23.1.6 release

ChangeLog

@@ -1,3 +1,11 @@
+22-FEB-2024: 23.1.6
+
+- Fixes possible XSS in tooltips for overlays [CSP-2969]
+- Fixes reference to clip path [drawio-4202]
+- Fixes possible XSS in fontCss for print preview [CSP-2986]
+- [conf cloud] Added tooltip to edit button when disabled
+- [conf cloud] Using v2 api to edit the page in direct diagram editing
+
 15-FEB-2024: 23.1.5
 
 - [conf cloud] Add charset to requests to protect from default charset changes

VERSION

@@ -1 +1 @@
-23.1.5
+23.1.6

src/main/mxgraph/util/mxSvgCanvas2D.js

@@ -332,7 +332,7 @@ mxSvgCanvas2D.prototype.format = function(value)
 mxSvgCanvas2D.prototype.getBaseUrl = function()
 {
 	var href = window.location.href;
-	var hash = href.lastIndexOf('#');
+	var hash = href.indexOf('#');
 
 	if (hash > 0)
 	{

src/main/mxgraph/view/mxGraph.js

@@ -9337,7 +9337,7 @@ mxGraph.prototype.getTooltip = function(state, node, x, y)
 				// LATER: Exit loop if tip is not null
 				if (tip == null && (node == shape.node || node.parentNode == shape.node))
 				{
-					tip = shape.overlay.toString();
+					tip = mxUtils.htmlEntities(shape.overlay.toString()).replace(/\\n/g, '<br>');
 				}
 			});
 		}

src/main/webapp/js/diagramly/Editor.js

@@ -8692,7 +8692,8 @@
 						if (editorUi.editor.fontCss != null)
 						{
 							doc.writeln('<style type="text/css">');
-							doc.writeln(editorUi.editor.fontCss);
+							doc.writeln(mxUtils.htmlEntities(editorUi.editor.fontCss,
+								false, false, false));
 							doc.writeln('</style>');
 						}
 

src/main/webapp/js/diagramly/GraphViewer.js

@@ -1820,7 +1820,7 @@ GraphViewer.prototype.createToolbarButton = function(fn, imgSrc, tip, enabled)
 	return a;
 };
 
-GraphViewer.prototype.disableButton = function(token)
+GraphViewer.prototype.disableButton = function(token, tooltip)
 {
 	var def = this.graphConfig['toolbar-buttons']? this.graphConfig['toolbar-buttons'][token] : null;
 
@@ -1833,6 +1833,11 @@ GraphViewer.prototype.disableButton = function(token)
 		{
 			def.elem.style.backgroundColor = '#eee';
 		});
+
+		if (tooltip)
+		{
+			def.elem.setAttribute('title', tooltip);
+		}
 	}
 };
 

src/main/webapp/js/export.js

@@ -2,7 +2,7 @@ var mxIsElectron = navigator.userAgent != null &&
 	navigator.userAgent.toLowerCase().indexOf(' electron/') > -1 && 
 	navigator.userAgent.indexOf(' draw.io/') > -1;
 var GOOGLE_APPS_MAX_AREA = 25000000;
-var GOOGLE_SHEET_MAX_AREA = 1048576; //1024x1024
+var GOOGLE_SHEET_MAX_AREA = 1000000; // The maximum number of pixels is 1 million.
 
 /**
  * Adds meta tag to the page.

src/main/webapp/resources/dia.txt

@@ -1276,5 +1276,6 @@ diagDupl=Duplicate Diagram Detected
 diagDuplMsg=This diagram is used in multiple places, which can result in unexpected results when edited. We've created an independent copy. Please open the editor again.
 diagDuplNoEditMsg=This diagram is used in multiple places. Please edit it within its own page.
 confCloudMigConfirm=Warning: This process will edit many pages and diagrams, so it is recommended to stop the Synchrony service during the process. Do you want to proceed?
-confCloudMigNotice=In the Cloud instance, please add linkAdjustments to draw.io configuration as follows {1}. Without this configuation, links in diagrams pointing to Confluence pages will not work.
+confCloudMigNotice=In the Cloud instance, please add linkAdjustments to draw.io configuration as follows {1}. Without this configuration, links in diagrams pointing to Confluence pages will not work.
 confALogsPageDesc=This page contains logs of draw.io long running services as attachments
+confEditOnlyInPageEditor=Can only be edited within Confluence page editor

src/main/webapp/resources/dia_am.txt

@@ -1276,5 +1276,6 @@ diagDupl=Duplicate Diagram Detected
 diagDuplMsg=This diagram is used in multiple places, which can result in unexpected results when edited. We've created an independent copy. Please open the editor again.
 diagDuplNoEditMsg=This diagram is used in multiple places. Please edit it within its own page.
 confCloudMigConfirm=Warning: This process will edit many pages and diagrams, so it is recommended to stop the Synchrony service during the process. Do you want to proceed?
-confCloudMigNotice=In the Cloud instance, please add linkAdjustments to draw.io configuration as follows {1}. Without this configuation, links in diagrams pointing to Confluence pages will not work.
+confCloudMigNotice=In the Cloud instance, please add linkAdjustments to draw.io configuration as follows {1}. Without this configuration, links in diagrams pointing to Confluence pages will not work.
 confALogsPageDesc=This page contains logs of draw.io long running services as attachments
+confEditOnlyInPageEditor=Can only be edited within Confluence page editor

