Opened 12 years ago
Closed 11 years ago
#23681 closed defect (bug) (fixed)
jQuery 1.9 doesn't like leading whitespace from wp_ajax_add_menu_item
Reported by: |
|
Owned by: |
|
---|---|---|---|
Milestone: | 3.7 | Priority: | normal |
Severity: | normal | Version: | 3.6 |
Component: | Menus | Keywords: | has-patch 3.7-early |
Focuses: | Cc: |
Description
jquery-migrate logs this message to the console when adding a new menu item:
JQMIGRATE: $(html) HTML strings must start with '<' character
Walker_Nav_Menu_Edit returns a <li> indented with two tabs because there's inline HTML in that class and it's indented. jQuery 1.9 rejects HTML strings with leading whitespace for security reasons.
(Note: this is probably why jquery-migrate is calling parseHTML instead of using a regex in #23055)
This patch uses $.parseHTML on the HTML fragment instead of passing it directly to $(). As it's written, $.parseHTML will strip out any scripts in the fragment for security reasons. If you think a plugin might include a script for some reason, the call should be changed to $.parseHTML(menuMarkup, document, true).
Attachments (4)
Change History (15)
#2
@
12 years ago
Custom fields are also affected: ticket:22975:17.
#3
@
12 years ago
jQuery 1.10.0 (#24426) has relaxed the HTML parsing, means it supports a leading whitespace again. But:
We still strongly advise that you use $.parseHTML() when parsing HTML obtained from external sources, and may be making further changes to HTML parsing in the future.
http://blog.jquery.com/2013/05/24/jquery-1-10-0-and-2-0-1-released/
#4
@
12 years ago
23681.patch calls $.parseHTML
on custom fields too. Here we get an array with two DOM nodes, the first one is an empty line, means text. So we have to pass the second index to jQuery.
#5
@
12 years ago
Perhaps $.trim()
would be faster (suggested in ticket:22975:21)?
#6
follow-up:
↓ 7
@
12 years ago
FWIW, custom fields work fine in trunk, see ticket:22975:30.
#7
in reply to:
↑ 6
@
12 years ago
Replying to SergeyBiryukov:
FWIW, custom fields work fine in trunk, see ticket:22975:30.
Yes, but you don't know how long, see comment:3. $.trim()
is a good idea. Testing.
#8
@
12 years ago
- Keywords 3.7-early added
- Milestone changed from 3.6 to Future Release
This good to go? We can always just wait until 3.7, as 3.6.x will be shipping with 1.10.x.
Call $.parseHTML instead of $()