[jspwiki] branch master updated: 2.11.0-M4-git-05 [JSPWIKI-1107] Fixing Slimbox links with illegal characters

[brushed]

This is an automated email from the ASF dual-hosted git repository.

brushed pushed a commit to branch master
in repository https://gitbox.apache.org/repos/asf/jspwiki.git


The following commit(s) were added to refs/heads/master by this push:
     new edff448  2.11.0-M4-git-05 [JSPWIKI-1107] Fixing Slimbox links with 
illegal characters
edff448 is described below

commit edff448e1b6f5fd35aea2d72f88e3c7a88741c0a
Author: brushed <dirk.frederi...@gmail.com>
AuthorDate: Tue Apr 23 21:16:49 2019 +0200

    2.11.0-M4-git-05 [JSPWIKI-1107] Fixing Slimbox links with illegal characters
    
    no version bump
---
 ChangeLog                                                | 3 +++
 jspwiki-war/src/main/scripts/behaviors/Viewer.Slimbox.js | 8 ++++----
 2 files changed, 7 insertions(+), 4 deletions(-)

diff --git a/ChangeLog b/ChangeLog
index 986ada7..482edaa 100644
--- a/ChangeLog
+++ b/ChangeLog
@@ -4,6 +4,9 @@
 
        * [JSPWIKI-1108] interwiki links with illegal characters causes XSS 
vulnerability
 
+       * [JSPWIKI-1107] uploading attachments with illegal filename causes XSS 
vulnerability
+         Fixing side-effect on slimbox links, when rendering the caption with 
illegal characters.
+
 2019-04-22  Dirk Frederickx (brushed AT apache DOT org)
 
        * 2.11.0-M4-git-04
diff --git a/jspwiki-war/src/main/scripts/behaviors/Viewer.Slimbox.js 
b/jspwiki-war/src/main/scripts/behaviors/Viewer.Slimbox.js
index 2b28396..998af75 100644
--- a/jspwiki-war/src/main/scripts/behaviors/Viewer.Slimbox.js
+++ b/jspwiki-war/src/main/scripts/behaviors/Viewer.Slimbox.js
@@ -74,8 +74,8 @@ Viewer.Slimbox = new Class({
 
         //helper function
         function clickFn(){
-            if( this.match(".next")){ self.update(1); }
-            else if( this.match(".prev")){ self.update(-1); }
+            if( this.matches(".next")){ self.update(1); }
+            else if( this.matches(".prev")){ self.update(-1); }
             else { self.attach( /*O=close*/ ); }
         }
 
@@ -261,7 +261,7 @@ Viewer.Slimbox = new Class({
         self.get(".caption").set({
             href: url,
             html: ( many ? hints.nofm.xsubs( cursor + 1, max)  : "" ) +
-                    (el.title || el.alt || el.textContent || ""  )
+                    (el.title || el.alt || el.textContent || ""  ).escapeHtml()
 
         });
 
@@ -280,7 +280,7 @@ Viewer.Slimbox = new Class({
     resize: function( preload ){
 
         var self = this,
-            isImage = preload.match("img"),
+            isImage = preload.matches("img"),
             viewport = self.viewport,
 
             wSize = window.getSize(),