable.util.escapeHtml` + */ + StateRestore.entityEncode = function (d) { + return typeof d === 'string' ? + d + .replace(/&/g, '&') + .replace(//g, '>') + .replace(/"/g, '"') : + d; + }; /** * Performs a deep compare of two state objects, returning true if they match * @@ -1360,8 +1376,8 @@ var DataTable = $.fn.dataTable; split: split }, extend: 'stateRestore', - text: state.s.identifier, - popoverTitle: state.s.identifier + text: StateRestore.entityEncode(state.s.identifier), + popoverTitle: StateRestore.entityEncode(state.s.identifier) }); } } @@ -1711,8 +1727,8 @@ var DataTable = $.fn.dataTable; var keys = Object.keys(localStorage); var _loop_2 = function (key) { // eslint-disable-next-line no-useless-escape - if (key.match(new RegExp('^DataTables_stateRestore_.*_' + location.pathname.replace(/\//g, '/') + '$')) || - key.match(new RegExp('^DataTables_stateRestore_.*_' + location.pathname.replace(/\//g, '/') + + if (key.match(new RegExp('^DataTables_stateRestore_.*_' + location.pathname + '$')) || + key.match(new RegExp('^DataTables_stateRestore_.*_' + location.pathname + '_' + this_2.s.dt.table().node().id + '$'))) { var loadedState_1 = JSON.parse(localStorage.getItem(key)); if (loadedState_1.stateRestore.isPreDefined || @@ -2159,8 +2175,8 @@ var DataTable = $.fn.dataTable; split: split }, extend: 'stateRestore', - text: state.s.identifier, - popoverTitle: state.s.identifier + text: StateRestore.entityEncode(state.s.identifier), + popoverTitle: StateRestore.entityEncode(state.s.identifier) }); } dt.button('SaveStateRestore:name').collectionRebuild(stateButtons); @@ -2306,8 +2322,8 @@ var DataTable = $.fn.dataTable; split: split }, extend: 'stateRestore', - text: state.s.identifier, - popoverTitle: state.s.identifier + text: StateRestore.entityEncode(state.s.identifier), + popoverTitle: StateRestore.entityEncode(state.s.identifier) }); } } diff --git a/js/dataTables.stateRestore.min.js b/js/dataTables.stateRestore.min.js index b2e0687..80c6af3 100644 --- a/js/dataTables.stateRestore.min.js +++ b/js/dataTables.stateRestore.min.js @@ -1,4 +1,4 @@ /*! StateRestore 1.4.0 * © SpryMedia Ltd - datatables.net/license */ -!function(s){var o,i;"function"==typeof define&&define.amd?define(["jquery","datatables.net"],function(e){return s(e,window,document)}):"object"==typeof exports?(o=require("jquery"),i=function(e,t){t.fn.dataTable||require("datatables.net")(e,t)},"undefined"==typeof window?module.exports=function(e,t){return e=e||window,t=t||o(e),i(e,t),s(t,0,e.document)}:(i(window,o),module.exports=s(o,window,window.document))):s(jQuery,window,document)}(function(y,e,g){"use strict";var u,m,f,a,p,s,t,c=y.fn.dataTable;function n(e,t,s,o,i,a){if(void 0===o&&(o=void 0),void 0===i&&(i=!1),void 0===a&&(a=function(){return null}),!m||!m.versionCheck||!m.versionCheck("1.10.0"))throw new Error("StateRestore requires DataTables 1.10 or newer");if(!m.Buttons)throw new Error("StateRestore requires Buttons");e=new m.Api(e);this.classes=u.extend(!0,{},n.classes),this.c=u.extend(!0,{},n.defaults,t),this.s={dt:e,identifier:s,isPreDefined:i,savedState:null,tableId:o&&o.stateRestore?o.stateRestore.tableId:void 0},this.dom={background:u('
'),closeButton:u('
×
'),confirmation:u('
'),confirmationButton:u('
"),creation:f('
'),creationForm:f('
'),creationTitle:f('

'+this.s.dt.i18n("stateRestore.creationModal.title",this.c.i18n.creationModal.title)+"

"),dtContainer:f(this.s.dt.table().container()),duplicateError:f(''+this.s.dt.i18n("stateRestore.duplicateError",this.c.i18n.duplicateError)+""),emptyError:f(''+this.s.dt.i18n("stateRestore.emptyError",this.c.i18n.emptyError)+""),lengthToggle:f('
'+this.s.dt.i18n("stateRestore.creationModal.length",this.c.i18n.creationModal.length)+"
"),nameInputRow:f('
'),orderToggle:f('
'+this.s.dt.i18n("stateRestore.creationModal.order",this.c.i18n.creationModal.order)+"
"),pagingToggle:f('
'+this.s.dt.i18n("stateRestore.creationModal.paging",this.c.i18n.creationModal.paging)+"
"),removeContents:f('
'),removeTitle:f('

