From 3a89cea7f71c2a818a610b62134cc6f3a88b4d5f Mon Sep 17 00:00:00 2001 From: Andrew Nicols Date: Tue, 10 Feb 2015 15:04:12 +0800 Subject: [PATCH] MDL-49144 blocks: Sanitise alt and title for block controls --- lib/javascript-static.js | 28 +++++++++++++++++++++++----- 1 file changed, 23 insertions(+), 5 deletions(-) diff --git a/lib/javascript-static.js b/lib/javascript-static.js index 87f57575fdf..955b75e8bc1 100644 --- a/lib/javascript-static.js +++ b/lib/javascript-static.js @@ -597,14 +597,32 @@ M.util.init_block_hider = function(Y, config) { this.set('block', '#'+this.get('id')); var b = this.get('block'), t = b.one('.title'), - a = null; + a = null, + hide, + show; if (t && (a = t.one('.block_action'))) { - var hide = Y.Node.create(''+config.tooltipVisible+''); - hide.setAttribute('src', this.get('iconVisible')).on('click', this.updateState, this, true); + hide = Y.Node.create('') + .addClass('block-hider-hide') + .setAttrs({ + alt: config.tooltipVisible, + src: this.get('iconVisible'), + tabindex: 0, + 'title': config.tooltipVisible + }); hide.on('keypress', this.updateStateKey, this, true); - var show = Y.Node.create(''+config.tooltipHidden+''); - show.setAttribute('src', this.get('iconHidden')).on('click', this.updateState, this, false); + hide.on('click', this.updateState, this, true); + + show = Y.Node.create('') + .addClass('block-hider-show') + .setAttrs({ + alt: config.tooltipHidden, + src: this.get('iconHidden'), + tabindex: 0, + 'title': config.tooltipHidden + }); show.on('keypress', this.updateStateKey, this, false); + show.on('click', this.updateState, this, false); + a.insert(show, 0).insert(hide, 0); } },