| Age | Commit message (Collapse) | Author |
|---|
|
not attached to the DOM
|
|
It is now possible to notify a promise through deferred.notify() method.
Notifications are useful to provide a way to send progress information
to promise holders.
|
|
|
|
Add an alternative way to define a mapping for ng:pluralize using
attributes instead of the `when` attribute
Closes #2454
|
|
Regular expression objects didn't used to be considered to be equal when using
'angular.equals'. Dirty checking therefore failed to recognize a
property modification.
Closes #2685
|
|
Closes #2770
|
|
Return early in `angular.toJson` if the object to be stringified is `undefined`.
IE8 stringifies `undefined` to `'undefined'` whereas other browsers return
`undefined`. This normalizes behavior and passes currently broken unit tests
in IE8.
|
|
The colon character is used to identify parameters in $resource.
This meant that we had to escape the colon used in a port.
It turns out that this is not necessary if we assume that parameter
names cannot consist of only digits.
If the parameter consists only of numbers, then it's a port.
Closes #2778
|
|
With select(...).option(val) it previously would select the first node
which contains the value, even if an exact match was available.
This fix prefers exact matches if available, otherwise it reverts
to the previous 'contains' behaviour for backwards compatibility.
Closes #2856
|
|
According to RFC 3986 (http://tools.ietf.org/html/rfc3986#section-3.1)
schemes such as http or mailto are case-insensitive. So links such as
http://server/ and HTTP://server/ are valid and equivalent.
Closes #3210
|
|
|
|
|
|
Closes #2915
|
|
Closes #2695
|
|
this test fails and we don't have intentions on making it pass since
we never made a commitment to implement this feature.
|
|
So we can request with dynamic header value.
module.factory('Res', [
'$resource'
'$routeParams'
'globalConfig'
function($resource, $routeParams, globalConfig) {
resource('/url/:id', {id: "@id"}, {
patch: {
method: 'patch',
headers: {
'Authorization': function() {
return "token " + globalConfig.token;
}
}
}
});
}]);
|
|
Merely testing for object[key] will give incorrect results on keys
defined in Object.prototype.
Note: IE8 is generally broken in this regard since `for...in` never returns
certain property keys even if they are defined directly on the object.
See #2141 - partially merges this PR
|
|
The stock Android browser doesn't support the current for-in body/style
detection for animations and transitions but we can manually fix this.
This is useful for PhoneGap web-views or traditional web-apps using the
stock browser.
|
|
Enhances sandboxing of Angular Expressions to prevent attacks via:
{}.toString.constructor(alert("evil JS code"))
|
|
Match jQuery behavior when prepending array into empty element
|
|
Previously if a template contained a directive that had a template
(sync or async) and the directive template was to replace the original
element and the directive template contained another directive on the
root element of this template and this new directive was an element
transclude directive then an infinite recursion would follow because
the compiler kept on re-adding and reapplying the original directive
to the replaced node.
This change fixes that.
Closes #2155
|
|
This reverts commit 15e1a29cd08993b599f390e83a249ec17f753972.
The original commit was fixing two issues - one of them was
preventing attributes that triggered directives that replaced
the compiled node to be merged into the new node.
This change was a breaking change (as seen in the diff of the
tests in this commit) and that's why it's being removed.
A proper fix will follow.
|
|
|
|
This reverts commit 0c6fb665a4e2e1e7ceb11372153963658d4b53b1.
The change invalidated the test because the point of the the test
was to test that an element directive works. Changing it to attribute
directive was wrong.
|
|
|
|
|
|
parseKeyValue and toKeyValue can now handle duplicate values in the query.
```
?x=1&x=2 <-> {x:[1,2]}
```
The algorithm looks like:
1)parseKeyValue looks for presence of obj[key]
2)detects and replaces obj[key] with [obj[key],val]
3)then pushes more duplicates if necessary
4)toKeyValue decodes array correctly
5)(not changed)$location.search({param: 'key'}) still replaces if necessary
6)(not changed)$location.search({param: ['key1', 'key2']}) sets the url with duplicates
BREAKING CHANGE: Before this change:
- `parseKeyValue` only took the last key overwriting all the previous keys;
- `toKeyValue` joined the keys together in a comma delimited string.
This was deemed buggy behavior. If your server relied on this behavior
then either the server should be fixed or a simple serialization of
the array should be done on the client before passing it to $location.
|
|
img[src]="https://foo" has the unfortunate problem that the browser will
actually try retrieving the resource the non FQDN foo. The local DNS
might suffix a domain to this, resolve it, and try to present a
certificate for the https request and prompt the user to pick a
certificate. This commit avoids that by making foo a FQDN. Note that it
might be better to replace foo with example.com (ref
http://tools.ietf.org/html/rfc2606#section-3).
|
|
|
|
|
|
Closes# 2155
|
|
With the recent refactoring of $location service we changed this behavior
resulting in a regression.
