From 037af6890fe6fdb84a08d3c86083e847c90ec0ad Mon Sep 17 00:00:00 2001
From: Aleksander Machniak <alec@alec.pl>
Date: Tue, 22 Oct 2013 08:17:26 -0400
Subject: [PATCH] Fix vulnerability in handling _session argument of utils/save-prefs (#1489382)
---
program/js/tiny_mce/plugins/table/js/cell.js | 35 +++++++++++++++++++++++++++++++++++
1 files changed, 35 insertions(+), 0 deletions(-)
diff --git a/program/js/tiny_mce/plugins/table/js/cell.js b/program/js/tiny_mce/plugins/table/js/cell.js
index 45e6061..02ecf22 100644
--- a/program/js/tiny_mce/plugins/table/js/cell.js
+++ b/program/js/tiny_mce/plugins/table/js/cell.js
@@ -63,6 +63,11 @@
function updateAction() {
var el, inst = ed, tdElm, trElm, tableElm, formObj = document.forms[0];
+ if (!AutoValidator.validate(formObj)) {
+ tinyMCEPopup.alert(AutoValidator.getErrorMessages(formObj).join('. ') + '.');
+ return false;
+ }
+
tinyMCEPopup.restoreSelection();
el = ed.selection.getStart();
tdElm = ed.dom.getParent(el, "td,th");
@@ -123,6 +128,36 @@
break;
+ case "col":
+ var curr, col = 0, cell = trElm.firstChild, rows = tableElm.getElementsByTagName("tr");
+
+ if (cell.nodeName != "TD" && cell.nodeName != "TH")
+ cell = nextCell(cell);
+
+ do {
+ if (cell == tdElm)
+ break;
+ col += cell.getAttribute("colspan")?cell.getAttribute("colspan"):1;
+ } while ((cell = nextCell(cell)) != null);
+
+ for (var i=0; i<rows.length; i++) {
+ cell = rows[i].firstChild;
+
+ if (cell.nodeName != "TD" && cell.nodeName != "TH")
+ cell = nextCell(cell);
+
+ curr = 0;
+ do {
+ if (curr == col) {
+ cell = updateCell(cell, true);
+ break;
+ }
+ curr += cell.getAttribute("colspan")?cell.getAttribute("colspan"):1;
+ } while ((cell = nextCell(cell)) != null);
+ }
+
+ break;
+
case "all":
var rows = tableElm.getElementsByTagName("tr");
--
Gitblit v1.9.1