Update Editor documentation.

src/documentation/reference-guide/1.10/dijit/Editor.rst

@@ -43,6 +43,18 @@ Limitations
       <p>This is the initial content.</p>
   </div>
 
+* The editor's value property accepts all HTML and renders it in the document being edited.  To avoid cross site scripting issues, use the editor's content filter properties to sanitize the HTML:
+
+.. js ::
+
+    require(["dijit/Editor", "my/favorite/sanitizer"], function (Editor, sanitizer) {
+        var myEditor = new Editor({
+            contentPreFilters: [ sanitizer.sanitize ],
+            contentPostFilters: [ sanitizer.sanitize ]
+        });
+    });
+
+
 * The editor cannot be created on a hidden div.  This is in large part due to the frames and similar.  You will get odd browser errors should you attempt to create an editor on a hidden div.
 
 * All browsers implement some of the underlying commands differently and may generate different markup, so do not expect identical markup out of each browser.  All markup generated by any browser should render 'equivalently'.

src/documentation/reference-guide/1.10/dijit/_editor/plugins/ViewSource.rst

@@ -23,7 +23,7 @@ Once required in and enabled, this plugin provides the following features to dij
 * Button with icon in toolbar for switching the view of the content from RTE to Source mode and back
 * Keyboard hotkey: CTRL-SHIFT-F12 toggles between source and RTE mode of the content.
 * Works well when paired with the FullScreen plugin.  This plugin is 'FullScreen' aware and will behave appropriately.
-* Built-in filters to strip out potentially dangerous input from being inserted, such as <script> tags, <iframe> tags, and comment tags, which are often used as a way to do XSS (Cross-SiteScripting hijacks).
+* Built-in filters to strip out potentially dangerous input from being inserted, such as <script> tags, <iframe> tags, and comment tags, which are often used as a way to do XSS (Cross-SiteScripting hijacks).  The filters are applied to the editor's initial content and any time the editor's value is set or retrieved.
 * When enabled, all other RTE plugins are disabled for the duration of the source view.  This is because in source view mode, the other plugins  do not apply.
 * Provides a 'readOnly' mode that, if enabled on the plugin, allows the user to see the source, but they cannot change it.
 

src/documentation/reference-guide/1.6/dijit/Editor.rst

@@ -44,6 +44,19 @@ Limitations
     <p>This is the initial content.</p>
   </div>
 
+* The editor's value property accepts all HTML and renders it in the document being edited.  To avoid cross site scripting issues, use the editor's content filter properties to sanitize the HTML:
+
+.. js ::
+
+    dojo.require("dijit.Editor");
+    dojo.require("my.favorite.sanitizer");
+    function create() {
+        var myEditor = new dijit.Editor({
+            contentPreFilters: [ my.favorite.sanitizer.sanitize ],
+            contentPostFilters: [ my.favorite.sanitizer.sanitize ]
+        });
+    }
+
 * The editor cannot be created on a hidden div.  This is in large part due to the frames and similar.  You will get odd browser errors should you attempt to create an editor on a hidden div.
 
 * All browsers implement some of the underlying commands differently and may generate different markup, so do not expect identical markup out of each browser.  All markup generated by any browser should render 'equivalently'.

src/documentation/reference-guide/1.6/dijit/_editor/plugins/ViewSource.rst

@@ -23,9 +23,9 @@ Once required in and enabled, this plugin provides the following features to dij
 * Button with icon in toolbar for switching the view of the content from RTE to Source mode and back
 * Keyboard hotkey: CTRL-SHIFT-F12 toggles between source and RTE mode of the content.
 * Works well when paired with the FullScreen plugin.  This plugin is 'FullScreen' aware and will behave appropriately.
-* Built-in filters to strip out potentially dangerous input from being inserted, such as <script> tags, <iframe> tags, and comment tags, that are often used as a way to do XSS (Cross-SiteScripting hijacks).
+* Built-in filters to strip out potentially dangerous input from being inserted, such as <script> tags, <iframe> tags, and comment tags, that are often used as a way to do XSS (Cross-SiteScripting hijacks).  The filters are applied to the editor's initial content and any time the editor's value is set or retrieved.
 * When enabled, all other RTE plugins are disabled for the duration of the source view.  This is because in source view mode, the other plugins  do not apply.
-* Provides a 'readOnly' mode that, if enabled on the plugin, allows the user to see the source, but they cannot change it.  
+* Provides a 'readOnly' mode that, if enabled on the plugin, allows the user to see the source, but they cannot change it.
 
 
 =====

src/documentation/reference-guide/1.7/dijit/Editor.rst

@@ -44,6 +44,19 @@ Limitations
     <p>This is the initial content.</p>
   </div>
 
+* The editor's value property accepts all HTML and renders it in the document being edited.  To avoid cross site scripting issues, use the editor's content filter properties to sanitize the HTML:
+
+.. js ::
+
+    dojo.require("dijit.Editor");
+    dojo.require("my.favorite.sanitizer");
+    function create() {
+        var myEditor = new dijit.Editor({
+            contentPreFilters: [ my.favorite.sanitizer.sanitize ],
+            contentPostFilters: [ my.favorite.sanitizer.sanitize ]
+        });
+    }
+
 * The editor cannot be created on a hidden div.  This is in large part due to the frames and similar.  You will get odd browser errors should you attempt to create an editor on a hidden div.
 
