XSS Vulnerability on closeText option of Dialog jQuery UI 1.11.4

AUTHORS.txt

@@ -282,3 +282,15 @@ Will Holley <[email protected]>
 Uri Gilad <[email protected]>
 Richard Gibson <[email protected]>
 Simen Bekkhus <[email protected]>
+Chen Eshchar <[email protected]>
+Bruno Pérel <[email protected]>
+Mohammed Alshehri <[email protected]>
+Anne-Gaelle Colom <[email protected]>
+Adam Foster <[email protected]>
+Luke Page <[email protected]>
+Marcus Warren <[email protected]>
+Patricia Juarez <[email protected]>
+Ben Mosher <[email protected]>
+Ablay Keldibek <[email protected]>
+Nils Heuermann <[email protected]>
+Marco Ziech <[email protected]>

CONTRIBUTING.md

@@ -16,68 +16,83 @@ This is the best way to contribute to jQuery UI. Please read through the full gu
 
 Every week (unless otherwise noted) the jQuery UI team has a meeting to discuss the progress of current work and to bring forward possible new blockers for discussion. The meeting is held on [IRC](http://irc.jquery.org) in the #jquery-meeting channel at [Noon EST](http://www.timeanddate.com/worldclock/fixedtime.html?month=1&day=17&year=2011&hour=12&min=0&sec=0&p1=43) on Wednesdays. Meeting notes are posted on http://meetings.jquery.org/category/ui/ after each meeting.
 
-## Tips For Bug Patching
+## Tips for Getting Started
 
-### Environment: localhost w/ PHP, Node.js & Grunt
+### Environment: Minimum Required
 
-jQuery UI uses Node.js & Grunt to automate the building and validation of source code.
+If you are contributing changes you will need a fork of jquery-ui (see [Getting the Source](#environment-getting-the-source)). If you just want the source code you could clone jquery-ui directly:
 
-Some tests depend on PHP running locally, so make sure you have the following installed:
-
-* A web server with PHP support (any will do, such as [XAMPP](http://www.apachefriends.org/en/xampp.html) or [MAMP](http://www.mamp.info/en/index.html))
-* [Node.js](http://nodejs.org/) (includes NPM, necessary for the next step)
-* Grunt (install with: `npm install -g grunt`)
+```bash
+git clone git://github.com/jquery/jquery-ui.git
+cd jquery-ui
+```
 
-### Build a Local Copy of jQuery UI
+The tests can run in any local web server. Ideally you should test your patch in appropriate web browsers and if possible run `grunt` to lint the code and run automated tests (this will happen automatically when you create a pull request). See the [Recommended Setup](#environment-recommended-setup) for setting up Node.js so that the grunt command works.
 
-Create a fork of the jQuery UI repo on GitHub at http://github.com/jquery/jquery-ui.
+### Environment: Getting the Source
 
-Change directory to your web root directory, whatever that might be:
+* Create a fork of the jQuery UI repo on GitHub at http://github.com/jquery/jquery-ui. This will create a fork of jquery-ui in your Github account.
+* You may want to clone jquery-ui under the path to your web server. If so, change to the required directory
 
 ```bash
-$ cd /path/to/your/www/root/
+cd /path/to/your/www/root/
 ```
 
-Clone your jQuery UI fork to work locally.
-
-*Note: be sure to replace `[USERNAME]` with your GitHub username.*
+* Clone your jQuery UI git repo.
 
 ```bash
-$ git clone [email protected]:[USERNAME]/jquery-ui.git
+git clone git://github.com/[USERNAME]/jquery-ui.git
+cd jquery-ui
 ```
 
-Change to the newly created directory.
+*Note: be sure to replace `[USERNAME]` with your GitHub username.*
+
+* Add the official jQuery repository as a remote. We recommend naming it "upstream".
 
 ```bash
-$ cd jquery-ui
+git remote add upstream git://github.com/jquery/jquery-ui.git
 ```
 
