Fixed missing starting '^' in regular expression testing for urls san…

…ity (i.e. http, https, webdav, ftp);

Added missing files from previous commit, specifically modified DomHelper to take into account of malicious JavaScript injections and XSS.

index.html

@@ -31005,7 +31005,7 @@ <h3 class="loading">loading ...</h3>
 case "URL":
 var _772;
 _772=Clipperz.Base.sanitizeString(this.value());
-if(!(/(https?|ftp|svn):\/\//.test(_772))){
+if(!(/^(https?|ftp|svn):\/\//.test(_772))){
 _772="http://"+_772;
 }
 Clipperz.YUI.DomHelper.append(this.element().dom,{tag:"a",href:_772,html:this.value(),target:"_blank"});
@@ -35036,7 +35036,7 @@ <h3 class="loading">loading ...</h3>
 if(this._hostname==null){
 var _a97;
 _a97=this.configuration()["form"]["attributes"]["action"];
-this._hostname=_a97.replace(/https?:\/\/([^\/]*)\/.*/,"$1");
+this._hostname=_a97.replace(/^https?:\/\/([^\/]*)\/.*/,"$1");
 }
 return this._hostname;
 },"favicon":function(){
@@ -36709,7 +36709,7 @@ <h3 class="loading">loading ...</h3>
 var _bf2;
 var _bf3;
 _bf2=this.formData()["attributes"]["action"];
-_bf3=_bf2.replace(/https?:\/\/([^\/]*)\/.*/,"$1");
+_bf3=_bf2.replace(/^https?:\/\/([^\/]*)\/.*/,"$1");
 this._favicon="http://"+_bf3+"/favicon.ico";
 }
 return this._favicon;
@@ -36888,7 +36888,7 @@ <h3 class="loading">loading ...</h3>
 var _c1e;
 var url;
 url=this.bindings()["url"].field().value();
-if(/https?\:\/\//.test(url)==false){
+if(/^https?\:\/\//.test(url)==false){
 url="http://"+url;
 }
 if(Clipperz_IEisBroken===true){
@@ -36898,7 +36898,7 @@ <h3 class="loading">loading ...</h3>
 var _c21;
 _c20=this.bindings()["username"].field().value();
 _c21=this.bindings()["password"].field().value();
-/(https?\:\/\/)?(.*)/.test(url);
+/(^https?\:\/\/)?(.*)/.test(url);
 _c1e=RegExp.$1+_c20+":"+_c21+"@"+RegExp.$2;
 }
 MochiKit.DOM.currentWindow().location.href=_c1e;
@@ -36928,7 +36928,7 @@ <h3 class="loading">loading ...</h3>
 },this));
 },"runDirectLogin":function(_c27){
 var _c28;
-if(/(https?|webdav|ftp)\:/.test(this.formData()["attributes"]["action"])==false){
+if(/^(https?|webdav|ftp)\:/.test(this.formData()["attributes"]["action"])==false){
 var _c29;
 if(typeof (_c27)!="undefined"){
 _c27.close();
@@ -38507,7 +38507,7 @@ <h5>Please enable scripting or upgrade your browser.</h5>
 		<a href="http://www.clipperz.com/terms_of_service" target="black">Terms of service</a> -
 		<a href="http://www.clipperz.com/privacy_policy" target="black">Privacy policy</a>
 		&nbsp;-&nbsp;
-		Application version: community.edition (revision 5)
+		Application version: community.edition (revision 6)
 	</div>
 
 	<div id="recordDetailEditModeHeaderMask"></div>

index_debug.html

@@ -591,7 +591,7 @@ <h5>Please enable scripting or upgrade your browser.</h5>
 		<a href="http://www.clipperz.com/terms_of_service" target="black">Terms of service</a> -
 		<a href="http://www.clipperz.com/privacy_policy" target="black">Privacy policy</a>
 		&nbsp;-&nbsp;
-		Application version: community.edition (revision 5)
+		Application version: community.edition (revision 6)
 	</div>
 