'+this.s.dt.i18n("stateRestore.removeTitle",this.c.i18n.removeTitle)+"

"),scrollerToggle:f('
'+this.s.dt.i18n("stateRestore.creationModal.scroller",this.c.i18n.creationModal.scroller)+"
"),searchBuilderToggle:f('
'+this.s.dt.i18n("stateRestore.creationModal.searchBuilder",this.c.i18n.creationModal.searchBuilder)+"
"),searchPanesToggle:f('
'+this.s.dt.i18n("stateRestore.creationModal.searchPanes",this.c.i18n.creationModal.searchPanes)+"
"),searchToggle:f('
'+this.s.dt.i18n("stateRestore.creationModal.search",this.c.i18n.creationModal.search)+"
"),selectToggle:f('
'+this.s.dt.i18n("stateRestore.creationModal.select",this.c.i18n.creationModal.select)+"
")},(e.settings()[0]._stateRestore=this)._searchForStates(),this._addPreDefined(this.c.preDefined),i={action:"load"},"function"==typeof this.c.ajax?s=function(){"function"==typeof o.c.ajax&&o.c.ajax.call(o.s.dt,i,function(e){return o._addPreDefined(e)})}:"string"==typeof this.c.ajax&&(s=function(){f.ajax({data:i,success:function(e){o._addPreDefined(e)},type:"POST",url:o.c.ajax})}),"function"==typeof s&&(this.s.dt.settings()[0]._bInitComplete?s():this.s.dt.one("preInit.dtsr",function(){s()})),this.s.dt.on("destroy.dtsr",function(){o.destroy()}),this.s.dt.on("draw.dtsr buttons-action.dtsr",function(){return o.findActive()}),this}function o(e,t){l(e,new c.StateRestoreCollection(e,t.config))}function l(e,t){var s=e.stateRestore.states(),o=e.button("SaveStateRestore:name"),i=[];if(o[0])for(var a=o.index().split("-"),i=o[0].inst.c.buttons,n=0;n'+e.i18n("stateRestore.emptyStates",t.c.i18n.emptyStates)+"");else for(var c=0,l=s;c'+i.s.dt.i18n("stateRestore.removeConfirm",i.c.i18n.removeConfirm).replace(/%s/g,i.s.identifier)+"
"),i.dom.confirmation.trigger("dtsr-rename"),i.dom.background.click(),i.dom.confirmation.remove(),u(g).unbind("keyup",function(e){return i._keyupFunction(e)}),i.dom.confirmationButton.off("click")}e={action:"rename",stateRestore:((e={})[i.s.identifier]=s,e)};if(i.c.ajax)"string"==typeof i.c.ajax&&i.s.dt.settings()[0]._bInitComplete?u.ajax({data:e,success:t,type:"POST",url:i.c.ajax}):"function"==typeof i.c.ajax&&i.c.ajax.call(i.s.dt,e,t);else try{localStorage.removeItem("DataTables_stateRestore_"+i.s.identifier+"_"+location.pathname+(i.s.tableId?"_"+i.s.tableId:"")),t()}catch(e){return i.dom.confirmation.children("."+i.classes.modalError).remove(),i.dom.confirmation.append(i.dom.removeError),!1}return!0};if(null!==s){if(o.includes(s))throw new Error(this.s.dt.i18n("stateRestore.duplicateError",this.c.i18n.duplicateError));if(0===s.length)throw new Error(this.s.dt.i18n("stateRestore.emptyError",this.c.i18n.emptyError));this.dom.confirmation.appendTo(this.dom.dtContainer),u(this.s.dt.table().node()).trigger("dtsr-modal-inserted"),e(),this.dom.confirmation.remove()}else this.dom.renameInput.val(this.s.identifier),this.dom.renameContents.append(this.dom.renameInput),this._newModal(this.dom.renameTitle,this.s.dt.i18n("stateRestore.renameButton",this.c.i18n.renameButton),e,this.dom.renameContents)}},n.prototype.save=function(e,t,s){var o,i,a,n=this;if(void 0===s&&(s=!0),this.c.save){if(this.s.dt.state.save(),void 0===e)o=this.s.dt.state();else{if("object"!=typeof e)return;o=e}if(o.stateRestore?(o.stateRestore.isPreDefined=this.s.isPreDefined,o.stateRestore.state=this.s.identifier,o.stateRestore.tableId=this.s.tableId):o.stateRestore={isPreDefined:this.s.isPreDefined,state:this.s.identifier,tableId:this.s.tableId},this.s.savedState=o,this.c.saveState.order||(this.s.savedState.order=void 0),this.c.saveState.search||(this.s.savedState.search=void 0),this.c.saveState.columns&&this.s.savedState.columns)for(var r=0,c=this.s.savedState.columns.length;r
').append(this.dom.confirmationButton)).appendTo(this.dom.dtContainer),u(this.s.dt.table().node()).trigger("dtsr-modal-inserted"),o.children("input")),a=((0'+this.s.dt.i18n("stateRestore.emptyStates",this.c.i18n.emptyStates)+"";if(0===this.s.states.length)t.includes(i)||t.push(i);else{for(;t.includes(i);)t.splice(t.indexOf(i),1);this.s.states=this.s.states.sort(function(e,t){e=e.s.identifier,t=t.s.identifier;return t'+t+"")),e=(this.dom.confirmation.empty().append(this.dom.confirmationTitleRow).append(o).append(f('
').append(n)).appendTo(this.dom.dtContainer),f(this.s.dt.table().node()).trigger("dtsr-modal-inserted"),o.children("input")),r=((0'),closeButton:u('
×
'),confirmation:u('
'),confirmationButton:u('
"),creation:p('
'),creationForm:p('
'),creationTitle:p('