-Add the official jQuery repository as a remote. We recommend naming it "upstream".
+* Get in the habit of pulling in the "upstream" master to stay up to date as jQuery UI receives new commits.
 
 ```bash
-$ git remote add upstream git://github.com/jquery/jquery-ui.git
+git pull upstream master
 ```
 
-Get in the habit of pulling in the "upstream" master to stay up to date as jQuery UI receives new commits.
+### Environment: Recommended Setup
+
+jQuery UI uses Node.js & Grunt to automate the building and validation of source code. Here is how to set that up:
+
+* Get [Node.js](http://nodejs.org/) (includes NPM, necessary for the next step)
+* Install Grunt cli:
 
 ```bash
-$ git pull upstream master
+npm install -g grunt-cli
 ```
 
-Install the dependencies.
+* Install local Node.js modules
 
 ```bash
 npm install
 ```
 
+The tests require a local web server and the samples contain some PHP, so a PHP web server may be useful.
+
+* Install a web server. Here are some you could use:
+  * Windows: [WAMP download](http://www.wampserver.com/en/)
+  * Mac: [MAMP download](http://www.mamp.info/en/index.html)
+  * Linux: [Setting up LAMP](https://www.linux.com/learn/tutorials/288158-easy-lamp-server-installation)
+  * [Mongoose (most platforms)](http://code.google.com/p/mongoose/)
+  * [http-server](https://www.npmjs.com/package/http-server)
+
+### Running the Tests
+
 To lint the JavaScript, HTML, and CSS, as well as run a smoke test in PhantomJS, run grunt:
 
 ```bash
-$ grunt
+grunt
 ```
 
 To run the tests for a specific plugin in your browser, open the appropriate file from the `/tests/unit/` directory, for example: `http://localhost/tests/unit/accordion/accordion.html`. The domain will be dependent on your local server configuration; if there is a port, be sure to include it.
 
 Ideally you would test in all of our [supported browsers](http://jqueryui.com/browser-support/), but if you don't have all of these browsers available, that's ok.
-
-Make sure to read our [commits and pull requests documentation](http://dev.contribute.jquery.org/commits-and-pull-requests/) for full details on working with branches and forks, as well as our commit guidelines.

Gruntfile.js

@@ -119,7 +119,7 @@ function createBanner( files ) {
 		"<%= grunt.template.today('isoDate') %>\n" +
 		"<%= pkg.homepage ? '* ' + pkg.homepage + '\\n' : '' %>" +
 		(files ? "* Includes: " + fileNames.join(", ") + "\n" : "") +
-		"* Copyright <%= grunt.template.today('yyyy') %> <%= pkg.author.name %>;" +
+		"* Copyright <%= pkg.author.name %>;" +
 		" Licensed <%= _.pluck(pkg.licenses, 'type').join(', ') %> */\n";
 }
 

LICENSE.txt

@@ -1,5 +1,4 @@
-Copyright 2007, 2014 jQuery Foundation and other contributors,
-https://jquery.org/
+Copyright jQuery Foundation and other contributors, https://jquery.org/
 
 This software consists of voluntary contributions made by many
 individuals. For exact contribution history, see the revision history

README.md

@@ -10,7 +10,7 @@ If you are interested in helping develop jQuery UI, you are in the right place.
 To discuss development with team members and the community, visit the [Developing jQuery UI Forum](http://forum.jquery.com/developing-jquery-ui) or [#jqueryui-dev on irc.freenode.net](http://irc.jquery.org/).
 
 
-## For contributors
+## For Contributors
 
 If you want to help and provide a patch for a bugfix or new feature, please take
 a few minutes and look at [our Getting Involved guide](http://wiki.jqueryui.com/w/page/35263114/Getting-Involved).
@@ -21,35 +21,21 @@ In general, fork the project, create a branch for a specific change and send a
 pull request for that branch. Don't mix unrelated changes. You can use the commit
 message as the description for the pull request.
 
+For more information, see the [contributing page](CONTRIBUTING.md).
 