Previously we thought that html5 mode always required base[href]
to be set in order for urls to resolve properly. It turns out that
base[href] is problematic because it makes anchor urls (#foo) to
always resolve to the base url, which is almost always incorrect
and results in all anchors links and other anchor urls (e.g. svg
references) to be broken.
For this reason, we should now start recommending that people just
deploy to root context (/) and not set the base[href] when using
the html5 mode (push/pop history state).
If it's impossible to deploy to the root context then either all
urls in the app must be absolute or base[href] must be set with the
caveat that anchor urls in such app won't work.
Closes #2762
|
|
|
|
BREAKING CHANGE: Concatenating expressions makes it hard to reason about
whether some combination of concatenated values are unsafe to use
and could easily lead to XSS. By requiring that a single expression
be used for *[src/ng-src] such as iframe[src], object[src], etc.
(but not img[src/ng-src] since that value is sanitized), we ensure that the value
that's used is assigned or constructed by some JS code somewhere
that is more testable or make it obvious that you bound the value to
some user controlled value. This helps reduce the load when
auditing for XSS issues.
To migrate your code, follow the example below:
Before:
JS:
scope.baseUrl = 'page';
scope.a = 1;
scope.b = 2;
HTML:
<!-- Are a and b properly escaped here? Is baseUrl
controlled by user? -->
<iframe src="{{baseUrl}}?a={{a}&b={{b}}">
After:
JS:
var baseUrl = "page";
scope.getIframeSrc = function() {
// There are obviously better ways to do this. The
// key point is that one will think about this and do
// it the right way.
var qs = ["a", "b"].map(function(value, name) {
return encodeURIComponent(name) + "=" +
encodeURIComponent(value);
}).join("&");
// baseUrl isn't on scope so it isn't bound to a user
// controlled value.
return baseUrl + "?" + qs;
}
HTML: <iframe src="{{getIframeSrc()}}">
|
|
BREAKING CHANGE: Interpolations inside DOM event handlers are
disallowed. DOM event handlers execute arbitrary Javascript code.
Using an interpolation for such handlers means that the interpolated
value is a JS string that is evaluated. Storing or generating such
strings is error prone and likely leads to an XSS if you're not
super careful. On the other hand, ng-click and such event handlers
evaluate Angular expressions that are a lot safer (e.g. No direct
access to global objects - only scope), cleaner and harder to
exploit.
To migrate the code follow the example below:
Before:
JS: scope.foo = 'alert(1)';
HTML: <div onclick="{{foo}}">
After:
JS: scope.foo = function() { alert(1); }
HTML: <div ng-click="foo()">
|
|
Ref: 9532234bf1c408af9a6fd2c4743fdb585b920531
BREAKING CHANGE: img[src] URLs are now sanitized using the same whitelist
as a[href] URLs. The most obvious impact is if you were using data:
URIs. data: URIs will be whitelisted for img[src] in a future
commit.
|
|
|
|
If user send content-type header, both content-type and default
Content-Type headers were sent. Now default header overriding is
case-insensitive.
|
|
jQuery switched to a completely new event binding implementation as of
1.7.0, centering around on/off methods instead of previous bind/unbind.
This patch makes jqLite match this implementation while still supporting
previous bind/unbind methods.
|
|
|
|
|
|
|
|
|
|
$route, $routeParams and ngView have been pulled from core angular.js
to angular-route.js/ngRoute module.
This is was done to in order keep the core focused on most commonly
used functionality and allow community routers to be freely used
instead of $route service.
There is no need to panic, angular-route will keep on being supported
by the angular team.
Note: I'm intentionally not fixing tutorial links. Tutorial will need
bigger changes and those should be done when we update tutorial to
1.2.
BREAKING CHANGE: applications that use $route will now need to load
angular-route.js file and define dependency on ngRoute module.
Before:
```
...
<script src="angular.js"></script>
...
var myApp = angular.module('myApp', ['someOtherModule']);
...
```
After:
```
...
<script src="angular.js"></script>
<script src="angular-route.js"></script>
...
var myApp = angular.module('myApp', ['ngRoute', 'someOtherModule']);
...
```
Closes #2804
|
|
jQuery's API for removeData allows a second 'name' argument to just
remove the property by that name from an element's data. The absence
of this argument was causing some features not to work correctly when
combining multiple directives, such as ng-click, ng-show, and ng-animate.
|
|
and transitions and animations together
|
|
By appending directive-start and directive-end to a
directive it is now possible to have the directive
act on a group of elements.
It is now possible to iterate over multiple elements like so:
<table>
<tr ng-repeat-start="item in list">I get repeated</tr>
<tr ng-repeat-end>I also get repeated</tr>
</table>
|
|
- add toThrowNg matcher
|
|
|
|
This new service is used by the ngSwipeLeft/Right directives, and by the
separate ngCarousel and swipe-to-delete directives which are under
development.
|