'+this.s.dt.i18n("stateRestore.creationModal.title",this.c.i18n.creationModal.title)+"

"),dtContainer:p(this.s.dt.table().container()),duplicateError:p(''+this.s.dt.i18n("stateRestore.duplicateError",this.c.i18n.duplicateError)+""),emptyError:p(''+this.s.dt.i18n("stateRestore.emptyError",this.c.i18n.emptyError)+""),lengthToggle:p('
'+this.s.dt.i18n("stateRestore.creationModal.length",this.c.i18n.creationModal.length)+"
"),nameInputRow:p('
'),orderToggle:p('
'+this.s.dt.i18n("stateRestore.creationModal.order",this.c.i18n.creationModal.order)+"
"),pagingToggle:p('
'+this.s.dt.i18n("stateRestore.creationModal.paging",this.c.i18n.creationModal.paging)+"
"),removeContents:p('
'),removeTitle:p('

'+this.s.dt.i18n("stateRestore.removeTitle",this.c.i18n.removeTitle)+"

"),scrollerToggle:p('
'+this.s.dt.i18n("stateRestore.creationModal.scroller",this.c.i18n.creationModal.scroller)+"
"),searchBuilderToggle:p('
'+this.s.dt.i18n("stateRestore.creationModal.searchBuilder",this.c.i18n.creationModal.searchBuilder)+"
"),searchPanesToggle:p('
'+this.s.dt.i18n("stateRestore.creationModal.searchPanes",this.c.i18n.creationModal.searchPanes)+"
"),searchToggle:p('
'+this.s.dt.i18n("stateRestore.creationModal.search",this.c.i18n.creationModal.search)+"
"),selectToggle:p('
'+this.s.dt.i18n("stateRestore.creationModal.select",this.c.i18n.creationModal.select)+"
")},(e.settings()[0]._stateRestore=this)._searchForStates(),this._addPreDefined(this.c.preDefined),i={action:"load"},"function"==typeof this.c.ajax?s=function(){"function"==typeof o.c.ajax&&o.c.ajax.call(o.s.dt,i,function(e){return o._addPreDefined(e)})}:"string"==typeof this.c.ajax&&(s=function(){p.ajax({data:i,success:function(e){o._addPreDefined(e)},type:"POST",url:o.c.ajax})}),"function"==typeof s&&(this.s.dt.settings()[0]._bInitComplete?s():this.s.dt.one("preInit.dtsr",function(){s()})),this.s.dt.on("destroy.dtsr",function(){o.destroy()}),this.s.dt.on("draw.dtsr buttons-action.dtsr",function(){return o.findActive()}),this}function o(e,t){l(e,new c.StateRestoreCollection(e,t.config))}function l(e,t){var s=e.stateRestore.states(),o=e.button("SaveStateRestore:name"),i=[];if(o[0])for(var a=o.index().split("-"),i=o[0].inst.c.buttons,n=0;n'+e.i18n("stateRestore.emptyStates",t.c.i18n.emptyStates)+"");else for(var c=0,l=s;c'+i.s.dt.i18n("stateRestore.removeConfirm",i.c.i18n.removeConfirm).replace(/%s/g,i.s.identifier)+"
"),i.dom.confirmation.trigger("dtsr-rename"),i.dom.background.click(),i.dom.confirmation.remove(),u(g).unbind("keyup",function(e){return i._keyupFunction(e)}),i.dom.confirmationButton.off("click")}e={action:"rename",stateRestore:((e={})[i.s.identifier]=s,e)};if(i.c.ajax)"string"==typeof i.c.ajax&&i.s.dt.settings()[0]._bInitComplete?u.ajax({data:e,success:t,type:"POST",url:i.c.ajax}):"function"==typeof i.c.ajax&&i.c.ajax.call(i.s.dt,e,t);else try{localStorage.removeItem("DataTables_stateRestore_"+i.s.identifier+"_"+location.pathname+(i.s.tableId?"_"+i.s.tableId:"")),t()}catch(e){return i.dom.confirmation.children("."+i.classes.modalError).remove(),i.dom.confirmation.append(i.dom.removeError),!1}return!0};if(null!==s){if(o.includes(s))throw new Error(this.s.dt.i18n("stateRestore.duplicateError",this.c.i18n.duplicateError));if(0===s.length)throw new Error(this.s.dt.i18n("stateRestore.emptyError",this.c.i18n.emptyError));this.dom.confirmation.appendTo(this.dom.dtContainer),u(this.s.dt.table().node()).trigger("dtsr-modal-inserted"),e(),this.dom.confirmation.remove()}else this.dom.renameInput.val(this.s.identifier),this.dom.renameContents.append(this.dom.renameInput),this._newModal(this.dom.renameTitle,this.s.dt.i18n("stateRestore.renameButton",this.c.i18n.renameButton),e,this.dom.renameContents)}},n.prototype.save=function(e,t,s){var o,i,a,n=this;if(void 0===s&&(s=!0),this.c.save){if(this.s.dt.state.save(),void 0===e)o=this.s.dt.state();else{if("object"!