src build elFinder-2.1-6218e9b

Changelog

@@ -1,3 +1,15 @@
+2021-06-13  Naoki Sawada  <hypweb+elfinder@gmail.com>
+	* elFinder (2.1.59):
+		- [Security:php] Fixed multiple vulnerabilities leading to RCE
+		- [php:session] Fixed #3278 wrong code of typo
+		- [js:core] #3351 allow columnsCustomName[x] to be a function
+		- [css:quicklook] Fixed #3240 remove unnecessary color specifications
+		- [cmd:extract] Fixed #3252 for checking the existence of existing files
+		- [js:core] Fixed #3359 add an option "noResizeBySelf"
+		- [VD:abstract] Fixed #3216 missing url option on upload into root
+		- And some minor bug fixes
+
+
 2021-06-09  Naoki Sawada  <hypweb+elfinder@gmail.com>
 	* elFinder (2.1.58):
 		- [VD:abstract] Fixed #3151 support RAR5 lib

README.md

@@ -1,7 +1,7 @@
 elFinder
 ========
 
-**WARNING: IF YOU HAVE OLDER (IN PARTICULAR 2.1.48 OR EARLIER) VERSIONS OF ELFINDER ON PUBLIC SERVERS, IT MAY CAUSE SERIOUS DAMAGE TO YOUR SERVER AND VISITED USER. YOU SHOULD UPDATE TO THE LATEST VERSION OR REMOVE IT FROM THE SERVER.**
+**WARNING: IF YOU HAVE OLDER (IN PARTICULAR 2.1.58 OR EARLIER) VERSIONS OF ELFINDER ON PUBLIC SERVERS, IT MAY CAUSE SERIOUS DAMAGE TO YOUR SERVER AND VISITED USER. YOU SHOULD UPDATE TO THE LATEST VERSION OR REMOVE IT FROM THE SERVER.**
 
 [![elFinder file manager for the Web](https://studio-42.github.io/elFinder/images/elFinderScr.png "elFinder file manager for the Web")](https://studio-42.github.io/elFinder/)
 

css/elfinder.full.css

@@ -1,6 +1,6 @@
 /*!
  * elFinder - file manager for web
- * Version 2.1.58 (2.1-src Nightly: 90be103) (2021-06-13)
+ * Version 2.1.58 (2.1-src Nightly: 6218e9b) (2021-06-13)
  * http://elfinder.org
  * 
  * Copyright 2009-2021, Studio 42

js/elfinder.full.js

@@ -1,6 +1,6 @@
 /*!
  * elFinder - file manager for web
- * Version 2.1.58 (2.1-src Nightly: 90be103) (2021-06-13)
+ * Version 2.1.58 (2.1-src Nightly: 6218e9b) (2021-06-13)
  * http://elfinder.org
  * 
  * Copyright 2009-2021, Studio 42
@@ -10716,7 +10716,7 @@ if (!window.cancelAnimationFrame) {
  *
  * @type String
  **/
-elFinder.prototype.version = '2.1.58 (2.1-src Nightly: 90be103)';
+elFinder.prototype.version = '2.1.58 (2.1-src Nightly: 6218e9b)';
 
 
 
@@ -25843,7 +25843,7 @@ elFinder.prototype.commands.fullscreen = function() {
 				'<ul class="ui-tabs-nav ui-helper-reset ui-helper-clearfix ui-widget-header ui-corner-top">'],
 		stpl    = '<div class="elfinder-help-shortcut"><div class="elfinder-help-shortcut-pattern">{pattern}</div> {descrip}</div>',
 		sep     = '<div class="elfinder-help-separator"></div>',
-		selfUrl = $('base').length? document.location.href.replace(/#.*$/, '') : '',
+		selfUrl = $('base').length? fm.escape(document.location.href.replace(/#.*$/, '')) : '',
 		clTabActive = fm.res('class', 'tabsactive'),
 
 		getTheme = function() {
@@ -25893,7 +25893,7 @@ elFinder.prototype.commands.fullscreen = function() {
 
 			html.push(sep);
 			html.push('<div class="'+lic+'">Licence: 3-clauses BSD Licence</div>');
-			html.push('<div class="'+lic+'">Copyright © 2009-2020, Studio 42</div>');
+			html.push('<div class="'+lic+'">Copyright © 2009-2021, Studio 42</div>');
 			html.push('<div class="'+lic+'">„ …'+fm.i18n('dontforget')+' ”</div>');
 			html.push('</div>');
 		},
@@ -27469,7 +27469,7 @@ elFinder.prototype.commands.netunmount = function() {
 
 		var doOpen = function() {
 			var openCB = function(url) {
-					var link = $('<a>').hide().appendTo($('body'));
+					var link = $('<a rel="noopener">').hide().appendTo($('body'));
 					if (fm.UA.Mobile || !inline) {
 						if (html5dl) {
 							if (!inline) {

js/extras/editors.default.js

@@ -181,7 +181,7 @@
 		if (getfile === 'ckeditor') {
 			elFinder.prototype._options.getFileCallback = function(file, fm) {
 				window.opener.CKEDITOR.tools.callFunction((function() {
-					var reParam = new RegExp('(?:[\?&]|&)CKEditorFuncNum=([^&]+)', 'i'),
+					var reParam = new RegExp('(?:[?&]|&)CKEditorFuncNum=([^&]+)', 'i'),
 						match = window.location.search.match(reParam);
 					return (match && match.length > 1) ? match[1] : '';
 				})(), fm.convAbsUrl(file.url));