Commit graph

4 commits

Author SHA1 Message Date
Gergely Nagy
f99cf911e8
Revert "Remove inputs in dropdowns from taborder"
This reverts commit 7dc453bb39.
2024-03-23 14:35:59 +01:00
Yarden Shoham
c1b6182625
Forbid HTML injection using jQuery (#29843)
See
https://github.com/wikimedia/eslint-plugin-no-jquery/blob/master/docs/rules/no-append-html.md

Tested the following components and they work as before:
- notification table
- issue author dropdown
- comment edit box attachments div

Signed-off-by: Yarden Shoham <git@yardenshoham.com>
Co-authored-by: Giteabot <teabot@gitea.io>
(cherry picked from commit f9b4efd42c17d7f75b689142b17575a478fe903c)
2024-03-20 08:46:30 +01:00
Otto Richter
7dc453bb39 Remove inputs in dropdowns from taborder
Inputs are normally present in the taborder of a website. When they are
inside a dropdown, this means a user could theoretically also tab
through them.

With the current dropdown approach, however, this can result in the
focus being trapped, because the dropdown is closed after the focus
switches to the next element.

In this case, the focus moves to the end of the page, breaking keyword
navigation and making parts of the page inaccessible with a keyboard.

I was only able to reproduce this in Firefox.

This patch removes inputs inside dropdowns from taborder. It should be
generally safe even with potential side-effects, because *nothing*
inside dropdowns should be in the tab order.

This is a hotfix for https://codeberg.org/forgejo/forgejo/issues/2635,
but I acknowledge it is not an ideal solution.
2024-03-12 02:24:17 +01:00
wxiaoguang
f860fe31d9
Move some JS code from fomantic.js to standalone files (#27994)
To improve maintainability, this PR: 

1. Rename `web_src/js/modules/aria` to `web_src/js/modules/fomantic`
(the code there are all for aria of fomantic)
2. Move api/transition related code to
`web_src/js/modules/fomantic/api.js` and
`web_src/js/modules/fomantic/transition.js`

No logic is changed.
2023-11-12 07:15:00 +00:00