=typeof e)return;o=e}if(o.stateRestore?(o.stateRestore.isPreDefined=this.s.isPreDefined,o.stateRestore.state=this.s.identifier,o.stateRestore.tableId=this.s.tableId):o.stateRestore={isPreDefined:this.s.isPreDefined,state:this.s.identifier,tableId:this.s.tableId},this.s.savedState=o,this.c.saveState.order||(this.s.savedState.order=void 0),this.c.saveState.search||(this.s.savedState.search=void 0),this.c.saveState.columns&&this.s.savedState.columns)for(var r=0,c=this.s.savedState.columns.length;r/g,">").replace(/"/g,"""):e},n.prototype._deepCompare=function(e,t){var s,o,i=[e,t],a=[Object.keys(e).sort(),Object.keys(t).sort()];for(a[0].includes("scroller")&&(s=a[0].indexOf("start"))&&a[0].splice(s,1),a[1].includes("scroller")&&(s=a[1].indexOf("start"))&&a[1].splice(s,1),o=0;o
').append(this.dom.confirmationButton)).appendTo(this.dom.dtContainer),u(this.s.dt.table().node()).trigger("dtsr-modal-inserted"),o.children("input")),a=((0'+this.s.dt.i18n("stateRestore.emptyStates",this.c.i18n.emptyStates)+"";if(0===this.s.states.length)t.includes(i)||t.push(i);else{for(;t.includes(i);)t.splice(t.indexOf(i),1);this.s.states=this.s.states.sort(function(e,t){e=e.s.identifier,t=t.s.identifier;return t'+t+"")),e=(this.dom.confirmation.empty().append(this.dom.confirmationTitleRow).append(o).append(p('
').append(n)).appendTo(this.dom.dtContainer),p(this.s.dt.table().node()).trigger("dtsr-modal-inserted"),o.children("input")),r=((0'+a.s.dt.i18n("stateRestore.removeConfirm",a.c.i18n.removeConfirm).replace(/%s/g,a.s.identifier)+"
"),a.dom.confirmation.trigger("dtsr-rename"),a.dom.background.click(),a.dom.confirmation.remove(),u(document).unbind("keyup",function(e){return a._keyupFunction(e)}),a.dom.confirmationButton.off("click")}e={action:"rename",stateRestore:((e={})[a.s.identifier]=s,e)};if(a.c.ajax)"string"==typeof a.c.ajax&&a.s.dt.settings()[0]._bInitComplete?u.ajax({data:e,success:t,type:"POST",url:a.c.ajax}):"function"==typeof a.c.ajax&&a.c.ajax.call(a.s.dt,e,t);else try{localStorage.removeItem("DataTables_stateRestore_"+a.s.identifier+"_"+location.pathname+(a.s.tableId?"_"+a.s.tableId:"")),t()}catch(e){return a.dom.confirmation.children("."+a.classes.modalError).remove(),a.dom.confirmation.append(a.dom.removeError),!1}return!0};if(null!==s){if(o.includes(s))throw new Error(this.s.dt.i18n("stateRestore.duplicateError",this.c.i18n.duplicateError));if(0===s.length)throw new Error(this.s.dt.i18n("stateRestore.emptyError",this.c.i18n.emptyError));this.dom.confirmation.appendTo(this.dom.dtContainer),u(this.s.dt.table().node()).trigger("dtsr-modal-inserted"),e(),this.dom.confirmation.remove()}else this.dom.renameInput.val(this.s.identifier),this.dom.renameContents.append(this.dom.renameInput),this._newModal(this.dom.renameTitle,this.s.dt.i18n("stateRestore.renameButton",this.c.i18n.renameButton),e,this.dom.renameContents)}},n.prototype.save=function(e,t,s){var o,a,i,n=this;if(void 0===s&&(s=!0),this.c.save){if(this.s.dt.state.save(),void 0===e)o=this.s.dt.state();else{if("object"!=typeof e)return;o=e}if(o.stateRestore?(o.stateRestore.isPreDefined=this.s.isPreDefined,o.stateRestore.state=this.s.identifier,o.stateRestore.tableId=this.s.tableId):o.stateRestore={isPreDefined:this.s.isPreDefined,state:this.s.identifier,tableId:this.s.tableId},this.s.savedState=o,this.c.saveState.order||(this.s.savedState.order=void 0),this.c.saveState.search||(this.s.savedState.search=void 0),this.c.saveState.columns&&this.s.savedState.columns)for(var r=0,c=this.s.savedState.columns.length;r').append(this.dom.confirmationButton)).appendTo(this.dom.dtContainer),u(this.s.dt.table().node()).trigger("dtsr-modal-inserted"),o.children("input")),i=((0'),closeButton:u('