 ## Running the Unit Tests
 
-Run the unit tests with a local server that supports PHP. No database is required. Pre-configured php local servers are available for Windows and Mac. Here are some options:
-
-- Windows: [WAMP download](http://www.wampserver.com/en/)
-- Mac: [MAMP download](http://www.mamp.info/en/index.html)
-- Linux: [Setting up LAMP](https://www.linux.com/learn/tutorials/288158-easy-lamp-server-installation)
-- [Mongoose (most platforms)](http://code.google.com/p/mongoose/)
+Run the unit tests manually with appropriate browsers and any local web server. See our [environment setup](CONTRIBUTING.md#environment-minimum-required) and [information on running tests](CONTRIBUTING.md#running-the-tests).
 
+You can also run the unit tests inside phantomjs by [setting up your environment](CONTRIBUTING.md#user-content-environment-recommended-setup).
 
 ## Building jQuery UI
 
-jQuery UI uses the [Grunt](http://github.com/gruntjs/grunt) build system.
+jQuery UI uses the [Grunt](http://gruntjs.com/) build system.
 
-To build jQuery UI, you must have [node.js](http://nodejs.org/) installed and then run the following commands:
+To build jQuery UI, [setup your environment]([setting up your environment](CONTRIBUTING.md#environment-minimum-required)) and then run the following commands:
 
 ```sh
-
-# Install the Grunt CLI
-npm install -g grunt-cli
-
-# Clone the jQuery UI git repo
-git clone git://github.com/jquery/jquery-ui.git
-cd jquery-ui
-
-# Install the node module dependencies
-npm install
-
 # Run the concat task to concatenate files
 grunt concat
 

build/tasks/testswarm.js

@@ -61,7 +61,7 @@ function submit( commit, runs, configFile, extra, done ) {
 		name: "Commit <a href='" + commitUrl + "'>" + commit.substr( 0, 10 ) + "</a>" + extra,
 		runs: runs,
 		runMax: config.runMax,
-		browserSets: [ "popular-ui" ],
+		browserSets: config.browserSets,
 		timeout: 1000 * 60 * 30
 	}, function( error, passed ) {
 		if ( error ) {

demos/autocomplete/search.php

@@ -368,7 +368,6 @@
 "Glossy Ibis"=>"Plegadis falcinellus",
 "Spanish Imperial Eagle"=>"Aquila adalberti",
 "Lesser Kestrel"=>"Falco naumanni",
-"Houbara Bustard"=>"Chlamydotis undulata",
 "Crab-Plover"=>"Dromas ardeola",
 "Cream-coloured Courser"=>"Cursorius cursor",
 "Collared Pratincole"=>"Glareola pratincola",

demos/effect/easing.html

@@ -96,7 +96,7 @@
 <div id="graphs"></div>
 
 <div class="demo-description">
-<p><strong>All easings provided by jQuery UI are drawn above, using a HTML canvas element</strong>. Click a diagram to see the easing in action.</p>
+<p><strong>All easings provided by jQuery UI are drawn above, using an HTML canvas element</strong>. Click a diagram to see the easing in action.</p>
 </div>
 </body>
 </html>

demos/sortable/empty-lists.html

@@ -11,7 +11,7 @@
 	<script src="../../ui/sortable.js"></script>
 	<link rel="stylesheet" href="../demos.css">
 	<style>
-	#sortable1, #sortable2, #sortable3 { list-style-type: none; margin: 0; padding: 0; float: left; margin-right: 10px; background: #eee; padding: 5px; width: 143px;}
+	#sortable1, #sortable2, #sortable3 { list-style-type: none; margin: 0; float: left; margin-right: 10px; background: #eee; padding: 5px; width: 143px;}
