htmlEncode escapes only string values

kartik-v / yii2-editable

An enhanced editable widget for Yii 2.0 that allows easy editing of displayed data with html inputs, widgets and more.

http://demos.krajee.com/editable

Other

112 stars 55 forks source link

htmlEncode escapes only string values #186

Closed kasparsklavins closed 5 years ago

kasparsklavins commented 5 years ago

Scope

This pull request includes a

[x] Bug fix
[ ] New feature
[ ] Translation

Changes

The following changes were made (this change is also documented in the change log):

Does not try to escape html entities (<, >, ", ') on non-string values in htmlEncode. Not documented.

kasparsklavins commented 5 years ago

Are .min files updated automatically?

kartik-v commented 5 years ago

Need to understand this correct. There is a validation condition for typeof data === "object" already before the test you have. The following condition should normally result in data as a string. Why do you feel typeof data === "string" test is needed? Do you have any other type other than string coming up in your use case?
You can minify the JS files from here and submit.

kasparsklavins commented 5 years ago

When using in combination with select2, and removing all selected options, $input.value is undefined. So, an undefined value is passed from here https://github.com/kartik-v/yii2-editable/blob/master/src/assets/js/editable.js#L201.

According to jquery docs, val() can return a string, a number, an array or undefined. replace() exists only on string values, so behaviour is not changed (unless someone depended on a TypeError being thrown)

I'll minify the file if no further changes are needed.

kasparsklavins commented 5 years ago

You can minify the JS files from here and submit.