×
'),confirmation:u('
'),confirmationButton:u('")),e=(this.dom.confirmation.empty().append(this.dom.confirmationTitleRow).append(o).append(g('
').append(n)).appendTo(this.dom.dtContainer),g(this.s.dt.table().node()).trigger("dtsr-modal-inserted"),o.children("input")),r=((0'+a.s.dt.i18n("stateRestore.removeConfirm",a.c.i18n.removeConfirm).replace(/%s/g,a.s.identifier)+"
"),a.dom.confirmation.trigger("dtsr-rename"),a.dom.background.click(),a.dom.confirmation.remove(),u(document).unbind("keyup",function(e){return a._keyupFunction(e)}),a.dom.confirmationButton.off("click")}e={action:"rename",stateRestore:((e={})[a.s.identifier]=s,e)};if(a.c.ajax)"string"==typeof a.c.ajax&&a.s.dt.settings()[0]._bInitComplete?u.ajax({data:e,success:t,type:"POST",url:a.c.ajax}):"function"==typeof a.c.ajax&&a.c.ajax.call(a.s.dt,e,t);else try{localStorage.removeItem("DataTables_stateRestore_"+a.s.identifier+"_"+location.pathname+(a.s.tableId?"_"+a.s.tableId:"")),t()}catch(e){return a.dom.confirmation.children("."+a.classes.modalError).remove(),a.dom.confirmation.append(a.dom.removeError),!1}return!0};if(null!==s){if(o.includes(s))throw new Error(this.s.dt.i18n("stateRestore.duplicateError",this.c.i18n.duplicateError));if(0===s.length)throw new Error(this.s.dt.i18n("stateRestore.emptyError",this.c.i18n.emptyError));this.dom.confirmation.appendTo(this.dom.dtContainer),u(this.s.dt.table().node()).trigger("dtsr-modal-inserted"),e(),this.dom.confirmation.remove()}else this.dom.renameInput.val(this.s.identifier),this.dom.renameContents.append(this.dom.renameInput),this._newModal(this.dom.renameTitle,this.s.dt.i18n("stateRestore.renameButton",this.c.i18n.renameButton),e,this.dom.renameContents)}},n.prototype.save=function(e,t,s){var o,a,i,n=this;if(void 0===s&&(s=!0),this.c.save){if(this.s.dt.state.save(),void 0===e)o=this.s.dt.state();else{if("object"!=typeof e)return;o=e}if(o.stateRestore?(o.stateRestore.isPreDefined=this.s.isPreDefined,o.stateRestore.state=this.s.identifier,o.stateRestore.tableId=this.s.tableId):o.stateRestore={isPreDefined:this.s.isPreDefined,state:this.s.identifier,tableId:this.s.tableId},this.s.savedState=o,this.c.saveState.order||(this.s.savedState.order=void 0),this.c.saveState.search||(this.s.savedState.search=void 0),this.c.saveState.columns&&this.s.savedState.columns)for(var r=0,c=this.s.savedState.columns.length;r/g,">").replace(/"/g,"""):e},n.prototype._deepCompare=function(e,t){var s,o,a=[e,t],i=[Object.keys(e).sort(),Object.keys(t).sort()];for(i[0].includes("scroller")&&(s=i[0].indexOf("start"))&&i[0].splice(s,1),i[1].includes("scroller")&&(s=i[1].indexOf("start"))&&i[1].splice(s,1),o=0;o').append(this.dom.confirmationButton)).appendTo(this.dom.dtContainer),u(this.s.dt.table().node()).trigger("dtsr-modal-inserted"),o.children("input")),i=((0'),closeButton:u('
×
'),confirmation:u('
'),confirmationButton:u('")),e=(this.dom.confirmation.empty().append(this.dom.confirmationTitleRow).append(o).append(g('
').append(n)).appendTo(this.dom.dtContainer),g(this.s.dt.table().node()).trigger("dtsr-modal-inserted"),o.children("input")),r=((0'),checkboxInputRow:g('
'),closeButton:g('
x
'),colReorderToggle:g('
'+this.s.dt.i18n("stateRestore.creationModal.colReorder",this.c.i18n.creationModal.colReorder)+"
"),columnsSearchToggle:g('
'+this.s.dt.i18n("stateRestore.creationModal.columns.search",this.c.i18n.creationModal.columns.search)+"
"),columnsVisibleToggle:g('
'+this.s.dt.i18n("stateRestore.creationModal.columns.visible",this.c.i18n.creationModal.columns.visible)+"
"),confirmation:g('
'),confirmationTitleRow:g('
'),createButtonRow:g('
"),creation:g('
'),creationForm:g('
'),creationTitle:g('

