L-electron-Rare/moodle
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

MDL-85557 tiny_equation: Sanitise equation preview input

Browse Source
This commit is contained in:
David Woloszyn
2025-11-27 11:50:19 +00:00
committed by Jenkins
parent 4e47698ca9
commit ec12af83dd
7 changed files with 21 additions and 10 deletions
Download Patch File Download Diff File Expand all files Collapse all files
lib/editor/tiny/plugins/equation/amd/build/repository.min.js
Vendored
+1 -1
View File
@@ -5,6 +5,6 @@ define("tiny_equation/repository",["exports","core/ajax"],(function(_exports,_aj
* @module tiny_equation/repository
* @copyright 2022 Huong Nguyen <huongnv13@gmail.com>
* @license http://www.gnu.org/copyleft/gpl.html GNU GPL v3 or later
*/Object.defineProperty(_exports,"__esModule",{value:!0}),_exports.filterEquation=void 0,_ajax=(obj=_ajax)&&obj.__esModule?obj:{default:obj};_exports.filterEquation=(contextId,content)=>{const request={methodname:"tiny_equation_filter",args:{contextid:contextId,content:content}};return _ajax.default.call([request])[0]}}));
*/Object.defineProperty(_exports,"__esModule",{value:!0}),_exports.filterEquation=void 0,_ajax=(obj=_ajax)&&obj.__esModule?obj:{default:obj};_exports.filterEquation=function(contextId,content){let stripTags=arguments.length>2&&void 0!==arguments[2]&&arguments[2];const request={methodname:"tiny_equation_filter",args:{contextid:contextId,content:content,striptags:stripTags}};return _ajax.default.call([request])[0]}}));
//# sourceMappingURL=repository.min.js.map
lib/editor/tiny/plugins/equation/amd/build/repository.min.js.map
+1 -1
View File
@@ -1 +1 @@
{"version":3,"file":"repository.min.js","sources":["../src/repository.js"],"sourcesContent":["// This file is part of Moodle - http://moodle.org/\n//\n// Moodle is free software: you can redistribute it and/or modify\n// it under the terms of the GNU General Public License as published by\n// the Free Software Foundation, either version 3 of the License, or\n// (at your option) any later version.\n//\n// Moodle is distributed in the hope that it will be useful,\n// but WITHOUT ANY WARRANTY; without even the implied warranty of\n// MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the\n// GNU General Public License for more details.\n//\n// You should have received a copy of the GNU General Public License\n// along with Moodle. If not, see <http://www.gnu.org/licenses/>.\n\n/**\n * A javascript module to handle TinyMCE Equation ajax actions.\n *\n * @module tiny_equation/repository\n * @copyright 2022 Huong Nguyen <[email protected]>\n * @license http://www.gnu.org/copyleft/gpl.html GNU GPL v3 or later\n */\nimport Ajax from 'core/ajax';\n\n/**\n * Filter the equation for given content.\n *\n * @param {Number} contextId The context id\n * @param {String} content Content to filter\n * @return {promise}\n */\nexport const filterEquation = (contextId, content) => {\n const request = {\n methodname: 'tiny_equation_filter',\n args: {\n contextid: contextId,\n content: content,\n }\n };\n\n return Ajax.call([request])[0];\n};\n"],"names":["contextId","content","request","methodname","args","contextid","Ajax","call"],"mappings":";;;;;;;wKA+B8B,CAACA,UAAWC,iBAChCC,QAAU,CACZC,WAAY,uBACZC,KAAM,CACFC,UAAWL,UACXC,QAASA,iBAIVK,cAAKC,KAAK,CAACL,UAAU"}
{"version":3,"file":"repository.min.js","sources":["../src/repository.js"],"sourcesContent":["// This file is part of Moodle - http://moodle.org/\n//\n// Moodle is free software: you can redistribute it and/or modify\n// it under the terms of the GNU General Public License as published by\n// the Free Software Foundation, either version 3 of the License, or\n// (at your option) any later version.\n//\n// Moodle is distributed in the hope that it will be useful,\n// but WITHOUT ANY WARRANTY; without even the implied warranty of\n// MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the\n// GNU General Public License for more details.\n//\n// You should have received a copy of the GNU General Public License\n// along with Moodle. If not, see <http://www.gnu.org/licenses/>.