 * All browsers implement some of the underlying commands differently and may generate different markup, so do not expect identical markup out of each browser.  All markup generated by any browser should render 'equivalently'.

src/documentation/reference-guide/1.7/dijit/_editor/plugins/ViewSource.rst

@@ -23,7 +23,7 @@ Once required in and enabled, this plugin provides the following features to dij
 * Button with icon in toolbar for switching the view of the content from RTE to Source mode and back
 * Keyboard hotkey: CTRL-SHIFT-F12 toggles between source and RTE mode of the content.
 * Works well when paired with the FullScreen plugin.  This plugin is 'FullScreen' aware and will behave appropriately.
-* Built-in filters to strip out potentially dangerous input from being inserted, such as <script> tags, <iframe> tags, and comment tags, which are often used as a way to do XSS (Cross-SiteScripting hijacks).
+* Built-in filters to strip out potentially dangerous input from being inserted, such as <script> tags, <iframe> tags, and comment tags, which are often used as a way to do XSS (Cross-SiteScripting hijacks).  The filters are applied to the editor's initial content and any time the editor's value is set or retrieved.
 * When enabled, all other RTE plugins are disabled for the duration of the source view.  This is because in source view mode, the other plugins  do not apply.
 * Provides a 'readOnly' mode that, if enabled on the plugin, allows the user to see the source, but they cannot change it.
 

src/documentation/reference-guide/1.8/dijit/Editor.rst

@@ -44,6 +44,17 @@ Limitations
       <p>This is the initial content.</p>
   </div>
 
+* The editor's value property accepts all HTML and renders it in the document being edited.  To avoid cross site scripting issues, use the editor's content filter properties to sanitize the HTML:
+
+.. js ::
+
+    require(["dijit/Editor", "my/favorite/sanitizer"], function (Editor, sanitizer) {
+        var myEditor = new Editor({
+            contentPreFilters: [ sanitizer.sanitize ],
+            contentPostFilters: [ sanitizer.sanitize ]
+        });
+    });
+
 * The editor cannot be created on a hidden div.  This is in large part due to the frames and similar.  You will get odd browser errors should you attempt to create an editor on a hidden div.
 
 * All browsers implement some of the underlying commands differently and may generate different markup, so do not expect identical markup out of each browser.  All markup generated by any browser should render 'equivalently'.

src/documentation/reference-guide/1.8/dijit/_editor/plugins/ViewSource.rst

@@ -23,7 +23,7 @@ Once required in and enabled, this plugin provides the following features to dij
 * Button with icon in toolbar for switching the view of the content from RTE to Source mode and back
 * Keyboard hotkey: CTRL-SHIFT-F12 toggles between source and RTE mode of the content.
 * Works well when paired with the FullScreen plugin.  This plugin is 'FullScreen' aware and will behave appropriately.
-* Built-in filters to strip out potentially dangerous input from being inserted, such as <script> tags, <iframe> tags, and comment tags, which are often used as a way to do XSS (Cross-SiteScripting hijacks).
+* Built-in filters to strip out potentially dangerous input from being inserted, such as <script> tags, <iframe> tags, and comment tags, which are often used as a way to do XSS (Cross-SiteScripting hijacks).  The filters are applied to the editor's initial content and any time the editor's value is set or retrieved.
 * When enabled, all other RTE plugins are disabled for the duration of the source view.  This is because in source view mode, the other plugins  do not apply.
 * Provides a 'readOnly' mode that, if enabled on the plugin, allows the user to see the source, but they cannot change it.
 

src/documentation/reference-guide/1.9/dijit/Editor.rst

@@ -43,6 +43,17 @@ Limitations
       <p>This is the initial content.</p>
   </div>
 
+* The editor's value property accepts all HTML and renders it in the document being edited.  To avoid cross site scripting issues, use the editor's content filter properties to sanitize the HTML:
+
+.. js ::
+
+    require(["dijit/Editor", "my/favorite/sanitizer"], function (Editor, sanitizer) {
+        var myEditor = new Editor({
+            contentPreFilters: [ sanitizer.sanitize ],
+            contentPostFilters: [ sanitizer.sanitize ]
+        });
+    });
+
 * The editor cannot be created on a hidden div.  This is in large part due to the frames and similar.  You will get odd browser errors should you attempt to create an editor on a hidden div.
 
 * All browsers implement some of the underlying commands differently and may generate different markup, so do not expect identical markup out of each browser.  All markup generated by any browser should render 'equivalently'.

src/documentation/reference-guide/1.9/dijit/_editor/plugins/ViewSource.rst

@@ -23,7 +23,7 @@ Once required in and enabled, this plugin provides the following features to dij
 * Button with icon in toolbar for switching the view of the content from RTE to Source mode and back
 * Keyboard hotkey: CTRL-SHIFT-F12 toggles between source and RTE mode of the content.
 * Works well when paired with the FullScreen plugin.  This plugin is 'FullScreen' aware and will behave appropriately.
-* Built-in filters to strip out potentially dangerous input from being inserted, such as <script> tags, <iframe> tags, and comment tags, which are often used as a way to do XSS (Cross-SiteScripting hijacks).
+* Built-in filters to strip out potentially dangerous input from being inserted, such as <script> tags, <iframe> tags, and comment tags, which are often used as a way to do XSS (Cross-SiteScripting hijacks).  The filters are applied to the editor's initial content and any time the editor's value is set or retrieved.
 * When enabled, all other RTE plugins are disabled for the duration of the source view.  This is because in source view mode, the other plugins  do not apply.
 * Provides a 'readOnly' mode that, if enabled on the plugin, allows the user to see the source, but they cannot change it.