Anders Kaseorg 8459185970 lightbox: Confine embedded video players to a unique origin. ...

This fixes a cross-site scripting vulnerability in the upcoming Inline
URL Previews feature found by Graham Bleaney and Ibrahim Mohamed using
Pysa.

This commit doesn't get a CVE because the bug was present in a code
path introduced in the 2.1.x development branch, so it doesn't impact
any Zulip release.

Signed-off-by: Anders Kaseorg <anders@zulipchat.com>

2019-12-12 15:23:15 -08:00

..

analytics

js: Automatically convert var to let and const in most files.

2019-11-03 12:42:39 -08:00

billing

js: Automatically convert var to let and const in most files.

2019-11-03 12:42:39 -08:00

bundles

dependencies: Upgrade to-markdown 3.1.1 to turndown 5.0.3.

2019-11-11 16:26:31 -08:00

portico

auth: Merge RemoteUserBackend into external_authentication_methods.

2019-12-10 20:16:21 +01:00

stats

minor: Replace Math.min() with Infinity for easier to read code.

2019-12-06 11:27:58 -08:00

types

typescript: Type webpack.config.ts correctly.

2019-11-04 18:12:11 -08:00

.eslintrc.json

…

activity.js

js: Automatically convert var to let and const in most files.

2019-11-03 12:42:39 -08:00

admin.js

org_settings: Change new user 24-hour setting to dropdown.

2019-11-08 17:39:59 -08:00

alert_words_ui.js

js: Automatically convert var to let and const in most files.

2019-11-03 12:42:39 -08:00

alert_words.js

js: Automatically convert var to let and const in most files.

2019-11-03 12:42:39 -08:00

archive.js

js: Automatically convert var to let and const in most files.

2019-11-03 12:42:39 -08:00

attachments_ui.js

js: Automatically convert var to let and const in most files.

2019-11-03 12:42:39 -08:00

avatar.js

js: Automatically convert var to let and const in most files.

2019-11-03 12:42:39 -08:00

blueslip_stacktrace.ts

blueslip: Make stack trace more readable.

2019-10-31 13:47:54 -07:00

blueslip.js

js: Automatically convert var to let and const in most files.

2019-11-03 12:42:39 -08:00

bot_data.js

js: Automatically convert var to let and const in most files.

2019-11-03 12:42:39 -08:00

buddy_data.js

js: Automatically convert var to let and const in remaining files.

2019-11-20 23:04:01 -08:00

buddy_list.js

js: Automatically convert var to let and const in most files.

2019-11-03 12:42:39 -08:00

channel.js

js: Automatically convert var to let and const in most files.

2019-11-03 12:42:39 -08:00

click_handlers.js

js: Automatically convert var to let and const in more files.

2019-11-20 14:10:47 -08:00

color_data.js

js: Automatically convert var to let and const in most files.

2019-11-03 12:42:39 -08:00

colorspace.js

js: Automatically convert var to let and const in most files.

2019-11-03 12:42:39 -08:00

common.js

js: Automatically convert var to let and const in most files.

2019-11-03 12:42:39 -08:00

components.js

js: Automatically convert var to let and const in most files.

2019-11-03 12:42:39 -08:00

compose_actions.js

typing: Fix invalid typing notifications for stream messages.

2019-12-02 09:31:16 -08:00

compose_fade.js

compose_state: Rename compost_state.recipient to be about PMs only.

2019-12-02 08:53:55 -08:00

compose_pm_pill.js

js: Automatically convert var to let and const in most files.

2019-11-03 12:42:39 -08:00

compose_state.js

compose_state: Rename compost_state.recipient to be about PMs only.

2019-12-02 08:53:55 -08:00

compose_ui.js

js: Automatically convert var to let and const in most files.

2019-11-03 12:42:39 -08:00

compose.js

markdown: Remove redundant checks from /me.

2019-12-03 17:17:10 -08:00

composebox_typeahead.js

js: Automatically convert var to let and const in most files.

2019-11-03 12:42:39 -08:00

condense.js

js: Automatically convert var to let and const in remaining files.

2019-11-20 23:04:01 -08:00

confirm_dialog.js

js: Automatically convert var to let and const in most files.

2019-11-03 12:42:39 -08:00

copy_and_paste.js

js: Automatically convert var to let and const in more files.

2019-11-20 14:10:47 -08:00

csrf.js

js: Automatically convert var to let and const in most files.

