|
1 | 1 | <a name="1.2.0-rc1"></a> |
2 | | -# 1.2.0-rc1 spooky-giraffe (2013-08-12) |
| 2 | +# 1.2.0-rc1 spooky-giraffe (2013-08-13) |
| 3 | + |
| 4 | +[Full Commit Log](https://github.com/angular/angular.js/compare/v1.1.5...master) |
3 | 5 |
|
4 | 6 |
|
5 | 7 | ## Features |
|
71 | 73 | [#2454](https://github.com/angular/angular.js/issues/2454)) |
72 | 74 |
|
73 | 75 | - **ngMobile/ngTouch:** |
74 | | - - emit 'swipeleft' and 'swiperight' events |
| 76 | + - emit `swipeleft` and `swiperight` events |
75 | 77 | ([ab189142](https://github.com/angular/angular.js/commit/ab189142988043d0513bb796c3b54ca7d07f242d)) |
76 | | - - refactor swipe logic from ngSwipe to $swipe service. |
| 78 | + - refactor swipe logic from `ngSwipe` directive to `$swipe` service. |
77 | 79 | ([f4c6b2c7](https://github.com/angular/angular.js/commit/f4c6b2c7894cb2d82ac69a1500a27785360b81c3)) |
78 | 80 |
|
79 | 81 | - **ngMock:** |
|
315 | 317 | - due to [38deedd6](https://github.com/angular/angular.js/commit/38deedd6e3d806eb8262bb43f26d47245f6c2739), |
316 | 318 | binding more than a single expression to `*[src]` or `*[ng-src]` with the exception of `<a>` and `<img>` elements is not supported. |
317 | 319 |
|
318 | | - Concatenating expressions makes it hard to understand whether some combination of concatenated values are unsafe to use and potentially subject to XSS vulnerabilities. To simplify the task of auditing for XSS issues, we now require that a single expression be used for '*[src/ng-src]' bindings such as bindings for 'iframe[src]', 'object[src]', etc. (but not 'img[src/ng-src]' since that value is sanitized). |
| 320 | + Concatenating expressions makes it hard to understand whether some combination of concatenated values are unsafe to use and potentially subject to XSS vulnerabilities. To simplify the task of auditing for XSS issues, we now require that a single expression be used for `*[src/ng-src]` bindings such as bindings for `iframe[src]`, `object[src]`, etc. (but not `img[src/ng-src]` since that value is sanitized). |
319 | 321 |
|
320 | 322 | This change ensures that the possible pool of values that are used for data-binding is easier to trace down. |
321 | 323 |
|
|
351 | 353 | - due to [39841f2e](https://github.com/angular/angular.js/commit/39841f2ec9b17b3b2920fd1eb548d444251f4f56), |
352 | 354 | Interpolations inside DOM event handlers are disallowed. |
353 | 355 |
|
354 | | - DOM event handlers execute arbitrary Javascript code. Using an interpolation for such handlers means that the interpolated value is a JS string that is evaluated. Storing or generating such strings is error prone and leads to an XSS. On the other hand, `ngClick` and other Angular specific event handlers evaluate Angular expressions in non-window (Scope) context which makes them much safer. |
| 356 | + DOM event handlers execute arbitrary Javascript code. Using an interpolation for such handlers means that the interpolated value is a JS string that is evaluated. Storing or generating such strings is error prone and leads to XSS vulnerabilities. On the other hand, `ngClick` and other Angular specific event handlers evaluate Angular expressions in non-window (Scope) context which makes them much safer. |
355 | 357 |
|
356 | 358 | To migrate the code follow the example below: |
357 | 359 |
|
|
394 | 396 |
|
395 | 397 | - **$resource:** |
396 | 398 | - due to [05772e15](https://github.com/angular/angular.js/commit/05772e15fbecfdc63d4977e2e8839d8b95d6a92d), |
397 | | - resource instance does not have `$then` function anymore. Use the `$promise.then` instead. |
| 399 | + resource instance does not have a `$then` function anymore. Use the `$promise.then` instead. |
398 | 400 |
|
