Skip to content

quasar-v2.32.2

Latest
Latest

Choose a tag to compare

View all tags
@rstoenescu rstoenescu released this 11 Sep 12:57
· 14 commits to dev since this release
quasar-v2.32.2
c8e9f78

Security fixes

  • fix(openURL): DOM clobbering of the iOS SafariViewController bridge -> on iOS, attacker-controlled HTML rendered into the page (a <a id="SafariViewController"> through QEditor, or QSelect / QChatMessage with HTML rendering enabled) shadowed the native bridge global, so every later openURL() call threw TypeError: window.SafariViewController.isAvailable is not a function and the URL never opened. openURL() now hands the URL to the bridge only when it exposes the expected isAvailable() and show() functions, and opens a regular window otherwise (GHSA-89vp-x45c-52cq)

Fixes

  • fix(types): framework.config.globalNodes -> the option has been honored since #8634 (it sets the CSS class of the nodes Quasar appends to <body> for portals, Notify, Loading and LoadingBar) but was never declared in QuasarUIConfiguration, so a typed quasar.config file or app.use(Quasar, { config: { globalNodes } }) rejected it. It is typed now, with its class member documented

Donations

Quasar Framework is an open-source MIT-licensed project made possible due to the generous contributions by sponsors and backers. If Quasar is useful in your workflow and you want to support ongoing maintenance, please consider the following:

Assets 2
Loading