2019-11-03 12:42:39 -08:00

debug.js

js: Automatically convert var to let and const in most files.

2019-11-03 12:42:39 -08:00

dict.ts

dependencies: Upgrade @typescript-eslint/eslint-plugin to 1.9.0.

2019-06-03 12:24:00 -07:00

drafts.js

compose_state: Rename compost_state.recipient to be about PMs only.

2019-12-02 08:53:55 -08:00

echo.js

message_edit: Add message edit local echo.

2019-11-20 17:40:19 -08:00

emoji_picker.js

js: Automatically convert var to let and const in most files.

2019-11-03 12:42:39 -08:00

emoji.js

js: Automatically convert var to let and const in most files.

2019-11-03 12:42:39 -08:00

favicon.js

js: Automatically convert var to let and const in most files.

2019-11-03 12:42:39 -08:00

feature_flags.js

js: Purge useless IIFEs.

2019-10-25 13:51:21 -07:00

feedback_widget.js

js: Automatically convert var to let and const in most files.

2019-11-03 12:42:39 -08:00

fenced_code.js

js: Automatically convert var to let and const in most files.

2019-11-03 12:42:39 -08:00

fetch_status.js

js: Automatically convert var to let and const in most files.

2019-11-03 12:42:39 -08:00

filter.js

narrow: Use search reading behavior in all searches.

2019-12-10 16:26:06 -08:00

floating_recipient_bar.js

js: Automatically convert var to let and const in most files.

2019-11-03 12:42:39 -08:00

gear_menu.js

js: Automatically convert var to let and const in most files.

2019-11-03 12:42:39 -08:00

global.d.ts

js: Automatically convert var to let and const in most files.

2019-11-03 12:42:39 -08:00

hash_util.js

js: Automatically convert var to let and const in more files.

2019-11-20 14:10:47 -08:00

hashchange.js

js: Automatically convert var to let and const in most files.

2019-11-03 12:42:39 -08:00

hbs.d.ts

blueslip: Make stack trace more readable.

2019-10-31 13:47:54 -07:00

hotkey.js

js: Automatically convert var to let and const in most files.

2019-11-03 12:42:39 -08:00

hotspots.js

js: Automatically convert var to let and const in most files.

2019-11-03 12:42:39 -08:00

info_overlay.js

js: Automatically convert var to let and const in most files.

2019-11-03 12:42:39 -08:00

input_pill.js

js: Automatically convert var to let and const in most files.

2019-11-03 12:42:39 -08:00

integration_bot_widget.js

js: Automatically convert var to let and const in most files.

2019-11-03 12:42:39 -08:00

invite.js

js: Automatically convert var to let and const in most files.

2019-11-03 12:42:39 -08:00

keydown_util.js

js: Automatically convert var to let and const in most files.

2019-11-03 12:42:39 -08:00

lightbox_canvas.js

js: Automatically convert var to let and const in most files.

2019-11-03 12:42:39 -08:00

lightbox.js

lightbox: Confine embedded video players to a unique origin.

2019-12-12 15:23:15 -08:00

list_cursor.js

js: Automatically convert var to let and const in most files.

2019-11-03 12:42:39 -08:00

list_render.js

js: Automatically convert var to let and const in most files.

2019-11-03 12:42:39 -08:00

list_util.js

js: Automatically convert var to let and const in most files.

2019-11-03 12:42:39 -08:00

loading.js

js: Automatically convert var to let and const in most files.

2019-11-03 12:42:39 -08:00

local_message.js

js: Automatically convert var to let and const in most files.

2019-11-03 12:42:39 -08:00

localstorage.js

js: Automatically convert var to let and const in most files.

2019-11-03 12:42:39 -08:00

markdown.js

markdown: Remove redundant checks from /me.

2019-12-03 17:17:10 -08:00

message_edit.js

js: Automatically convert var to let and const in remaining files.

2019-11-20 23:04:01 -08:00

message_events.js

message_edit: Add message edit local echo.

2019-11-20 17:40:19 -08:00

message_fetch.js

narrow: Fix streams:all notice appearing too early.

2019-12-10 18:10:39 -08:00

message_flags.js

js: Automatically convert var to let and const in most files.

2019-11-03 12:42:39 -08:00

message_list_data.js

js: Automatically convert var to let and const in most files.

