From 0693c0ae970627583f435a0e8a70ab4639b9a2f8 Mon Sep 17 00:00:00 2001 From: webzwo0i Date: Tue, 3 Mar 2015 15:37:56 +0100 Subject: [PATCH] - operator do not show up in the attribs of a pad, but authors could still leak to the pool --- src/node/handler/PadMessageHandler.js | 3 +-- 1 file changed, 1 insertion(+), 2 deletions(-) diff --git a/src/node/handler/PadMessageHandler.js b/src/node/handler/PadMessageHandler.js index 7521c05c..ab81ad87 100644 --- a/src/node/handler/PadMessageHandler.js +++ b/src/node/handler/PadMessageHandler.js @@ -659,8 +659,7 @@ function handleUserChanges(data, cb) //+ can add text with attribs //= can change or add attribs - //- can have attribs, but they are discarded and don't show up in the apool - if(op.opcode == '-') continue; + //- can have attribs, but they are discarded and don't show up in the attribs - but do show up in the pool op.attribs.split('*').forEach(function(attr) { if(!attr) return