'+this.s.dt.i18n("stateRestore.creationModal.title",this.c.i18n.creationModal.title)+"

"),dtContainer:g(this.s.dt.table().container()),duplicateError:g(''+this.s.dt.i18n("stateRestore.duplicateError",this.c.i18n.duplicateError)+""),emptyError:g(''+this.s.dt.i18n("stateRestore.emptyError",this.c.i18n.emptyError)+""),lengthToggle:g('
'+this.s.dt.i18n("stateRestore.creationModal.length",this.c.i18n.creationModal.length)+"
"),nameInputRow:g('
'),orderToggle:g('
'+this.s.dt.i18n("stateRestore.creationModal.order",this.c.i18n.creationModal.order)+"
"),pagingToggle:g('
'+this.s.dt.i18n("stateRestore.creationModal.paging",this.c.i18n.creationModal.paging)+"
"),removeContents:g('
'),removeTitle:g('

'+this.s.dt.i18n("stateRestore.removeTitle",this.c.i18n.removeTitle)+"

"),scrollerToggle:g('
'+this.s.dt.i18n("stateRestore.creationModal.scroller",this.c.i18n.creationModal.scroller)+"
"),searchBuilderToggle:g('
'+this.s.dt.i18n("stateRestore.creationModal.searchBuilder",this.c.i18n.creationModal.searchBuilder)+"
"),searchPanesToggle:g('
'+this.s.dt.i18n("stateRestore.creationModal.searchPanes",this.c.i18n.creationModal.searchPanes)+"
"),searchToggle:g('
'+this.s.dt.i18n("stateRestore.creationModal.search",this.c.i18n.creationModal.search)+"
"),selectToggle:g('
'+this.s.dt.i18n("stateRestore.creationModal.select",this.c.i18n.creationModal.select)+"
")},(e.settings()[0]._stateRestore=this)._searchForStates(),this._addPreDefined(this.c.preDefined),a={action:"load"},"function"==typeof this.c.ajax?s=function(){"function"==typeof o.c.ajax&&o.c.ajax.call(o.s.dt,a,function(e){return o._addPreDefined(e)})}:"string"==typeof this.c.ajax&&(s=function(){g.ajax({data:a,success:function(e){o._addPreDefined(e)},type:"POST",url:o.c.ajax})}),"function"==typeof s&&(this.s.dt.settings()[0]._bInitComplete?s():this.s.dt.one("preInit.dtsr",function(){s()})),this.s.dt.on("destroy.dtsr",function(){o.destroy()}),this.s.dt.on("draw.dtsr buttons-action.dtsr",function(){return o.findActive()}),this}e=$,m=(u=e).fn.dataTable,e=$,i=(g=e).fn.dataTable,$.fn.dataTable.StateRestore=p,$.fn.DataTable.StateRestore=p,$.fn.dataTable.StateRestoreCollection=s,$.fn.DataTable.StateRestoreCollection=s;var e=DataTable.Api.register;function o(e,t){c(e,new DataTable.StateRestoreCollection(e,t.config))}function c(e,t){var s=e.stateRestore.states(),o=e.button("SaveStateRestore:name"),a=[];if(o[0])for(var i=o.index().split("-"),a=o[0].inst.c.buttons,n=0;n'+e.i18n("stateRestore.emptyStates",t.c.i18n.emptyStates)+"");else for(var c=0,l=s;c'),checkboxInputRow:g('
'),closeButton:g('
x
'),colReorderToggle:g('
'+this.s.dt.i18n("stateRestore.creationModal.colReorder",this.c.i18n.creationModal.colReorder)+"
"),columnsSearchToggle:g('
'+this.s.dt.i18n("stateRestore.creationModal.columns.search",this.c.i18n.creationModal.columns.search)+"
"),columnsVisibleToggle:g('
'+this.s.dt.i18n("stateRestore.creationModal.columns.visible",this.c.i18n.creationModal.columns.visible)+"
"),confirmation:g('
'),confirmationTitleRow:g('
'),createButtonRow:g('
"),creation:g('
'),creationForm:g('
'),creationTitle:g('

'+this.s.dt.i18n("stateRestore.creationModal.title",this.c.i18n.creationModal.title)+"

"),dtContainer:g(this.s.dt.table().container()),duplicateError:g(''+this.s.dt.i18n("stateRestore.duplicateError",this.c.i18n.duplicateError)+""),emptyError:g(''+this.s.dt.i18n("stateRestore.emptyError",this.c.i18n.emptyError)+""),lengthToggle:g('
'+this.s.dt.i18n("stateRestore.creationModal.length",this.c.i18n.creationModal.length)+"
"),nameInputRow:g('
'),orderToggle:g('
'+this.s.dt.i18n("stateRestore.creationModal.order",this.c.i18n.creationModal.order)+"
"),pagingToggle:g('
'+this.s.dt.i18n("stateRestore.creationModal.paging",this.c.i18n.creationModal.paging)+"
"),removeContents:g('
'),removeTitle:g('

'+this.s.dt.i18n("stateRestore.removeTitle",this.c.i18n.removeTitle)+"