2019-11-03 12:42:39 -08:00

message_list_view.js

message_edit: Add message edit local echo.

2019-11-20 17:40:19 -08:00

message_list.js

js: Automatically convert var to let and const in most files.

2019-11-03 12:42:39 -08:00

message_live_update.js

js: Automatically convert var to let and const in most files.

2019-11-03 12:42:39 -08:00

message_scroll.js

js: Automatically convert var to let and const in most files.

2019-11-03 12:42:39 -08:00

message_store.js

pm_conversations: Refactor to sort by message ID.

2019-11-21 17:01:41 -08:00

message_util.js

js: Automatically convert var to let and const in most files.

2019-11-03 12:42:39 -08:00

message_viewport.js

js: Automatically convert var to let and const in most files.

2019-11-03 12:42:39 -08:00

muting_ui.js

dependencies: Upgrade eslint from 6.0.1 to 6.6.0.

2019-11-11 16:26:31 -08:00

muting.js

js: Automatically convert var to let and const in most files.

2019-11-03 12:42:39 -08:00

narrow_state.js

js: Automatically convert var to let and const in most files.

2019-11-03 12:42:39 -08:00

narrow.js

narrow: Clarify streams:public user experience.

2019-12-10 18:36:51 -08:00

navigate.js

js: Automatically convert var to let and const in most files.

2019-11-03 12:42:39 -08:00

night_mode.js

js: Purge useless IIFEs.

2019-10-25 13:51:21 -07:00

notifications.js

notifications: Support wildcard_mentions_notify for desktop.

2019-12-10 13:12:36 -08:00

overlays.js

js: Automatically convert var to let and const in most files.

2019-11-03 12:42:39 -08:00

padded_widget.js

js: Automatically convert var to let and const in most files.

2019-11-03 12:42:39 -08:00

page_params.js

page_params: Throw an error if params are missing.

2019-09-20 10:34:44 -07:00

panels.js

js: Automatically convert var to let and const in most files.

2019-11-03 12:42:39 -08:00

people.js

people: Use Unicode normalization for diacritic removal.

2019-12-09 13:02:54 -08:00

pm_conversations.js

pm_conversations: Initialize using server data.

2019-11-21 17:01:41 -08:00

pm_list.js

js: Automatically convert var to let and const in most files.

2019-11-03 12:42:39 -08:00

pointer.js

js: Automatically convert var to let and const in most files.

2019-11-03 12:42:39 -08:00

poll_widget.js

js: Automatically convert var to let and const in most files.

2019-11-03 12:42:39 -08:00

popovers.js

js: Automatically convert var to let and const in more files.

2019-11-20 14:10:47 -08:00

presence.js

js: Automatically convert var to let and const in most files.

2019-11-03 12:42:39 -08:00

reactions.js

js: Automatically convert var to let and const in most files.

2019-11-03 12:42:39 -08:00

ready.js

templates: Make the Loading… message more robust.

2019-09-20 10:34:44 -07:00

realm_icon.js

js: Automatically convert var to let and const in most files.

2019-11-03 12:42:39 -08:00

realm_logo.js

js: Automatically convert var to let and const in most files.

2019-11-03 12:42:39 -08:00

recent_senders.js

js: Automatically convert var to let and const in most files.

2019-11-03 12:42:39 -08:00

reload_state.js

js: Automatically convert var to let and const in most files.

2019-11-03 12:42:39 -08:00

reload.js

compose_state: Rename compost_state.recipient to be about PMs only.

2019-12-02 08:53:55 -08:00

reminder.js

js: Automatically convert var to let and const in most files.

2019-11-03 12:42:39 -08:00

resize.js

js: Automatically convert var to let and const in most files.

2019-11-03 12:42:39 -08:00

rows.js

js: Automatically convert var to let and const in most files.

2019-11-03 12:42:39 -08:00

rtl.js

js: Automatically convert var to let and const in most files.

2019-11-03 12:42:39 -08:00

schema.js

js: Automatically convert var to let and const in most files.

2019-11-03 12:42:39 -08:00

scroll_bar.js

js: Automatically convert var to let and const in most files.

2019-11-03 12:42:39 -08:00

scroll_util.js

js: Automatically convert var to let and const in most files.

2019-11-03 12:42:39 -08:00

search_pill_widget.js

js: Automatically convert var to let and const in most files.

2019-11-03 12:42:39 -08:00

search_pill.js

js: Automatically convert var to let and const in most files.