\n\n/**\n * A javascript module to handle TinyMCE Equation ajax actions.\n *\n * @module tiny_equation/repository\n * @copyright 2022 Huong Nguyen <[email protected]>\n * @license http://www.gnu.org/copyleft/gpl.html GNU GPL v3 or later\n */\nimport Ajax from 'core/ajax';\n\n/**\n * Filter the equation for given content.\n *\n * @param {Number} contextId The context id\n * @param {String} content Content to filter\n * @param {Bool} stripTags Whether to strip HTML tags (optional)\n * @return {promise}\n */\nexport const filterEquation = (contextId, content, stripTags = false) => {\n const request = {\n methodname: 'tiny_equation_filter',\n args: {\n contextid: contextId,\n content: content,\n striptags: stripTags,\n }\n };\n\n return Ajax.call([request])[0];\n};\n"],"names":["contextId","content","stripTags","request","methodname","args","contextid","striptags","Ajax","call"],"mappings":";;;;;;;wKAgC8B,SAACA,UAAWC,aAASC,wEACzCC,QAAU,CACZC,WAAY,uBACZC,KAAM,CACFC,UAAWN,UACXC,QAASA,QACTM,UAAWL,mBAIZM,cAAKC,KAAK,CAACN,UAAU"}
lib/editor/tiny/plugins/equation/amd/build/ui.min.js
Vendored
+1 -1
View File
File diff suppressed because one or more lines are too long
lib/editor/tiny/plugins/equation/amd/build/ui.min.js.map
+1 -1
View File
File diff suppressed because one or more lines are too long
lib/editor/tiny/plugins/equation/amd/src/repository.js
+3 -1
View File
@@ -27,14 +27,16 @@ import Ajax from 'core/ajax';
*
* @param {Number} contextId The context id
* @param {String} content Content to filter
* @param {Bool} stripTags Whether to strip HTML tags (optional)
* @return {promise}
*/
export const filterEquation = (contextId, content) => {
export const filterEquation = (contextId, content, stripTags = false) => {
const request = {
methodname: 'tiny_equation_filter',
args: {
contextid: contextId,
content: content,
striptags: stripTags,
}
};
lib/editor/tiny/plugins/equation/amd/src/ui.js
+1 -1
View File
@@ -211,7 +211,7 @@ const updatePreview = (contextId) => {
equation = prefix + equation.substring(0, currentPos) + cursorLatex + equation.substring(currentPos);
equation = Selectors.delimiters.start + ' ' + equation + ' ' + Selectors.delimiters.end;
TinyEquationRepository.filterEquation(contextId, equation).then((data) => {
TinyEquationRepository.filterEquation(contextId, equation, true).then((data) => {
preview.innerHTML = data.content;
notifyFilter(preview);
lib/editor/tiny/plugins/equation/classes/external/filter.php
Vendored
+13 -4
View File
@@ -49,7 +49,8 @@ class filter extends external_api {
public static function execute_parameters(): external_function_parameters {
return new external_function_parameters([
'contextid' => new external_value(PARAM_INT, 'The context ID', VALUE_REQUIRED),
'content' => new external_value(PARAM_RAW, 'The equation content', VALUE_REQUIRED)
'content' => new external_value(PARAM_RAW, 'The equation content', VALUE_REQUIRED),
'striptags' => new external_value(PARAM_BOOL, 'Whether to strip HTML tags', VALUE_DEFAULT, false),
]);
}
@@ -58,18 +59,26 @@ class filter extends external_api {
*
* @param int $contextid Context ID.
* @param string $content Equation content.
* @param string $striptags Strip HTML tags.
* @return array
* @since Moodle 4.1
*/
public static function execute(int $contextid, string $content): array {
public static function execute(int $contextid, string $content, bool $striptags = false): array {
[
'contextid' => $contextid,
'content' => $content
'content' => $content,
'striptags' => $striptags,
] = self::validate_parameters(self::execute_parameters(), [
'contextid' => $contextid,
'content' => $content
'content' => $content,
'striptags' => $striptags,
]);
// Strip all HTML tags before filtering the text (avoiding XSS risk).
if ($striptags) {
$content = clean_param($content, PARAM_NOTAGS);
}
$context = context::instance_by_id($contextid);
self::validate_context($context);
$result = filter_manager::instance()->filter_text($content, $context);