src/main/webapp/resources/dia_ar.txt

@@ -1276,5 +1276,6 @@ diagDupl=Duplicate Diagram Detected
 diagDuplMsg=This diagram is used in multiple places, which can result in unexpected results when edited. We've created an independent copy. Please open the editor again.
 diagDuplNoEditMsg=This diagram is used in multiple places. Please edit it within its own page.
 confCloudMigConfirm=Warning: This process will edit many pages and diagrams, so it is recommended to stop the Synchrony service during the process. Do you want to proceed?
-confCloudMigNotice=In the Cloud instance, please add linkAdjustments to draw.io configuration as follows {1}. Without this configuation, links in diagrams pointing to Confluence pages will not work.
+confCloudMigNotice=In the Cloud instance, please add linkAdjustments to draw.io configuration as follows {1}. Without this configuration, links in diagrams pointing to Confluence pages will not work.
 confALogsPageDesc=This page contains logs of draw.io long running services as attachments
+confEditOnlyInPageEditor=Can only be edited within Confluence page editor

src/main/webapp/resources/dia_bg.txt

@@ -1276,5 +1276,6 @@ diagDupl=Duplicate Diagram Detected
 diagDuplMsg=This diagram is used in multiple places, which can result in unexpected results when edited. We've created an independent copy. Please open the editor again.
 diagDuplNoEditMsg=This diagram is used in multiple places. Please edit it within its own page.
 confCloudMigConfirm=Warning: This process will edit many pages and diagrams, so it is recommended to stop the Synchrony service during the process. Do you want to proceed?
-confCloudMigNotice=In the Cloud instance, please add linkAdjustments to draw.io configuration as follows {1}. Without this configuation, links in diagrams pointing to Confluence pages will not work.
+confCloudMigNotice=In the Cloud instance, please add linkAdjustments to draw.io configuration as follows {1}. Without this configuration, links in diagrams pointing to Confluence pages will not work.
 confALogsPageDesc=This page contains logs of draw.io long running services as attachments
+confEditOnlyInPageEditor=Can only be edited within Confluence page editor

src/main/webapp/resources/dia_bn.txt

@@ -1276,5 +1276,6 @@ diagDupl=Duplicate Diagram Detected
 diagDuplMsg=This diagram is used in multiple places, which can result in unexpected results when edited. We've created an independent copy. Please open the editor again.
 diagDuplNoEditMsg=This diagram is used in multiple places. Please edit it within its own page.
 confCloudMigConfirm=Warning: This process will edit many pages and diagrams, so it is recommended to stop the Synchrony service during the process. Do you want to proceed?
-confCloudMigNotice=In the Cloud instance, please add linkAdjustments to draw.io configuration as follows {1}. Without this configuation, links in diagrams pointing to Confluence pages will not work.
+confCloudMigNotice=In the Cloud instance, please add linkAdjustments to draw.io configuration as follows {1}. Without this configuration, links in diagrams pointing to Confluence pages will not work.
 confALogsPageDesc=This page contains logs of draw.io long running services as attachments
+confEditOnlyInPageEditor=Can only be edited within Confluence page editor

src/main/webapp/resources/dia_bs.txt

@@ -1276,5 +1276,6 @@ diagDupl=Duplicate Diagram Detected
 diagDuplMsg=This diagram is used in multiple places, which can result in unexpected results when edited. We've created an independent copy. Please open the editor again.
 diagDuplNoEditMsg=This diagram is used in multiple places. Please edit it within its own page.
 confCloudMigConfirm=Warning: This process will edit many pages and diagrams, so it is recommended to stop the Synchrony service during the process. Do you want to proceed?
-confCloudMigNotice=In the Cloud instance, please add linkAdjustments to draw.io configuration as follows {1}. Without this configuation, links in diagrams pointing to Confluence pages will not work.
+confCloudMigNotice=In the Cloud instance, please add linkAdjustments to draw.io configuration as follows {1}. Without this configuration, links in diagrams pointing to Confluence pages will not work.
 confALogsPageDesc=This page contains logs of draw.io long running services as attachments
+confEditOnlyInPageEditor=Can only be edited within Confluence page editor

src/main/webapp/resources/dia_ca.txt

@@ -1276,5 +1276,6 @@ diagDupl=Diagrama Duplicat Detectat
 diagDuplMsg=Aquest diagrama s'utilitza en diversos llocs, cosa que pot donar lloc a resultats inesperats quan s'edita. Hem creat una còpia independent. Torneu a obrir l'editor.
 diagDuplNoEditMsg=Aquest diagrama s'utilitza en diversos llocs. Si us plau, edita'l dins de la seva pròpia pàgina.
 confCloudMigConfirm=Warning: This process will edit many pages and diagrams, so it is recommended to stop the Synchrony service during the process. Do you want to proceed?
-confCloudMigNotice=In the Cloud instance, please add linkAdjustments to draw.io configuration as follows {1}. Without this configuation, links in diagrams pointing to Confluence pages will not work.
+confCloudMigNotice=In the Cloud instance, please add linkAdjustments to draw.io configuration as follows {1}. Without this configuration, links in diagrams pointing to Confluence pages will not work.
 confALogsPageDesc=This page contains logs of draw.io long running services as attachments
+confEditOnlyInPageEditor=Can only be edited within Confluence page editor