2019-11-03 12:42:39 -08:00

search_suggestion.js

js: Automatically convert var to let and const in most files.

2019-11-03 12:42:39 -08:00

search_util.js

js: Automatically convert var to let and const in most files.

2019-11-03 12:42:39 -08:00

search.js

js: Automatically convert var to let and const in most files.

2019-11-03 12:42:39 -08:00

sent_messages.js

js: Automatically convert var to let and const in most files.

2019-11-03 12:42:39 -08:00

server_events_dispatch.js

settings: Add setting for who can edit user groups.

2019-11-03 16:45:13 -08:00

server_events.js

js: Automatically convert var to let and const in most files.

2019-11-03 12:42:39 -08:00

settings_account.js

js: Automatically convert var to let and const in most files.

2019-11-03 12:42:39 -08:00

settings_bots.js

js: Automatically convert var to let and const in most files.

2019-11-03 12:42:39 -08:00

settings_display.js

settings: Change 24-hour setting to dropdown.

2019-11-08 17:35:52 -08:00

settings_emoji.js

js: Automatically convert var to let and const in most files.

2019-11-03 12:42:39 -08:00

settings_exports.js

js: Automatically convert var to let and const in most files.

2019-11-03 12:42:39 -08:00

settings_invites.js

js: Automatically convert var to let and const in most files.

2019-11-03 12:42:39 -08:00

settings_linkifiers.js

js: Automatically convert var to let and const in most files.

2019-11-03 12:42:39 -08:00

settings_muting.js

js: Automatically convert var to let and const in most files.

2019-11-03 12:42:39 -08:00

settings_notifications.js

settings_notifications: Fix linter issue.

2019-11-20 17:16:43 -08:00

settings_org.js

js: Automatically convert var to let and const in more files.

2019-11-20 14:10:47 -08:00

settings_panel_menu.js

js: Automatically convert var to let and const in most files.

2019-11-03 12:42:39 -08:00

settings_profile_fields.js

js: Automatically convert var to let and const in most files.

2019-11-03 12:42:39 -08:00

settings_sections.js

js: Automatically convert var to let and const in most files.

2019-11-03 12:42:39 -08:00

settings_streams.js

js: Automatically convert var to let and const in most files.

2019-11-03 12:42:39 -08:00

settings_toggle.js

js: Automatically convert var to let and const in most files.

2019-11-03 12:42:39 -08:00

settings_ui.js

js: Automatically convert var to let and const in most files.

2019-11-03 12:42:39 -08:00

settings_user_groups.js

js: Automatically convert var to let and const in more files.

2019-11-20 14:10:47 -08:00

settings_users.js

bot settings: Fix sorting by owner.

2019-12-06 12:01:46 -08:00

settings.js

settings: Add notification settings checkboxes for wildcard mentions.

2019-11-20 16:58:46 -08:00

setup.js

js: Extract csrf.js and include in common bundle.

2018-12-16 16:18:42 -08:00

socket.js

dependencies: Upgrade eslint from 6.0.1 to 6.6.0.

2019-11-11 16:26:31 -08:00

starred_messages.js

js: Automatically convert var to let and const in most files.

2019-11-03 12:42:39 -08:00

stream_color.js

js: Automatically convert var to let and const in most files.

2019-11-03 12:42:39 -08:00

stream_create.js

js: Automatically convert var to let and const in more files.

2019-11-20 14:10:47 -08:00

stream_data.js

wildcard_mentions_notify: Add per-stream override of global setting.

2019-12-09 16:09:38 -08:00

stream_edit.js

wildcard_mentions_notify: Add per-stream override of global setting.

2019-12-09 16:09:38 -08:00

stream_events.js

wildcard_mentions_notify: Add per-stream override of global setting.

2019-12-09 16:09:38 -08:00

stream_list.js

topic_list: Limit number of unread topics shown at once.

2019-11-21 13:12:33 -08:00

stream_muting.js

js: Automatically convert var to let and const in most files.

2019-11-03 12:42:39 -08:00

stream_popover.js

js: Automatically convert var to let and const in most files.

2019-11-03 12:42:39 -08:00

stream_sort.js

js: Automatically convert var to let and const in most files.

2019-11-03 12:42:39 -08:00

stream_ui_updates.js

js: Automatically convert var to let and const in most files.