"),scrollerToggle:g('
'+this.s.dt.i18n("stateRestore.creationModal.scroller",this.c.i18n.creationModal.scroller)+"
"),searchBuilderToggle:g('
'+this.s.dt.i18n("stateRestore.creationModal.searchBuilder",this.c.i18n.creationModal.searchBuilder)+"
"),searchPanesToggle:g('
'+this.s.dt.i18n("stateRestore.creationModal.searchPanes",this.c.i18n.creationModal.searchPanes)+"
"),searchToggle:g('
'+this.s.dt.i18n("stateRestore.creationModal.search",this.c.i18n.creationModal.search)+"
"),selectToggle:g('
'+this.s.dt.i18n("stateRestore.creationModal.select",this.c.i18n.creationModal.select)+"
")},(e.settings()[0]._stateRestore=this)._searchForStates(),this._addPreDefined(this.c.preDefined),a={action:"load"},"function"==typeof this.c.ajax?s=function(){"function"==typeof o.c.ajax&&o.c.ajax.call(o.s.dt,a,function(e){return o._addPreDefined(e)})}:"string"==typeof this.c.ajax&&(s=function(){g.ajax({data:a,success:function(e){o._addPreDefined(e)},type:"POST",url:o.c.ajax})}),"function"==typeof s&&(this.s.dt.settings()[0]._bInitComplete?s():this.s.dt.one("preInit.dtsr",function(){s()})),this.s.dt.on("destroy.dtsr",function(){o.destroy()}),this.s.dt.on("draw.dtsr buttons-action.dtsr",function(){return o.findActive()}),this}e=$,m=(u=e).fn.dataTable,e=$,i=(g=e).fn.dataTable,$.fn.dataTable.StateRestore=y,$.fn.DataTable.StateRestore=y,$.fn.dataTable.StateRestoreCollection=s,$.fn.DataTable.StateRestoreCollection=s;var e=DataTable.Api.register;function o(e,t){c(e,new DataTable.StateRestoreCollection(e,t.config))}function c(e,t){var s=e.stateRestore.states(),o=e.button("SaveStateRestore:name"),a=[];if(o[0])for(var i=o.index().split("-"),a=o[0].inst.c.buttons,n=0;n'+e.i18n("stateRestore.emptyStates",t.c.i18n.emptyStates)+"");else for(var c=0,l=s;c' + this.s.dt .i18n('stateRestore.removeConfirm', this.c.i18n.removeConfirm) - .replace(/%s/g, this.s.identifier) + + .replace(/%s/g, StateRestore.entityEncode(this.s.identifier)) + '
'), removeError: $$2('' + this.s.dt.i18n('stateRestore.removeError', this.c.i18n.removeError) + @@ -70,7 +70,7 @@ let $ = jQuery; '' + '
'), renameInput: $$2(''), @@ -538,6 +538,22 @@ let $ = jQuery; this.c.ajax.call(this.s.dt, ajaxData, successCallback); } }; + /** + * Encode HTML entities + * + * @param d String to encode + * @returns Encoded string + * @todo When DT1 support is dropped, switch to using `DataTable.util.escapeHtml` + */ + StateRestore.entityEncode = function (d) { + return typeof d === 