Updates the content pointer behaviour so it's inserted before/after the
target, instead of just before, depending on selection direction, so it
can stay out of the selection range.
Positioning is absolute relative to a parent content so visually should
be the same result as before.
For #6214
This specifically alters the checkbox label implementation to use the
existing checkbox label instead of always adding an extra label to the
custom checkbox element itself, unless they diverge (like for permission
checkboxes).
Prevents the same IDs from different systems leading to access of other
accounts, and allows registration of same ids under different services.
Thanks to Google and Ada Logics for discovery and reporting.
It now retains existing input where set.
This also updates the modal click handling with an extra click source
check to handle cases where a mousedown event is not emitted, like on
select list dismissals.
Required updating the selection management to ensure they are selected
upon mousedown, for when a drag operation starts.
Also added draggable management, which we have to avoid having there
when open unless a drag is started, otherwise contents are not editable
in chromium browsers.
Fixes behaviour when using cut/copy/drag for items like images or code
blocks.
Also updates history handling to not ignore additions where original
content remains unchanged.
Aligned the linebreak exportdom behaviour to align with how the
reconciler displays line breaks in the editor, by adding an extra line
break to each series of line breaks, so they're now visually the same
across editor and export.
Block formatting on range selection could break when made from bottom to
top, due to using the first selected for insertion position instead of
the first in the doc structure.
Updated code editor display so the editor area actually gains focus
again.
Updated modal handling to delegate focus handling to the editor if focus
was on the edit area before, to prevent cursor jumps to the start.
Cells could have an 'align' attribute, especially when created via
markdown. This updates the allow filtering to retain valid align values
on table cells.
For #6167
Updated LDAP group handling to properly handle empty group values by
checking the explode's count property instead of performing a general
array count.
Also updated logic with DN validation/filtering before LDAP calls are
made.
For #6088
For #6181
Just in users' my account area for now.
To add to admin-level actions in the future once we can better trace
session life.
Updated/added tests to cover.
Also changed the UI based forms to submit as changelog instead of
summary to align with more sensible name used on the API.
Added testing to cover.
For #6162
Actually registered the SFTP protocol with HTMLPurifier to allow SFTP
links.
Replaced the default MakeAbsolute URI filter for HTMLPurifier so that
fragment based links are allowed, and are not forced to have a base URL
and/or protocol.
For #6178, Related to #6186
Fixed lack of permission update scope in permission builder where
trashed pages on chapter permission updates would not get permission
updates.
Also added permission rebuild on restore as an extra assurance.
Added tests to cover.
Thanks to SVO — svo.com.br for reporting.
- Updates ZIP imports to validate that actual mime type of book cover
images to ensure they are a supported image file.
- Updates lower level ImageStorage to validate extensions of images when
cleaning their name pre-storage.
- Updates ZIP import Image and Book handling so book cover and image
files have their extension forced from file mime types in the same
way.
Added testing to cover.
Thanks to the submersion.ai security research team for reporting.
The lack of the filter could result in draft pages, from other users,
showing in locations like search results.
Thanks to Ahmed Ibrahim (github.com/skeletonsec) for reporting.
To prevent the ability to use the draft publish endpoint on non-draft
pages which the user may not have the ability to update by default.
Thanks to SVO for reporting.
Dan Brown