Giter Site home page Giter Site logo

yaniswang / xheditor Goto Github PK

View Code? Open in Web Editor NEW
242.0 27.0 80.0 2 MB

xhEditor是一个基于jQuery开发的简单迷你并且高效的在线可视化HTML编辑器。

Home Page: http://xheditor.com/

License: GNU Lesser General Public License v3.0

HTML 12.29% PHP 31.81% JavaScript 44.71% CSS 6.41% ASP 4.78%

xheditor's Issues

xhEditor与bootstrap有冲突

bootstrap中有一个“按钮 button.js”
http://v3.bootcss.com/javascript/#buttons-stateful

在页面加如这种按钮的特效后，会提示错误

<script>
  $('#myButton').on('click', function () {
    var $btn = $(this).button('loading')
    // business logic...
    $btn.button('reset')
  })
</script>

JS错误:
Uncaught Error: cannot call methods on button prior to initialization; attempted to call method 'loading'

去掉“按钮 button.js”的调用，或者是去掉xhEditor，就正常了。

ubb error

编辑文章开头同时使用字体颜色和背景颜色，ubb标签嵌套关系出错。

其他情况下复杂样式也会出错

不能readonly

readonly和disabled都无效，建议增加api readonly(true|false)

不支持高版本主要原因是$.browser

以下是我对源代码的修改，或许可以帮到你。

var agent=navigator.userAgent.toLowerCase(),
    browserMath = /(chrome)[ \/]([\w.]+)/.exec( agent ) ||
    /(webkit)[ \/]([\w.]+)/.exec( agent ) ||
    /(opera)(?:.*version|)[ \/]([\w.]+)/.exec( agent ) ||
    /(msie) ([\w.]+)/.exec( agent ) ||
    agent.indexOf("compatible") < 0 && /(mozilla)(?:.*? rv:([\w.]+)|)/.exec( agent ) ||
    [],
    browser = {};
if ( browserMath ) {
    browser[ browserMath.browser ] = true;
    browser.version = browserMath.version;
}
// Chrome is Webkit, but Webkit is also Safari.
if ( browser.chrome ) {
    browser.webkit = true;
} else if ( browser.webkit ) {
    browser.safari = true;
}

var bMobile=/mobile/i.test(agent),
    browerVer=parseFloat(browser.version),
    isIE=browser.msie,
    isMozilla=browser.mozilla,
    isWebkit=browser.webkit,
    isOpera=browser.opera,
    isChrome=browser.chrome,
    bAir=agent.indexOf(' adobeair/')>-1;

XSS vulnerability in source code view

The editor's source code view allows attacker to bypass the input validation in default view by injecting javascript using IFRAME element.

Proof of Concept:
Injected the the payload <IFRAME SRC="javascript:alert('XSS');"></IFRAME> into the editor's source code view.

不支持jQuery 1.9

好像是取浏览器版本时出问题，可有替代方案？除了jQuery的那个降级插件外还有没有其它解决办法？

匹配空行正则的问题

今天在使用xhEditor的时，发现在提交的时候非常的缓慢。通过CPU性能排查，发现了主要是这一行的问题：

a = a.replace(/^\s*(?:<(p|div)(?:\s+[^>]*?)?>)?\s*(<span(?:\s+[^>]*?)?>\s*<\/span>|<br(?:\s+[^>]*?)?>|&nbsp;)*\s*(?:<\/\1>)?\s*$/i, "");

然后我的输入时是这个：

var a = "                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                 故障原因：测绘一下啊<br>故障进展："

用node测试结果如下：
image

完整的是这个

var a = "                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                 故障原因：测绘一下啊<br>故障进展："
a = a.replace(/^\s*(?:<(p|div)(?:\s+[^>]*?)?>)?\s*(<span(?:\s+[^>]*?)?>\s*<\/span>|<br(?:\s+[^>]*?)?>|&nbsp;)*\s*(?:<\/\1>)?\s*$/i, "");