 	#sortable1 li, #sortable2 li, #sortable3 li { margin: 5px; padding: 5px; font-size: 1.2em; width: 120px; }
 	</style>
 	<script>

demos/tabs/ajax.html

@@ -13,7 +13,7 @@
 	$(function() {
 		$( "#tabs" ).tabs({
 			beforeLoad: function( event, ui ) {
-				ui.jqXHR.error(function() {
+				ui.jqXHR.fail(function() {
 					ui.panel.html(
 						"Couldn't load this tab. We'll try to fix this as soon as possible. " +
 						"If this wouldn't be a demo." );

demos/tabs/vertical.html

@@ -20,7 +20,7 @@
 	.ui-tabs-vertical .ui-tabs-nav { padding: .2em .1em .2em .2em; float: left; width: 12em; }
 	.ui-tabs-vertical .ui-tabs-nav li { clear: left; width: 100%; border-bottom-width: 1px !important; border-right-width: 0 !important; margin: 0 -1px .2em 0; }
 	.ui-tabs-vertical .ui-tabs-nav li a { display:block; }
-	.ui-tabs-vertical .ui-tabs-nav li.ui-tabs-active { padding-bottom: 0; padding-right: .1em; border-right-width: 1px; border-right-width: 1px; }
+	.ui-tabs-vertical .ui-tabs-nav li.ui-tabs-active { padding-bottom: 0; padding-right: .1em; border-right-width: 1px; }
 	.ui-tabs-vertical .ui-tabs-panel { padding: 1em; float: right; width: 40em;}
 	</style>
 </head>

package.json

@@ -2,11 +2,11 @@
 	"name": "jquery-ui",
 	"title": "jQuery UI",
 	"description": "A curated set of user interface interactions, effects, widgets, and themes built on top of the jQuery JavaScript Library.",
-	"version": "1.11.3-pre",
+	"version": "1.11.5-pre",
 	"homepage": "http://jqueryui.com",
 	"author": {
 		"name": "jQuery Foundation and other contributors",
-		"url": "https://github.com/jquery/jquery-ui/blob/master/AUTHORS.txt"
+		"url": "https://github.com/jquery/jquery-ui/blob/1-11-stable/AUTHORS.txt"
 	},
 	"maintainers": [
 		{
@@ -53,7 +53,7 @@
 	"licenses": [
 		{
 			"type": "MIT",
-			"url": "https://github.com/jquery/jquery-ui/blob/master/LICENSE.txt"
+			"url": "https://github.com/jquery/jquery-ui/blob/1-11-stable/LICENSE.txt"
 		}
 	],
 	"scripts": {

tests/unit/accordion/accordion_core.js

@@ -28,9 +28,10 @@ test( "handle click on header-descendant", function() {
 });
 
 test( "accessibility", function () {
-	expect( 37 );
+	expect( 61 );
 	var element = $( "#list1" ).accordion({
-			active: 1
+			active: 1,
+			collapsible: true
 		}),
 		headers = element.find( ".ui-accordion-header" );
 
@@ -45,31 +46,60 @@ test( "accessibility", function () {
 	});
 
 	equal( headers.eq( 1 ).attr( "tabindex" ), 0, "active header has tabindex=0" );
-	equal( headers.eq( 1 ).attr( "aria-selected" ), "true", "active tab has aria-selected=true" );
-	equal( headers.eq( 1 ).attr( "aria-expanded" ), "true", "active tab has aria-expanded=true" );
-	equal( headers.eq( 1 ).next().attr( "aria-hidden" ), "false", "active tabpanel has aria-hidden=false" );
-	equal( headers.eq( 0 ).attr( "tabindex" ), -1, "inactive header has tabindex=-1" );
-	equal( headers.eq( 0 ).attr( "aria-selected" ), "false", "inactive tab has aria-selected=false" );
-	equal( headers.eq( 0 ).attr( "aria-expanded" ), "false", "inactive tab has aria-expanded=false" );
-	equal( headers.eq( 0 ).next().attr( "aria-hidden" ), "true", "inactive tabpanel has aria-hidden=true" );
-	equal( headers.eq( 2 ).attr( "tabindex" ), -1, "inactive header has tabindex=-1" );
