@@ -31,9 +31,9 @@ $.fn.dropdown = function(parameters) {
3131 moduleSelector = $allModules . selector || '' ,
3232
3333 hasTouch = ( 'ontouchstart' in document . documentElement ) ,
34- clickEvent = hasTouch
35- ? 'touchstart'
36- : 'click' ,
34+ // GITEA-PATCH: always "click" as clickEvent, old code used "touchstart" as clickEvent, it is wrong,
35+ // because "touchstart" caused problems when users try to scroll and the touch point is in the dropdown.
36+ clickEvent = 'click' ,
3737
3838 time = new Date ( ) . getTime ( ) ,
3939 performance = [ ] ,
@@ -768,7 +768,7 @@ $.fn.dropdown = function(parameters) {
768768 preSelected = preSelected && preSelected !== "" ? preSelected . split ( settings . delimiter ) : [ ] ;
769769 }
770770 $ . each ( preSelected , function ( index , value ) {
771- $item . filter ( '[data-value="' + value + '"]' )
771+ $item . filter ( '[data-value="' + CSS . escape ( value ) + '"]' ) // GITEA-PATCH: use "CSS.escape" for query selector
772772 . addClass ( className . filtered )
773773 ;
774774 } ) ;
@@ -1027,7 +1027,7 @@ $.fn.dropdown = function(parameters) {
10271027 $input . append ( '<option disabled selected value></option>' ) ;
10281028 $ . each ( values , function ( index , item ) {
10291029 var
1030- value = settings . templates . deQuote ( item [ fields . value ] ) ,
1030+ value = settings . templates . escape ( item [ fields . value ] ) , // GITEA-PATCH: use "escape" for attribute value
10311031 name = settings . templates . escape (
10321032 item [ fields . name ] || '' ,
10331033 settings . preserveHTML
@@ -4180,13 +4180,14 @@ $.fn.dropdown.settings.templates = {
41804180 if ( itemType === 'item' ) {
41814181 var
41824182 maybeText = ( option [ fields . text ] )
4183- ? ' data-text="' + deQuote ( option [ fields . text ] ) + '"'
4183+ ? ' data-text="' + escape ( option [ fields . text ] ) + '"' // GITEA-PATCH: use "escape" for attribute value
41844184 : '' ,
41854185 maybeDisabled = ( option [ fields . disabled ] )
41864186 ? className . disabled + ' '
41874187 : ''
41884188 ;
4189- html += '<div class="' + maybeDisabled + ( option [ fields . class ] ? deQuote ( option [ fields . class ] ) : className . item ) + '" data-value="' + deQuote ( option [ fields . value ] ) + '"' + maybeText + '>' ;
4189+ // GITEA-PATCH: use "escape" for attribute value
4190+ html += '<div class="' + maybeDisabled + ( option [ fields . class ] ? deQuote ( option [ fields . class ] ) : className . item ) + '" data-value="' + escape ( option [ fields . value ] ) + '"' + maybeText + '>' ;
41904191 if ( option [ fields . image ] ) {
41914192 html += '<img class="' + ( option [ fields . imageClass ] ? deQuote ( option [ fields . imageClass ] ) : className . image ) + '" src="' + deQuote ( option [ fields . image ] ) + '">' ;
41924193 }
0 commit comments