redking / chosen-dojo Goto Github PK

Thanks for your working in porting this to DOJO.

The original ChosenUI instructions state:

Updating Chosen Dynamically
If you need to update the options in your select field and want Chosen to pick up the changes, you'll need to trigger the "liszt:updated" event on the field. Chosen will re-build itself based on the updated content.

MooTools Version: $("form_field").fireEvent("liszt:updated");
jQuery Version: $("#form_field").trigger("liszt:updated");
Prototype Version: Event.fire($("form_field"), "liszt:updated");

Looking through the code, it looks like this version uses topic.publish?

Is this correct, if so, how should it be formatted? I've tried topic.publish('liszt:updated'); and a number of variations around topic.publish('liszt:updated', mySelect); but am having no luck.

Thanks!

This lib is vulnerable to XSS attacks if html/javascript is entered as a search term. The lib has many instances of innerHTML replacements where textContent should be used.

Steps to reproduce:

1. Enter <iframe src=javascript:alert(1)> into the search box
2. Notice the javascript is executed because it's inserted into the DOM as html