Selene Feigl

Fix HTML injection in column toggle.

2

The column toggle element gets the label as text an writes the label as HTML. When using alert("Hacked"); as column label (in HTML escaped form), the code gets executed by...

Options get doubled in non validating arg group when used in MixIn

1

When using a non-validating ArgGroup in a MixIn, the options of the ArgGroup are doubled in the "Usage" line. When placing the ArgGroup directly in the command class, the options...