From 037af6890fe6fdb84a08d3c86083e847c90ec0ad Mon Sep 17 00:00:00 2001
From: Aleksander Machniak <alec@alec.pl>
Date: Tue, 22 Oct 2013 08:17:26 -0400
Subject: [PATCH] Fix vulnerability in handling _session argument of utils/save-prefs (#1489382)
---
program/js/tiny_mce/plugins/paste/js/pasteword.js | 6 +++---
1 files changed, 3 insertions(+), 3 deletions(-)
diff --git a/program/js/tiny_mce/plugins/paste/js/pasteword.js b/program/js/tiny_mce/plugins/paste/js/pasteword.js
index fe053a7..a52731c 100644
--- a/program/js/tiny_mce/plugins/paste/js/pasteword.js
+++ b/program/js/tiny_mce/plugins/paste/js/pasteword.js
@@ -13,12 +13,12 @@
css = [ed.baseURI.toAbsolute("themes/" + ed.settings.theme + "/skins/" + ed.settings.skin + "/content.css")];
css = css.concat(tinymce.explode(ed.settings.content_css) || []);
tinymce.each(css, function(u) {
- cssHTML += '<link href="' + ed.documentBaseURI.toAbsolute(u) + '" rel="stylesheet" type="text/css" />';
+ cssHTML += '<link href="' + ed.documentBaseURI.toAbsolute('' + u) + '" rel="stylesheet" type="text/css" />';
});
// Write content into iframe
doc.open();
- doc.write('<html><head>' + cssHTML + '</head><body spellcheck="false"></body></html>');
+ doc.write('<html><head>' + cssHTML + '</head><body class="mceContentBody" spellcheck="false"></body></html>');
doc.close();
doc.designMode = 'on';
@@ -32,7 +32,7 @@
insert : function() {
var h = document.getElementById('iframe').contentWindow.document.body.innerHTML;
- tinyMCEPopup.editor.execCommand('mceInsertClipboardContent', false, h);
+ tinyMCEPopup.editor.execCommand('mceInsertClipboardContent', false, {content : h, wordContent : true});
tinyMCEPopup.close();
},
--
Gitblit v1.9.1