-	equal( headers.eq( 2 ).attr( "aria-selected" ), "false", "inactive tab has aria-selected=false" );
-	equal( headers.eq( 2 ).attr( "aria-expanded" ), "false", "inactive tab has aria-expanded=false" );
-	equal( headers.eq( 2 ).next().attr( "aria-hidden" ), "true", "inactive tabpanel has aria-hidden=true" );
+	equal( headers.eq( 1 ).attr( "aria-selected" ), "true", "active tab (1) has aria-selected=true" );
+	equal( headers.eq( 1 ).attr( "aria-expanded" ), "true", "active tab (1) has aria-expanded=true" );
+	equal( headers.eq( 1 ).next().attr( "aria-hidden" ), "false", "active tabpanel (1) has aria-hidden=false" );
+	equal( headers.eq( 0 ).attr( "tabindex" ), -1, "inactive header (0) has tabindex=-1" );
+	equal( headers.eq( 0 ).attr( "aria-selected" ), "false", "inactive tab (0) has aria-selected=false" );
+	equal( headers.eq( 0 ).attr( "aria-expanded" ), "false", "inactive tab (0) has aria-expanded=false" );
+	equal( headers.eq( 0 ).next().attr( "aria-hidden" ), "true", "inactive tabpanel (0) has aria-hidden=true" );
+	equal( headers.eq( 2 ).attr( "tabindex" ), -1, "inactive header (2) has tabindex=-1" );
+	equal( headers.eq( 2 ).attr( "aria-selected" ), "false", "inactive tab (2) has aria-selected=false" );
+	equal( headers.eq( 2 ).attr( "aria-expanded" ), "false", "inactive tab (2) has aria-expanded=false" );
+	equal( headers.eq( 2 ).next().attr( "aria-hidden" ), "true", "inactive tabpanel (2) has aria-hidden=true" );
 
 	element.accordion( "option", "active", 0 );
-	equal( headers.eq( 0 ).attr( "tabindex" ), 0, "active header has tabindex=0" );
-	equal( headers.eq( 0 ).attr( "aria-selected" ), "true", "active tab has aria-selected=true" );
-	equal( headers.eq( 0 ).attr( "aria-expanded" ), "true", "active tab has aria-expanded=true" );
-	equal( headers.eq( 0 ).next().attr( "aria-hidden" ), "false", "active tabpanel has aria-hidden=false" );
-	equal( headers.eq( 1 ).attr( "tabindex" ), -1, "inactive header has tabindex=-1" );
-	equal( headers.eq( 1 ).attr( "aria-selected" ), "false", "inactive tab has aria-selected=false" );
-	equal( headers.eq( 1 ).attr( "aria-expanded" ), "false", "inactive tab has aria-expanded=false" );
-	equal( headers.eq( 1 ).next().attr( "aria-hidden" ), "true", "inactive tabpanel has aria-hidden=true" );
-	equal( headers.eq( 2 ).attr( "tabindex" ), -1, "inactive header has tabindex=-1" );
-	equal( headers.eq( 2 ).attr( "aria-selected" ), "false", "inactive tab has aria-selected=false" );
-	equal( headers.eq( 2 ).attr( "aria-expanded" ), "false", "inactive tab has aria-expanded=false" );
-	equal( headers.eq( 2 ).next().attr( "aria-hidden" ), "true", "inactive tabpanel has aria-hidden=true" );
+	equal( headers.eq( 0 ).attr( "tabindex" ), 0, "active header (0) has tabindex=0" );
+	equal( headers.eq( 0 ).attr( "aria-selected" ), "true", "active tab (0) has aria-selected=true" );
+	equal( headers.eq( 0 ).attr( "aria-expanded" ), "true", "active tab (0) has aria-expanded=true" );
+	equal( headers.eq( 0 ).next().attr( "aria-hidden" ), "false", "active tabpanel (0) has aria-hidden=false" );
+	equal( headers.eq( 1 ).attr( "tabindex" ), -1, "inactive header (1) has tabindex=-1" );
+	equal( headers.eq( 1 ).attr( "aria-selected" ), "false", "inactive tab (1) has aria-selected=false" );
