`storagePromptState`; used by `ext-storage.js`
- Fix (regression): Ensure storage dialog will not be blocked because of
canvas updating done for sake of centering background
- Fix (extensions): Ensure `langReady` changes are available by time prefs
dialog is closed and that its changes have occurred by time extensions
have first loaded (`setLang` now returns a Promise rather than `undefined`
as it waits for extension's `langReady` to resolve); this is also useful
with `ext-storage.js` so we know that `extensions_loaded` (which
conditionally updates the canvas based on `storagePromptState`) has seen
`langReady` and the storage extension hasn't set a `storagePromptState`
of "waiting"
- Fix: Allow language to be properly set back to a different locale and
retaining preference (and ensure language changes are available before
dialog closed)
- Refactoring: array extra/spread operator
- npm: Update devDep (sinon-test)
on touch devices (since `touch.js` changes `touchstart` to
`mousedown`) (@ClemArt); closes#168
- Fix: Ensure extension `mouseup` events run on "zoom" and "select"
modes (@iuyiuy); closes#159
to select all (part of #291)
- Enhancement: Add a global escape key listener to clear the selection
- Refactoring: Change 'a' to lower case in key command to avoid impression
that shift is needed
again so as not to break old SVG-Edit which fail at *presence* of
`namespace` (fixes#274)
- Known regression: Remove Openclipart as its site's now setting of
`X-Frame-Options` to `"sameorigin"` makes it unusable on our end
for our cross-origin uses
- Forward compatibility enhancement: For IAN image library, add
`svgedit=3` param to URL so that it can keep using old API for
SVG-Edit versions before 3, while conditionally using new object-based
API now (and if we switch exclusively to the object-based API in the
future, this site will continue to work)
- Docs: Add "Forward compatibility enhancement" to list
alternative to `namespace` so as not to break old SVG-Edit which fail
at *presence* of `namespace` (fixes#274)
- Forward compatibility enhancement: Once IE9 support may be dropped,
we may post messages as objects, so don't break if objects received
(embedded API, xdomain, Imagelib)
config array be set with safe origins or otherwise reject `postMessage`
messages in case from untrusted sources
- Security fix/Breaking change (xdomain): Namespace xdomain file to avoid
it being used to modify non-xdomain storage
- Security fix (Imagelib): Expose `dropXMLInternalSubset` to extensions
for preventing billion laughs attack (and use in Imagelib)
setting (though this was only for trusted origins anyways)
- Security fix (minor): For embedded API example, copy params to iframe
source without XSS risk (though params should already be XML-safe
given `encodeURIComponent` and lack of a single quote attribute context)
- Linting (LGTM): Flag origin-checked item as safe
- Refactoring: Destructuring, ellipsis
- Docs (JSDoc): Missing return value
Brett Zamir
eric