Julien Cristau <julien.cristau@logilab.fr> [Tue, 11 Feb 2014 13:50:29 +0100] rev 9525
[navigation] use add_onload instead of inline javascript href
This way our javascript code isn't thrown out by the html cleaner e.g. when
using the rql rest directive and a table view.
Closes #3501626
Julien Cristau <julien.cristau@logilab.fr> [Wed, 05 Feb 2014 15:50:36 +0100] rev 9524
[uilib] allow canvas tags in the html cleaner
Used by the iprogress cube. Closes #3524254.
Julien Cristau <julien.cristau@logilab.fr> [Wed, 05 Feb 2014 16:34:21 +0100] rev 9523
[ajax] use a custom tag to handle dynamically loaded js
Using <pre class="script"> makes it trivial for a malicious user to
inject arbitrary javascript into a html or rest text element (because it
looks innocent to the html sanitizer). Using a custom tag we can be
sure that it actually comes from our code and not from untrusted user
data. IE ignores custom tags, though, so we put it in its own namespace.
https://extranet.logilab.fr/1530578
Aurelien Campeas <aurelien.campeas@logilab.fr> [Mon, 03 Feb 2014 19:07:58 +0100] rev 9522
[dataimport] fix comment
Aurelien Campeas <aurelien.campeas@logilab.fr> [Wed, 12 Feb 2014 18:15:32 +0100] rev 9521
[hooks/security, devtools/fill] silence yams 0.38.0 warnings
Florent Cayré <florent.cayre@logilab.fr> [Mon, 03 Feb 2014 16:30:07 +0100] rev 9520
Drop 3.13 incomplete backward compat in edit controller.
It is very old and broken (there is another non-backward-copmpatible
usage of `_cw_entity_fields`), better to remove it instead of fixing.
Closes #3515223.
Julien Cristau <julien.cristau@logilab.fr> [Mon, 10 Feb 2014 16:06:16 +0100] rev 9519
[devtools] force locale to C for postgresql test clusters
Avoids initdb failure with e.g. iso8859-X locale and utf-8 encoding.