@@ -31,9 +31,9 @@ $.fn.dropdown = function(parameters) {
31
31
moduleSelector = $allModules . selector || '' ,
32
32
33
33
hasTouch = ( 'ontouchstart' in document . documentElement ) ,
34
- clickEvent = hasTouch
35
- ? 'touchstart'
36
- : 'click' ,
34
+ // GITEA-PATCH: always "click" as clickEvent, old code used "touchstart" as clickEvent, it is wrong,
35
+ // because "touchstart" caused problems when users try to scroll and the touch point is in the dropdown.
36
+ clickEvent = 'click' ,
37
37
38
38
time = new Date ( ) . getTime ( ) ,
39
39
performance = [ ] ,
@@ -768,7 +768,7 @@ $.fn.dropdown = function(parameters) {
768
768
preSelected = preSelected && preSelected !== "" ? preSelected . split ( settings . delimiter ) : [ ] ;
769
769
}
770
770
$ . each ( preSelected , function ( index , value ) {
771
- $item . filter ( '[data-value="' + value + '"]' )
771
+ $item . filter ( '[data-value="' + CSS . escape ( value ) + '"]' ) // GITEA-PATCH: use "CSS.escape" for query selector
772
772
. addClass ( className . filtered )
773
773
;
774
774
} ) ;
@@ -1027,7 +1027,7 @@ $.fn.dropdown = function(parameters) {
1027
1027
$input . append ( '<option disabled selected value></option>' ) ;
1028
1028
$ . each ( values , function ( index , item ) {
1029
1029
var
1030
- value = settings . templates . deQuote ( item [ fields . value ] ) ,
1030
+ value = settings . templates . escape ( item [ fields . value ] ) , // GITEA-PATCH: use "escape" for attribute value
1031
1031
name = settings . templates . escape (
1032
1032
item [ fields . name ] || '' ,
1033
1033
settings . preserveHTML
@@ -4180,13 +4180,14 @@ $.fn.dropdown.settings.templates = {
4180
4180
if ( itemType === 'item' ) {
4181
4181
var
4182
4182
maybeText = ( option [ fields . text ] )
4183
- ? ' data-text="' + deQuote ( option [ fields . text ] ) + '"'
4183
+ ? ' data-text="' + escape ( option [ fields . text ] ) + '"' // GITEA-PATCH: use "escape" for attribute value
4184
4184
: '' ,
4185
4185
maybeDisabled = ( option [ fields . disabled ] )
4186
4186
? className . disabled + ' '
4187
4187
: ''
4188
4188
;
4189
- html += '<div class="' + maybeDisabled + ( option [ fields . class ] ? deQuote ( option [ fields . class ] ) : className . item ) + '" data-value="' + deQuote ( option [ fields . value ] ) + '"' + maybeText + '>' ;
4189
+ // GITEA-PATCH: use "escape" for attribute value
4190
+ html += '<div class="' + maybeDisabled + ( option [ fields . class ] ? deQuote ( option [ fields . class ] ) : className . item ) + '" data-value="' + escape ( option [ fields . value ] ) + '"' + maybeText + '>' ;
4190
4191
if ( option [ fields . image ] ) {
4191
4192
html += '<img class="' + ( option [ fields . imageClass ] ? deQuote ( option [ fields . imageClass ] ) : className . image ) + '" src="' + deQuote ( option [ fields . image ] ) + '">' ;
4192
4193
}
0 commit comments