399 | 401 | Before: |
400 | 402 |
|
|
423 | 425 | resource.chaining = true; |
424 | 426 | ``` |
425 | 427 |
|
426 | | - - due to [05772e15](https://github.com/angular/angular.js/commit/05772e15fbecfdc63d4977e2e8839d8b95d6a92d), on success, promise is resolved with the resource instance rather than http response object. |
| 428 | + - due to [05772e15](https://github.com/angular/angular.js/commit/05772e15fbecfdc63d4977e2e8839d8b95d6a92d), on success, the resource promise is resolved with the resource instance rather than http response object. |
427 | 429 |
|
428 | | - Use interceptor to access the http response object. |
| 430 | + Use interceptor api to access the http response object. |
429 | 431 |
|
430 | 432 | Before: |
431 | 433 |
|
|
451 | 453 |
|
452 | 454 | - **$route:** |
453 | 455 | - due to [04cebcc1](https://github.com/angular/angular.js/commit/04cebcc133c8b433a3ac5f72ed19f3631778142b), |
454 | | - the syntax for named wildcard parameters in routes has changed from *wildcard to :wildcard* |
| 456 | + the syntax for named wildcard parameters in routes has changed from `*wildcard` to `:wildcard*` |
455 | 457 |
|
456 | 458 | To migrate the code, follow the example below. Here, `*highlight` becomes |
457 | 459 | `:highlight*`: |
|
471 | 473 | ``` |
472 | 474 |
|
473 | 475 | - due to [5599b55b](https://github.com/angular/angular.js/commit/5599b55b04788c2e327d7551a4a699d75516dd21), |
474 | | - applications that use $route will now need to load angular-route.js file and define dependency on ngRoute module. |
| 476 | + applications that use `$route` will now need to load an angular-route.js file and define a dependency on the ngRoute module. |
475 | 477 |
|
476 | 478 | Before: |
477 | 479 |
|
|
501 | 503 | - `parseKeyValue` only took the last key overwriting all the previous keys; |
502 | 504 | - `toKeyValue` joined the keys together in a comma delimited string. |
503 | 505 |
|
504 | | - This was deemed buggy behavior. If your server relied on this behavior then either the server should be fixed or a simple serialization of the array should be done on the client before passing it to $location. |
| 506 | + This was deemed buggy behavior. If your server relied on this behavior then either the server should be fixed, or a simple serialization of the array should be done on the client before passing it to $location. |
505 | 507 |
|
506 | 508 | - **ngBindHtml, sce:** due to [dae69473](https://github.com/angular/angular.js/commit/dae694739b9581bea5dbc53522ec00d87b26ae55), |
507 | 509 |
|
508 | | - ng-html-bind-unsafe has been removed and replaced by ng-html-bind (which has been removed from ngSanitize.) ng-bind-html provides ng-html-bind-unsafe like behavior (innerHTML's the result without sanitization) when bound to the result of $sce.trustAsHtml(string). When bound to a plain string, the string is sanitized via $sanitize before being innerHTML'd. If $sanitize isn't available, it's logs an exception. |
| 510 | + `ngHtmlBindUnsafe` has been removed and replaced by `ngHtmlBind` (which has been moved from `ngSanitize` module to the core `ng` module). `ngBindHtml` provides `ngHtmlBindUnsafe` like behavior (evaluate an expression and innerHTML the result into the DOM) when bound to the result of `$sce.trustAsHtml(string)`. When bound to a plain string, the string is sanitized via `$sanitize` before being innerHTML'd. If the `$sanitize` service isn't available (`ngSanitize` module is not loaded) and the bound expression evaluates to a value that is not trusted an exception is thrown. |
509 | 511 |
|
510 | 512 | - **ngForm:** due to [8ea802a1](https://github.com/angular/angular.js/commit/8ea802a1d23ad8ecacab892a3a451a308d9c39d7), |
511 | 513 |
|
|
0 commit comments