这个需要优化一下吗？还是需要我尽量避免这样的输入？谢啦>_<
(PS:不是很理解为何这句正则会运行这么慢，不知道作者能否帮我解惑一下？)

jquery 3.5.1 compatibility

there are some empty span tags that are coded by the script.... and are wrongly expanded by jquery/browser as per changes in jquery 3.5.1 documentation.

please see in main.js such span tags like

<span ....... />

I suggest,
please change all such occurrences with

<span........></span>

HTH
Thanks

chrome 多图上传的bug

注释的地方是bug.注释下面的一行是修改成功的。
this.showImg = function() {
var a = $(getLang(htmlImg)),
b = _this.getParent("img"),
c = $("#xheImgUrl", a),
d = $("#xheImgAlt", a),
e = $("#xheImgAlign", a),
f = $("#xheImgWidth", a),
g = $("#xheImgHeight", a),
h = $("#xheImgBorder", a),
i = $("#xheImgVspace", a),
j = $("#xheImgHspace", a),
k = $("#xheSave", a);
if (1 === b.length) {
c.val(xheAttr(b, "src")),
d.val(b.attr("alt")),
e.val(b.attr("align")),
f.val(b.attr("width")),
g.val(b.attr("height")),
h.val(b.attr("border"));
var l = b.attr("vspace"),
m = b.attr("hspace");
i.val(0 >= l ? "": l),
j.val(0 >= m ? "": m)
}
settings.upImgUrl && _this.uploadInit(c, settings.upImgUrl, settings.upImgExt),
k.click(function() {
_this.loadBookmark();
var a = c.val();
if ("" !== a && "http://" !== a) {
var k = a.toString().split(" "),
l = d.val(),
m = e.val(),
n = f.val(),
o = g.val(),
p = h.val(),
q = i.val(),
r = j.val();
if (k.length > 1) {
var s, t = '<img src="xhe_tmpurl"',
u = [];
"" !== l && (t += ' alt="' + l + '"'),
"" !== m && (t += ' align="' + m + '"'),
"" !== n && (t += ' width="' + n + '"'),
"" !== o && (t += ' height="' + o + '"'),
"" !== p && (t += ' border="' + p + '"'),
"" !== q && (t += ' vspace="' + q + '"'),
"" !== r && (t += ' hspace="' + r + '"'),
t += " />";
//for (var v in k) a = k[v],
for (var v=0,len=k.length;v<len;v++) a = k[v],
"" !== a &&
(
//a = a.split("||"),
a = a.toString().split("||"),
s = t, s = s.replace("xhe_tmpurl", a[0]),
a[1] && (s = '' + s + ""),
u.push(s)
);

                    _this.pasteHTML(u.join("&nbsp;"))
                } else if (1 === k.length && (a = k[0], "" !== a && (a = a.split("||"), 0 === b.length && (_this.pasteHTML('<img src="' + a[0] + '#xhe_tmpurl" />'), b = $('img[src$="#xhe_tmpurl"]', _doc)), xheAttr(b, "src", a[0]), "" !== l && b.attr("alt", l), "" !== m ? b.attr("align", m) : b.removeAttr("align"), "" !== n ? b.attr("width", n) : b.removeAttr("width"), "" !== o ? b.attr("height", o) : b.removeAttr("height"), "" !== p ? b.attr("border", p) : b.removeAttr("border"), "" !== q ? b.attr("vspace", q) : b.removeAttr("vspace"), "" !== r ? b.attr("hspace", r) : b.removeAttr("hspace"), a[1]))) {
                    var w = b.parent("a");
                    0 === w.length && (b.wrap("<a></a>"), w = b.parent("a")),
                    xheAttr(w, "href", a[1]),
                    w.attr("target", "_blank")
                }
            } else 1 === b.length && b.remove();
            return _this.hidePanel(),
            !1
        }),
        _this.saveBookmark(),
        _this.showDialog(a)
    },

强悍

66666666，完美兼容ie678

xhEditor demo12 : 远程抓图&剪切板图片粘贴上传

在你们官网演示这里，我复制本地或网上的图片，粘贴进去，会一直显示加载。。，根本无法实现远程抓图&剪切板图片粘贴上传，我用的是最新的火狐和chrome，都不行，希望能解决，很期待。

New XSS vulnerability in source code view

The editor's source code view allows attacker to bypass the input validation in default view by injecting javascript using details.
payload:
Injected the the payload <details ontoggle="alert(1)"> into the editor's source code view.

