Charitable – Donation & Fundraising Platform (Donation Forms, Recurring Donations & Fundraising Campaigns) / 1.8.13

Charitable – Donation & Fundraising Platform (Donation Forms, Recurring Donations & Fundraising Campaigns) v1.8.13

charitable / assets / js / campaign-builder / utils.js

utils.js in Charitable – Donation & Fundraising Platform (Donation Forms, Recurring Donations & Fundraising Campaigns) 1.8.13, at assets/js/campaign-builder/utils.js

192 lines 6.0 KB

Raw Download Zip

1	'use strict';
2
3	// eslint-disable-next-line no-unused-vars
4	const CharitableUtils = window.CharitableUtils \|\| ( function( document, window, $ ) {
5
6	/**
7	* Characters removed from user-entered headlines, labels and titles.
8	*
9	* This is a denylist on purpose. The previous allowlist only permitted ASCII
10	* word characters plus the Latin Extended blocks, so every non-Latin script
11	* (Japanese, Chinese, Korean, Cyrillic, Greek, Arabic, Hebrew, Thai,
12	* Devanagari) was silently deleted as the user typed. An allowlist widened to
13	* \p{L}\p{N}\p{M}\p{Zs} still drops the punctuation those languages actually
14	* use, so bare kanji would survive while "今すぐ寄付！" quietly lost its
15	* fullwidth "！" and "寄付する。" lost its kuten.
16	*
17	* Escaping is handled server side -- generate_text() strips quotes and runs
18	* esc_html() before echoing into a value attribute, and every output path
19	* uses esc_html() -- so this is belt and braces. It only needs to remove the
20	* characters that could break an HTML context, plus control characters.
21	*
22	* Deliberately NOT stripped, despite looking like candidates:
23	*
24	* - Bidi marks and isolates (U+200E/U+200F, U+202A-U+202E, U+2066-U+2069) and
25	* zero-width joiners (U+200B-U+200D, U+FEFF). Removing these would break the
26	* very languages this fix exists to support: RLM/LRM are load-bearing in
27	* Arabic and Hebrew, and ZWNJ/ZWJ are required in Persian, Arabic and Indic
28	* scripts and in emoji sequences. They carry a theoretical display-spoofing
29	* risk, but the author already needs campaign-edit capability, so spoofing
30	* their own button label grants them nothing.
31	* - HTML entity text such as "<script>". innerHTML decodes entities into
32	* text nodes rather than re-parsing them as markup, so they cannot create an
33	* element. Verified.
34	*
35	* @since 1.8.12.3
36	*
37	* @type {RegExp}
38	*/
39	const UNSAFE_TEXT_CHARS = /[<>`]\|[\u0000-\u001F\u007F-\u009F]/g; // eslint-disable-line no-control-regex
40
41	/**
42	* Strip the unsafe characters from a value, tolerating non-string input.
43	*
44	* Non-strings return '' rather than being coerced. The previous implementation
45	* called .replace() directly and so threw a TypeError on null, undefined and
46	* numbers alike; coercing with String() instead would put the literal text
47	* "null" or "[object Object]" into a campaign field, which is worse than
48	* either. Every real caller passes a jQuery .val(), which is always a string.
49	*
50	* @since 1.8.12.3
51	*
52	* @param {string} stringValue The text, usually coming from user input.
53	*
54	* @returns {string} The cleaned string.
55	*/
56	function stripUnsafeText( stringValue ) {
57
58	return 'string' === typeof stringValue ? stringValue.replace( UNSAFE_TEXT_CHARS, '' ) : '';
59
60	}
61
62	/**
63	* Public functions and properties.
64	*
65	* @since 1.8.0
66	*
67	* @type {object}
68	*/
69	const app = {
70
71	/**
72	* function that prevents certain HTML/JS/etc characters from being inputted into headlines, campaign titles, etc.
73	*
74	* @since 1.8.0
75	* @since 1.8.12.3 Switched to a denylist so non-Latin scripts survive.
76	*
77	* @param {string} stringValue The text, usually coming from user input.
78	*
79	* @returns {Event} Event object.
80	*/
81	santitizeTitle: function ( stringValue ) {
82
83	return stripUnsafeText( stringValue );
84
85	},
86
87
88	/**
89	* function that prevents certain HTML/JS/etc characters from being inputted into generic text input areas/boxes.
90	*
91	* @since 1.8.0
92	* @since 1.8.12.3 Switched to a denylist so non-Latin scripts survive.
93	*
94	* @param {string} stringValue The text, usually coming from user input.
95	*
96	* @returns {Event} Event object.
97	*/
98	santitizeTextInput: function ( stringValue ) {
99
100	return stripUnsafeText( stringValue );
101
102	},
103
104	/**
105	* function that prevents certain HTML/JS/etc characters from being inputted into CSS class input areas/boxes.
106	*
107	* @since 1.8.0
108	*
109	* @param {string} stringValue The text, usually coming from user input.
110	*
111	* @returns {Event} Event object.
112	*/
113	santitizeCSSInput: function ( stringValue ) {
114
115	return stringValue.replace(/[^a-zA-Z0-9_,\/$:\-\.!;]/g, ''); //eslint-disable-line
116
117	},
118
119	/**
120	* Wrapper to trigger a native or custom event and return the event object.
121	*
122	* @since 1.8.0
123	*
124	* @param {jQuery} $element Element to trigger event on.
125	* @param {string} eventName Event name to trigger (custom or native).
126	* @param {Array} args Trigger arguments.
127	*
128	* @returns {Event} Event object.
129	*/
130	triggerEvent: function( $element, eventName, args = [] ) {
131
132	let eventObject = new $.Event( eventName );
133
134	$element.trigger( eventObject, args );
135
136	return eventObject;
137	},
138
139	/**
140	* Debounce.
141	*
142	* This function comes directly from underscore.js:
143	*
144	* Returns a function, that, as long as it continues to be invoked, will not
145	* be triggered. The function will be called after it stops being called for
146	* N milliseconds. If `immediate` is passed, trigger the function on the
147	* leading edge, instead of the trailing.
148	*
149	* Debouncing is removing unwanted input noise from buttons, switches or other user input.
150	* Debouncing prevents extra activations or slow functions from triggering too often.
151	*
152	* @param {Function} func The function to be debounced.
153	* @param {int} wait The amount of time to delay calling func.
154	* @param {bool} immediate Whether or not to trigger the function on the leading edge.
155	*
156	* @returns {Function} Returns a function that, as long as it continues to be invoked, will not be triggered.
157	*/
158	debounce: function( func, wait, immediate ) {
159
160	var timeout;
161
162	return function() {
163
164	var context = this,
165	args = arguments;
166	var later = function() {
167
168	timeout = null;
169
170	if ( ! immediate ) {
171	func.apply( context, args );
172	}
173	};
174
175	var callNow = immediate && ! timeout;
176
177	clearTimeout( timeout );
178
179	timeout = setTimeout( later, wait );
180
181	if ( callNow ) {
182	func.apply( context, args );
183	}
184	};
185	},
186	};
187
188	// Provide access to public functions/properties.
189	return app;
190
191	}( document, window, jQuery ) ); // eslint-disable-line
192