mirror of
https://github.com/got-feedBack/feedBack.git
synced 2026-07-21 20:31:21 +00:00
de2a42bd35
`spec.width` / `spec.height` are plugin-controlled, and the window host builds
window.open()'s feature string by concatenation:
'popup,width=' + spec.width + ',height=' + spec.height
`spec.width || 380` passed anything truthy straight through. So a width of
'300,menubar=1' would not merely be an invalid size — it would inject window
features. Less dramatically, any non-numeric value produced a malformed feature
string and a pane that failed to open for no visible reason.
They now go through _size(): Number, round, reject anything not finite and
positive, clamp to 120..4000. A hostile or careless value falls back to the
default instead of reaching window.open() at all.
Verified against the obvious inputs: '300,menubar=1' -> 380 (default), '300' ->
300, 0/-50/NaN/{}/'abc' -> 380, 1e9 -> 4000, 5 -> 120.
Signed-off-by: topkoa <topkoa@gmail.com>
|
||
|---|---|---|
| .. | ||
| assets/venue/themes/small-club | ||
| capabilities | ||
| js | ||
| lottie | ||
| panes | ||
| svg | ||
| v3 | ||
| vendor | ||
| _tailwind.src.css | ||
| app.js | ||
| audio-mixer.js | ||
| capabilities.js | ||
| diagnostics.js | ||
| highway.js | ||
| lottie-api.js | ||
| style.css | ||
| tailwind.min.css | ||
| tour-engine.css | ||
| tour-engine.js | ||