'string' ? + d + .replace(/&/g, '&') + .replace(//g, '>') + .replace(/"/g, '"') : + d; + }; /** * Performs a deep compare of two state objects, returning true if they match * @@ -1320,8 +1336,8 @@ let $ = jQuery; split: split }, extend: 'stateRestore', - text: state.s.identifier, - popoverTitle: state.s.identifier + text: StateRestore.entityEncode(state.s.identifier), + popoverTitle: StateRestore.entityEncode(state.s.identifier) }); } } @@ -1671,8 +1687,8 @@ let $ = jQuery; var keys = Object.keys(localStorage); var _loop_2 = function (key) { // eslint-disable-next-line no-useless-escape - if (key.match(new RegExp('^DataTables_stateRestore_.*_' + location.pathname.replace(/\//g, '/') + '$')) || - key.match(new RegExp('^DataTables_stateRestore_.*_' + location.pathname.replace(/\//g, '/') + + if (key.match(new RegExp('^DataTables_stateRestore_.*_' + location.pathname + '$')) || + key.match(new RegExp('^DataTables_stateRestore_.*_' + location.pathname + '_' + this_2.s.dt.table().node().id + '$'))) { var loadedState_1 = JSON.parse(localStorage.getItem(key)); if (loadedState_1.stateRestore.isPreDefined || @@ -2119,8 +2135,8 @@ let $ = jQuery; split: split }, extend: 'stateRestore', - text: state.s.identifier, - popoverTitle: state.s.identifier + text: StateRestore.entityEncode(state.s.identifier), + popoverTitle: StateRestore.entityEncode(state.s.identifier) }); } dt.button('SaveStateRestore:name').collectionRebuild(stateButtons); @@ -2266,8 +2282,8 @@ let $ = jQuery; split: split }, extend: 'stateRestore', - text: state.s.identifier, - popoverTitle: state.s.identifier + text: StateRestore.entityEncode(state.s.identifier), + popoverTitle: StateRestore.entityEncode(state.s.identifier) }); } } diff --git a/js/index.js b/js/index.js index 34f8823..b327e24 100644 --- a/js/index.js +++ b/js/index.js @@ -315,8 +315,8 @@ DataTable.ext.buttons.createState = { split: split }, extend: 'stateRestore', - text: state.s.identifier, - popoverTitle: state.s.identifier + text: StateRestore.entityEncode(state.s.identifier), + popoverTitle: StateRestore.entityEncode(state.s.identifier) }); } dt.button('SaveStateRestore:name').collectionRebuild(stateButtons); @@ -462,8 +462,8 @@ function _stateRegen(dt, src) { split: split }, extend: 'stateRestore', - text: state.s.identifier, - popoverTitle: state.s.identifier + text: StateRestore.entityEncode(state.s.identifier), + popoverTitle: StateRestore.entityEncode(state.s.identifier) }); } }