 	<div id="recordDetailEditModeHeaderMask"></div>

js/src/Bookmarklet_IE.js

@@ -0,0 +1,23 @@
+//
+//	IE limit: 508 characters!!!!!
+//
+
+loadClipperzBookmarklet = function() {
+	var	headNode;
+	var clipperzScript;
+
+	clipperzScript = document.getElementById('clipperzScript');
+	headNode = document.getElementsByTagName("head").item(0);
+
+	if (clipperzScript) {
+		headNode.removeChild(clipperzScript);
+	}
+
+	clipperzScript = document.createElement('script');
+	clipperzScript.setAttribute('src', 'http%3a%2f%2fclipperz.com%2ffiles%2fclipperz.com%2fbookmarklet%2fBookmarklet.js');
+	clipperzScript.setAttribute('type', 'text/javascript');
+	clipperzScript.setAttribute('defer', true);
+	headNode.appendChild(clipperzScript);
+}
+
+loadClipperzBookmarklet();

js/src/Clipperz/PM/BookmarkletProcessor.js

@@ -117,7 +117,7 @@ Clipperz.PM.BookmarkletProcessor.prototype = MochiKit.Base.update(null, {
 
 			actionUrl = this.configuration()['form']['attributes']['action'];
 //MochiKit.Logging.logDebug("+++ actionUrl: " + actionUrl);
-			this._hostname = actionUrl.replace(/https?:\/\/([^\/]*)\/.*/, '$1');
+			this._hostname = actionUrl.replace(/^https?:\/\/([^\/]*)\/.*/, '$1');
 		}
 
 		return this._hostname;

js/src/Clipperz/PM/Components/RecordDetail/FieldValueComponent.js

@@ -92,7 +92,7 @@ YAHOO.extendX(Clipperz.PM.Components.RecordDetail.FieldValueComponent, Clipperz.
 					var	urlLocation;
 
 					urlLocation = Clipperz.Base.sanitizeString(this.value());
-					if (! (/(https?|ftp|svn):\/\//.test(urlLocation))) {
+					if (! (/^(https?|ftp|svn):\/\//.test(urlLocation))) {
 						urlLocation = 'http://' + urlLocation;
 					}
 					Clipperz.YUI.DomHelper.append(this.element().dom, {tag:'a', href:urlLocation, html:this.value(), target:'_blank'});

js/src/Clipperz/PM/DataModel/DirectLogin.js

@@ -80,7 +80,7 @@ Clipperz.PM.DataModel.DirectLogin.prototype = MochiKit.Base.update(null, {
 			var hostname;
 
 			actionUrl = this.formData()['attributes']['action'];
-			hostname = actionUrl.replace(/https?:\/\/([^\/]*)\/.*/, '$1');
+			hostname = actionUrl.replace(/^https?:\/\/([^\/]*)\/.*/, '$1');
 			this._favicon = "http://" + hostname + "/favicon.ico";
 		}
 
@@ -382,7 +382,7 @@ Clipperz.PM.DataModel.DirectLogin.prototype = MochiKit.Base.update(null, {
 
 			url = this.bindings()['url'].field().value();
 
-			if (/https?\:\/\//.test(url) == false) {
+			if (/^https?\:\/\//.test(url) == false) {
 				url = 'http://' + url;
 			}
 
@@ -395,7 +395,7 @@ Clipperz.PM.DataModel.DirectLogin.prototype = MochiKit.Base.update(null, {
 				username = this.bindings()['username'].field().value();
 				password = this.bindings()['password'].field().value();
 
-				/(https?\:\/\/)?(.*)/.test(url);
+				/(^https?\:\/\/)?(.*)/.test(url);
 
 				completeUrl = RegExp.$1 + username + ':' + password + '@' + RegExp.$2;
 			}
@@ -464,7 +464,7 @@ Clipperz.PM.DataModel.DirectLogin.prototype = MochiKit.Base.update(null, {
 
 //console.log("formData.attributes", this.formData()['attributes']);
 //		if (/^javascript/.test(this.formData()['attributes']['action'])) {
-		if (/(https?|webdav|ftp)\:/.test(this.formData()['attributes']['action']) == false) {
+		if (/^(https?|webdav|ftp)\:/.test(this.formData()['attributes']['action']) == false) {
 			var messageBoxConfiguration;
 
 			if (typeof(aNewWindow) != 'undefined') {