2019-11-03 12:42:39 -08:00

submessage.js

js: Automatically convert var to let and const in most files.

2019-11-03 12:42:39 -08:00

subs.js

stream settings: Fix initialization of main toggler state.

2019-12-02 09:59:13 -08:00

tab_bar.js

js: Automatically convert var to let and const in remaining files.

2019-11-20 23:04:01 -08:00

templates.js

i18n: Fix translation of multi-line strings.

2019-11-20 10:58:15 -08:00

tictactoe_widget.js

js: Automatically convert var to let and const in most files.

2019-11-03 12:42:39 -08:00

timerender.js

js: Automatically convert var to let and const in most files.

2019-11-03 12:42:39 -08:00

todo_widget.js

js: Automatically convert var to let and const in most files.

2019-11-03 12:42:39 -08:00

top_left_corner.js

js: Automatically convert var to let and const in most files.

2019-11-03 12:42:39 -08:00

topic_data.js

js: Automatically convert var to let and const in most files.

2019-11-03 12:42:39 -08:00

topic_generator.js

js: Automatically convert var to let and const in most files.

2019-11-03 12:42:39 -08:00

topic_list.js

topic_list: Limit number of unread topics shown at once.

2019-11-21 13:12:33 -08:00

topic_zoom.js

js: Automatically convert var to let and const in most files.

2019-11-03 12:42:39 -08:00

translations.js

js: Automatically convert var to let and const in most files.

2019-11-03 12:42:39 -08:00

transmit.js

js: Automatically convert var to let and const in most files.

2019-11-03 12:42:39 -08:00

tslint.json

typescript: Move TS files into JS directory.

2019-03-25 12:11:37 -07:00

tutorial.js

js: Purge useless IIFEs.

2019-10-25 13:51:21 -07:00

typeahead_helper.js

js: Automatically convert var to let and const in most files.

2019-11-03 12:42:39 -08:00

typing_data.js

js: Automatically convert var to let and const in most files.

2019-11-03 12:42:39 -08:00

typing_events.js

js: Automatically convert var to let and const in most files.

2019-11-03 12:42:39 -08:00

typing.js

js: Automatically convert var to let and const in most files.

2019-11-03 12:42:39 -08:00

ui_init.js

pm_conversations: Initialize using server data.

2019-11-21 17:01:41 -08:00

ui_report.js

js: Automatically convert var to let and const in most files.

2019-11-03 12:42:39 -08:00

ui_util.js

js: Automatically convert var to let and const in most files.

2019-11-03 12:42:39 -08:00

ui.js

dependencies: Upgrade simplebar from 4.2.3 to 5.0.7.

2019-11-13 12:46:29 -08:00

unread_ops.js

js: Automatically convert var to let and const in most files.

2019-11-03 12:42:39 -08:00

unread_ui.js

js: Automatically convert var to let and const in most files.

2019-11-03 12:42:39 -08:00

unread.js

js: Automatically convert var to let and const in most files.

2019-11-03 12:42:39 -08:00

upload_widget.js

js: Automatically convert var to let and const in most files.

2019-11-03 12:42:39 -08:00

upload.js

js: Automatically convert var to let and const in remaining files.

2019-11-20 23:04:01 -08:00

user_events.js

js: Automatically convert var to let and const in most files.

2019-11-03 12:42:39 -08:00

user_groups.js

js: Automatically convert var to let and const in most files.

2019-11-03 12:42:39 -08:00

user_pill.js

js: Automatically convert var to let and const in most files.

2019-11-03 12:42:39 -08:00

user_search.js

js: Automatically convert var to let and const in most files.

2019-11-03 12:42:39 -08:00

user_status_ui.js

js: Automatically convert var to let and const in most files.

2019-11-03 12:42:39 -08:00

user_status.js

js: Automatically convert var to let and const in most files.

2019-11-03 12:42:39 -08:00

util.js

js: Automatically convert var to let and const in most files.

2019-11-03 12:42:39 -08:00

widgetize.js

js: Automatically convert var to let and const in most files.

2019-11-03 12:42:39 -08:00

zcommand.js

js: Automatically convert var to let and const in most files.

2019-11-03 12:42:39 -08:00

zform.js

js: Automatically convert var to let and const in most files.

2019-11-03 12:42:39 -08:00

zulip.js

js: Automatically convert var to let and const in most files.

2019-11-03 12:42:39 -08:00