From d6284b4d22d1e6912b01228b7d2a63e9fecbc5fb Mon Sep 17 00:00:00 2001
From: till <till@php.net>
Date: Wed, 02 Nov 2011 11:13:42 -0400
Subject: [PATCH] check-in 3.4.6 (without moxieplayer due to a content-spoofing vulnerability)

---
 program/js/common.js |   77 +++++++++++++++++++++++++-------------
 1 files changed, 50 insertions(+), 27 deletions(-)

diff --git a/program/js/common.js b/program/js/common.js
index 16f2ebf..831e44a 100644
--- a/program/js/common.js
+++ b/program/js/common.js
@@ -171,14 +171,12 @@
   var opcode = 0;
   e = e || window.event;
 
-  if (bw.mac && e) {
+  if (bw.mac && e)
     opcode += (e.metaKey && CONTROL_KEY) + (e.shiftKey && SHIFT_KEY);
-    return opcode;
-  }
-  if (e) {
+  else if (e)
     opcode += (e.ctrlKey && CONTROL_KEY) + (e.shiftKey && SHIFT_KEY);
-    return opcode;
-  }
+
+  return opcode;
 },
 
 /**
@@ -347,13 +345,25 @@
           break;
       }
     }
-
-    if (ret)
-      delete ret.event;
+    if (ret && ret.event) {
+      try {
+        delete ret.event;
+      } catch (err) {
+        // IE6-7 doesn't support deleting HTMLFormElement attributes (#1488017)
+        $(ret).removeAttr('event');
+      }
+    }
   }
 
   this._event_exec = false;
-  delete e.event;
+  if (e.event) {
+    try {
+      delete e.event;
+    } catch (err) {
+      // IE6-7 doesn't support deleting HTMLFormElement attributes (#1488017)
+      $(e).removeAttr('event');
+    }
+  }
 
   return ret;
 }
@@ -383,21 +393,17 @@
       parent = arg.parent,
       obj = document.createElement('DIV');
 
-    with (obj) {
-      id = this.name;
-      with (style) {
-	    position = 'absolute';
-        visibility = (vis) ? (vis==2) ? 'inherit' : 'visible' : 'hidden';
-        left = l+'px';
-        top = t+'px';
-        if (w)
-	      width = w.toString().match(/\%$/) ? w : w+'px';
-        if (h)
-	      height = h.toString().match(/\%$/) ? h : h+'px';
-        if (z)
-          zIndex = z;
-	  }
-    }
+    obj.id = this.name;
+    obj.style.position = 'absolute';
+    obj.style.visibility = (vis) ? (vis==2) ? 'inherit' : 'visible' : 'hidden';
+    obj.style.left = l+'px';
+    obj.style.top = t+'px';
+    if (w)
+	  obj.style.width = w.toString().match(/\%$/) ? w : w+'px';
+    if (h)
+	  obj.style.height = h.toString().match(/\%$/) ? h : h+'px';
+    if (z)
+      obj.style.zIndex = z;
 
     if (parent)
       parent.appendChild(obj);
@@ -611,10 +617,10 @@
       return null;
   }
   else {
-    begin += 2;  
+    begin += 2;
   }
 
-  var end = document.cookie.indexOf(";", begin);
+  var end = dc.indexOf(";", begin);
   if (end == -1)
     end = dc.length;
 
@@ -665,6 +671,23 @@
   return String(str).replace(/([.*+?^=!:${}()|[\]\/\\])/g, '\\$1');
 };
 
+// Extend Date prototype to detect Standard timezone without DST
+// from http://www.michaelapproved.com/articles/timezone-detect-and-ignore-daylight-saving-time-dst/
+Date.prototype.getStdTimezoneOffset = function()
+{
+  var m = 12,
+    d = new Date(null, m, 1),
+    tzo = d.getTimezoneOffset();
+
+    while (--m) {
+      d.setUTCMonth(m);
+      if (tzo != d.getTimezoneOffset()) {
+        return Math.max(tzo, d.getTimezoneOffset());
+    }
+  }
+
+  return tzo;
+}
 
 // Make getElementById() case-sensitive on IE
 if (bw.ie)

--
Gitblit v1.9.1