+	equal( headers.eq( 1 ).attr( "aria-expanded" ), "false", "inactive tab (1) has aria-expanded=false" );
+	equal( headers.eq( 1 ).next().attr( "aria-hidden" ), "true", "inactive tabpanel (1) has aria-hidden=true" );
+	equal( headers.eq( 2 ).attr( "tabindex" ), -1, "inactive header (2) has tabindex=-1" );
+	equal( headers.eq( 2 ).attr( "aria-selected" ), "false", "inactive tab (2) has aria-selected=false" );
+	equal( headers.eq( 2 ).attr( "aria-expanded" ), "false", "inactive tab (2) has aria-expanded=false" );
+	equal( headers.eq( 2 ).next().attr( "aria-hidden" ), "true", "inactive tabpanel (2) has aria-hidden=true" );
+
+	element.accordion( "option", "active", false );
+	equal( headers.eq( 0 ).attr( "tabindex" ), 0, "previously active header (0) has tabindex=0" );
+	equal( headers.eq( 0 ).attr( "aria-selected" ), "false", "inactive tab (0) has aria-selected=false" );
+	equal( headers.eq( 0 ).attr( "aria-expanded" ), "false", "inactive tab (0) has aria-expanded=false" );
+	equal( headers.eq( 0 ).next().attr( "aria-hidden" ), "true", "inactive tabpanel (0) has aria-hidden=true" );
+	equal( headers.eq( 1 ).attr( "tabindex" ), -1, "inactive header (1) has tabindex=-1" );
+	equal( headers.eq( 1 ).attr( "aria-selected" ), "false", "inactive tab (1) has aria-selected=false" );
+	equal( headers.eq( 1 ).attr( "aria-expanded" ), "false", "inactive tab (1) has aria-expanded=false" );
+	equal( headers.eq( 1 ).next().attr( "aria-hidden" ), "true", "inactive tabpanel (1) has aria-hidden=true" );
+	equal( headers.eq( 2 ).attr( "tabindex" ), -1, "inactive header (2) has tabindex=-1" );
+	equal( headers.eq( 2 ).attr( "aria-selected" ), "false", "inactive tab (2) has aria-selected=false" );
+	equal( headers.eq( 2 ).attr( "aria-expanded" ), "false", "inactive tab (2) has aria-expanded=false" );
+	equal( headers.eq( 2 ).next().attr( "aria-hidden" ), "true", "inactive tabpanel (2) has aria-hidden=true" );
+
+	element.accordion( "option", "active", 1 );
+	equal( headers.eq( 1 ).attr( "tabindex" ), 0, "active header has tabindex=0" );
+	equal( headers.eq( 1 ).attr( "aria-selected" ), "true", "active tab (1) has aria-selected=true" );
+	equal( headers.eq( 1 ).attr( "aria-expanded" ), "true", "active tab (1) has aria-expanded=true" );
+	equal( headers.eq( 1 ).next().attr( "aria-hidden" ), "false", "active tabpanel (1) has aria-hidden=false" );
+	equal( headers.eq( 0 ).attr( "tabindex" ), -1, "inactive header (0) has tabindex=-1" );
+	equal( headers.eq( 0 ).attr( "aria-selected" ), "false", "inactive tab (0) has aria-selected=false" );
+	equal( headers.eq( 0 ).attr( "aria-expanded" ), "false", "inactive tab (0) has aria-expanded=false" );
+	equal( headers.eq( 0 ).next().attr( "aria-hidden" ), "true", "inactive tabpanel (0) has aria-hidden=true" );
+	equal( headers.eq( 2 ).attr( "tabindex" ), -1, "inactive header (2) has tabindex=-1" );
+	equal( headers.eq( 2 ).attr( "aria-selected" ), "false", "inactive tab (2) has aria-selected=false" );
+	equal( headers.eq( 2 ).attr( "aria-expanded" ), "false", "inactive tab (2) has aria-expanded=false" );
+	equal( headers.eq( 2 ).next().attr( "aria-hidden" ), "true", "inactive tabpanel (2) has aria-hidden=true" );
+
 });
 
 asyncTest( "keyboard support", function() {