From f836473129819c2e348f821ed268451b9b8bf2e4 Mon Sep 17 00:00:00 2001
From: Jacob Thornton <jacobthornton@gmail.com>
Date: Sat, 2 Jun 2012 17:55:10 -0700
Subject: add html option back to tooltip and popover to explicitly prevent XSS
 #3421

---
 js/bootstrap-popover.js |  4 ++--
 js/bootstrap-tooltip.js | 12 ++----------
 2 files changed, 4 insertions(+), 12 deletions(-)

(limited to 'js')

diff --git a/js/bootstrap-popover.js b/js/bootstrap-popover.js
index 39fbe358e..c6c1f8b47 100644
--- a/js/bootstrap-popover.js
+++ b/js/bootstrap-popover.js
@@ -43,8 +43,8 @@
         , title = this.getTitle()
         , content = this.getContent()
 
-      $tip.find('.popover-title')[this.isHTML(title) ? 'html' : 'text'](title)
-      $tip.find('.popover-content > *')[this.isHTML(content) ? 'html' : 'text'](content)
+      $tip.find('.popover-title')[this.options.html ? 'html' : 'text'](title)
+      $tip.find('.popover-content > *')[this.options.html ? 'html' : 'text'](content)
 
       $tip.removeClass('fade top bottom left right in')
     }
diff --git a/js/bootstrap-tooltip.js b/js/bootstrap-tooltip.js
index b476f1c4e..f5f9fad3f 100644
--- a/js/bootstrap-tooltip.js
+++ b/js/bootstrap-tooltip.js
@@ -148,20 +148,11 @@
       }
     }
 
-  , isHTML: function(text) {
-      // html string detection logic adapted from jQuery
-      return typeof text != 'string'
-        || ( text.charAt(0) === "<"
-          && text.charAt( text.length - 1 ) === ">"
-          && text.length >= 3
-        ) || /^(?:[^<]*<[\w\W]+>[^>]*$)/.exec(text)
-    }
-
   , setContent: function () {
       var $tip = this.tip()
         , title = this.getTitle()
 
-      $tip.find('.tooltip-inner')[this.isHTML(title) ? 'html' : 'text'](title)
+      $tip.find('.tooltip-inner')[this.options.html ? 'html' : 'text'](title)
       $tip.removeClass('fade in top bottom left right')
     }
 
@@ -270,6 +261,7 @@
   , trigger: 'hover'
   , title: ''
   , delay: 0
+  , html: true
   }
 
 }(window.jQuery);
-- 
cgit v1.2.3