Merge branch 'release/2.0.2'

richard67 · richard67 · commit a19f7504927c · 2018-04-17T19:55:43.000+02:00
diff --git a/CHANGELOG.md b/CHANGELOG.md
@@ -1,5 +1,13 @@
 # Changelog
 
+## v2.0.2, 2018-04-17
+
+Fetched from [heiseonline/shariff](https://github.com/heiseonline/shariff):
+
+- Fix installation instructions.
+- Fixed XSS vulnerability discovered by JoJoAction in twitter service ([heiseonline#319](https://github.com/heiseonline/shariff/pull/319)).
+- Update package-lock.json to match dependencies.
+
 ## v2.0.1, 2018-03-15
 
 Fixed demo/index.html
diff --git a/README-de.md b/README-de.md
@@ -15,14 +15,15 @@ Shariff besteht aus zwei Teilen. Der erste Teil ist eine einfache JavaScript-Bib
 ## Erste Schritte
 
 1. Das [aktuellste Shariff-Plus-Release](https://github.com/richard67/shariff-plus/releases/latest) herunterladen
-2.  CSS im `<head>` einbinden:
-    * `shariff.complete.css` enthält alle Abhängigkeiten
+2. Alle im Release enthaltenen Dateien hochladen
+3.  CSS im `<head>` einbinden:
+    * `shariff.complete.css` verlässt sich auf die im Release enthaltenen Abhängigkeiten
     * `shariff.min.css` verwenden, wenn [Font Awesome](https://github.com/FortAwesome/Font-Awesome) bereits in Ihrer Seite geladen wird
-3. JavaScript unmittelbar vor `</body>` einbinden:
-    * `shariff.complete.js` enthält alle Abhängigkeiten
+4. JavaScript unmittelbar vor `</body>` einbinden:
+    * `shariff.complete.js` verlässt sich auf die im Release enthaltenen Abhängigkeiten
     * `shariff.min.js` verwenden, wenn [jQuery](https://github.com/jquery/jquery) bereits in der Seite vorhanden ist
-4. Beliebig viele `<div class="shariff">` Elemente einfügen
-5. Mit den unten beschriebenen `data`-Attributen Aussehen und Funktion konfigurieren
+5. Beliebig viele `<div class="shariff">` Elemente einfügen
+6. Mit den unten beschriebenen `data`-Attributen Aussehen und Funktion konfigurieren
 
 Die Zähler in den Buttons benötigen ein [Backend](#backends) auf ihrem Server.
 
diff --git a/README.md b/README.md
@@ -15,14 +15,15 @@ Shariff consists of two parts: a simple JavaScript client library and an optiona
 ## Getting Started
 
 1. Download the [latest release](https://github.com/richard67/shariff-plus/releases/latest)
-2. Include CSS in `<head>`:
-    * `shariff.complete.css` contains all dependencies
-    * if [Font Awesome](https://github.com/FortAwesome/Font-Awesome) is already included in your site, use `shariff.min.css`
-3. Include JavaScript right before `</body>`:
-    * `shariff.complete.js` contains all dependencies
-    * if [jQuery](https://github.com/jquery/jquery) is already included in your site, use `shariff.min.js`
-4. Insert one or more `<div class="shariff">` elements.
-5. Customize the look using data-* attributes.
+2. Upload all files included in the release
+3. Include CSS in `<head>`:
+    * `shariff.complete.css` uses the dependencies included in the release files
+    * if [Font Awesome](https://github.com/FortAwesome/Font-Awesome) is already included in your site, use `build/shariff.min.css`
+4. Include JavaScript right before `</body>`:
+    * `shariff.complete.js` uses the dependencies included in the release files
+    * if [jQuery](https://github.com/jquery/jquery) is already included in your site, use `build/shariff.min.js`
+5. Insert one or more `<div class="shariff">` elements.
+6. Customize the look using data-* attributes.
 
 To enable the counters in the buttons, see section [Backends](#backends).
 
diff --git a/RELEASING.md b/RELEASING.md
@@ -5,7 +5,9 @@ To prepare a release you have to do the following tasks:
 1. Run `git flow release start [version]`.
 2. Bump versions in `package.json`.
 3. Update [CHANGELOG.md](CHANGELOG.md).
-2. Run `git flow release finish`.
+4. Run `npm install` to update `package-lock.json`.
+5. Commit changes.
+6. Run `git flow release finish`.
 
 After pushing the release tag to GitHub, Travis CI will create release downloads and push the release to [npmjs.com](https://www.npmjs.com).
 
diff --git a/package-lock.json b/package-lock.json
diff --git a/package.json b/package.json
@@ -1,6 +1,6 @@
 {
   "name": "shariff-plus",
-  "version": "2.0.1",
+  "version": "2.0.2",
   "description": "Shariff-Plus enables website users to share or like their favorite content without compromising their privacy. It is based on Shariff by Heise Medien GmbH & Co. KG.",
   "main": "src/js/shariff.js",
   "scripts": {
diff --git a/src/js/services/twitter.js b/src/js/services/twitter.js
@@ -5,7 +5,8 @@ var url = require('url')
 // abbreviate at last blank before length and add "\u2026" (horizontal ellipsis)
 var abbreviateText = function(text, length) {
   var div = document.createElement('div')
-  div.innerHTML = text
+  var node = document.createTextNode(text)
+  div.appendChild(node)
   var abbreviated = div.textContent
   if (abbreviated.length <= length) {
     return text

Original file line number	Diff line number	Diff line change
`@@ -1,6 +1,6 @@`
`1`	`1`	`{`
`2`	`2`	`"name": "shariff-plus",`
`3`		`- "version": "2.0.1",`
	`3`	`+ "version": "2.0.2",`
`4`	`4`	`"description": "Shariff-Plus enables website users to share or like their favorite content without compromising their privacy. It is based on Shariff by Heise Medien GmbH & Co. KG.",`
`5`	`5`	`"main": "src/js/shariff.js",`
`6`	`6`	`"scripts": {`