粘贴自动上传图片功能有Bug

粘贴远程图片后，第一张图片丢失。看源码，发现img标签被转义
default
在前台显示为<img src=""" size="71979" alt="">后台则是&标记的形式。
PS：我的服务器把图片转换为dataurlBase64的形式，如果取图失败会直接返回图片原址，以“|”分隔返回图片组（在官方说明里没看到参数和返回的规范）。

添加多级列表的bug

添加多级列表时，数字列表序号错误，如：
1.-------------
2.-------------
2.1-----------
2.2-----------
1.-------------
2.-------------
3.-------------

火狐浏览器下粘贴截图时 报错

xheditor/src/main.js 2090行 火狐底下报错 ReferenceError: event is not defined

default

我改成这样如何

default

另外吐槽：这个网站粘贴图片上传很吃力，粘贴10次，才成功2次。

让xhEdit支持AMD

不知为什么作者都没有维护了，好几个项目都用。

这里我用的requirejs，虽然支持非AMD格式的JS，但是xhEditor要让他支持还需要一点手术刀。

主要是原来根据是script[src*=xheditor]来判断editor的根目录，因为这里涉及到资源加载。但是如果按AMD的方式来加载肯定无法获取正确值。

以下是我做了修改部分，目前都正常使用功能。

$('script[src*=xheditor]').each(function(){
    var s=this.src;
    if(s.match(/xheditor[^\/]*\.js/i)){editorRoot=s.replace(/[\?#].*$/, '').replace(/(^|[\/\\])[^\/]*$/, '$1');return false;}
});
// editorRoot 编辑器根目录，为了支持AMD，尝试直接通过HTML中查找
if (!editorRoot) {
    editorRoot = $('.xheditor_config').first().attr('data-editorRoot');
}

页面需要加入

<textarea name="intro" id="intro" class="xheditor_config" data-editorroot="/r/libs/xheditor/"></textarea>

xhEditor1.2.2在ie8上面发现一个bug

用ie8打开官网的演示地址，然后插入一个表情图片，会发现鼠标焦点无法聚焦到表情图片的后面，导致图片后面无法再输入文字，上传一张图片后，也是一样的效果，后面无法再输入文字，希望能修复一下这个bug，毕竟现在ie8使用的还是挺多的。

Recommend Projects

  • React photo React

    A declarative, efficient, and flexible JavaScript library for building user interfaces.

  • Vue.js photo Vue.js

    🖖 Vue.js is a progressive, incrementally-adoptable JavaScript framework for building UI on the web.

  • Typescript photo Typescript

    TypeScript is a superset of JavaScript that compiles to clean JavaScript output.

  • TensorFlow photo TensorFlow

    An Open Source Machine Learning Framework for Everyone

  • Django photo Django

    The Web framework for perfectionists with deadlines.

  • D3 photo D3

    Bring data to life with SVG, Canvas and HTML. 📊📈🎉

Recommend Topics

  • javascript

    JavaScript (JS) is a lightweight interpreted programming language with first-class functions.

  • web

    Some thing interesting about web. New door for the world.

  • server

    A server is a program made to process requests and deliver data to clients.

  • Machine learning

    Machine learning is a way of modeling and interpreting data that allows a piece of software to respond intelligently.

  • Game

    Some thing interesting about game, make everyone happy.

Recommend Org

  • Facebook photo Facebook

    We are working to build community through open source technology. NB: members must have two-factor auth.

  • Microsoft photo Microsoft

    Open source projects and samples from Microsoft.

  • Google photo Google

    Google ❤️ Open Source for everyone.

  • D3 photo D3

    Data-Driven Documents codes.