Severa changes:

    - fix XSS vulnerability caused by leading space
    - fix nested popup widget cancelling as well as not correctly calling render() of stubbed WCompositeWidget (#3242)
    - make WStandardItemModel robust against header data requests outside geometry (#2408)
    - added missing icon files (#2312)
    - fixed setting text later on checkbox (#2293)
    - fix tooltip not showing when wrapped inside a button (#2256)
    - allow non-modal dialog to raise to front using titlebar click (#2167)
    - document limitation of WDialog::exec() + non-event thread (#976)

Author: Koen Deforche

resources/themes/bootstrap/img/glyphicons-halflings-white.png

@@ -140,7 +140,7 @@ private:
 
   WText::RichText text_;
 
-  bool stateChanged_, textChanged_;
+  bool naked_, stateChanged_, textChanged_;
   CheckState prevState_;
 
   void undoSetChecked();

resources/themes/bootstrap/img/glyphicons-halflings.png

@@ -19,6 +19,7 @@ const char *WAbstractToggleButton::UNCHECKED_SIGNAL = "M_unchecked";
 WAbstractToggleButton::WAbstractToggleButton(WContainerWidget *parent)
   : WFormWidget(parent),
     state_(Unchecked),
+    naked_(true),
     stateChanged_(false),
     textChanged_(false)
 {
@@ -29,6 +30,7 @@ WAbstractToggleButton::WAbstractToggleButton(const WString& text,
 					     WContainerWidget *parent)
   : WFormWidget(parent),
     state_(Unchecked),
+    naked_(false),
     stateChanged_(false),
     textChanged_(false)
 { 
@@ -298,7 +300,7 @@ void WAbstractToggleButton::updateDom(DomElement& element, bool all)
 
 DomElementType WAbstractToggleButton::domElementType() const
 {
-  if (!text_.text.empty())
+  if (!naked_)
     return DomElement_LABEL;
   else
     return DomElement_INPUT;

src/Wt/WAbstractToggleButton

@@ -538,7 +538,8 @@ void WCompositeWidget::getSDomChanges(std::vector<DomElement *>& result,
 				      WApplication *app)
 {
   if (needsToBeRendered())
-    render(impl_->isRendered() ? RenderUpdate : RenderFull);
+    render(impl_->isRendered() || !WWebWidget::canOptimizeUpdates()
+	   ? RenderUpdate : RenderFull);
 
   impl_->getSDomChanges(result, app);
 }

src/Wt/WAbstractToggleButton.C

@@ -45,15 +45,19 @@ class DialogCover;
  * will be connected to accept(), and in some cases a Cancel button to
  * reject(). This solution has the drawback that it is not scalable to
  * many concurrent sessions, since for every session with a recursive
- * event loop, a thread is locked until exec() returns. A thread that is
- * locked by a recursive event loop cannot be used to process requests
- * from another sessions. When all threads in the threadpool are locked in
- * recursive event loops, the server will be unresponsive to requests
- * from any other session. In practical terms, this means you must not
- * use exec(), unless your application will never be used by more
- * concurrent users than the amount of threads in your threadpool (like on
- * some intranets or extranets).  \if java This functionality is only
- * available on Servlet 3.0 compatible servlet containers.  \endif
+ * event loop, a thread is locked until exec() returns. A thread that
+ * is locked by a recursive event loop cannot be used to process
+ * requests from another sessions. When all threads in the threadpool
+ * are locked in recursive event loops, the server will be
+ * unresponsive to requests from any other session. In practical
+ * terms, this means you must not use exec(), unless your application
+ * will never be used by more concurrent users than the amount of
+ * threads in your threadpool (like on some intranets or
+ * extranets). Using exec() is not supported from outside the regular
+ * event loop (i.e. when taking a lock on a session using
+ * WApplication::getUpdateLock() or by posting an event using
+ * WServer::post()). \if java This functionality is only available on
+ * Servlet 3.0 compatible servlet containers. \endif
  *
  * Use \link setModal() setModal(false)\endlink  to create a non-modal
  * dialog. A non-modal dialog does not block the underlying user interface:

src/Wt/WCompositeWidget.C

@@ -396,6 +396,10 @@ void WDialog::render(WFlags<RenderFlag> flags)
       impl_->bindEmpty("center-script");
   }
 
+  if (!isModal())
+    titleBar()->clicked()
+      .connect("jQuery.data(" + jsRef() + ", 'obj').bringToFront");
+
   if ( (flags & RenderFull) && autoFocus_)
     impl_->setFirstFocus();
 

src/Wt/WDialog

@@ -58,7 +58,12 @@ WInteractWidget::~WInteractWidget()
 void WInteractWidget::setPopup(bool popup)
 {
   if (popup) {
-    clicked().connect("function(o,e) { $(document).trigger('click', e); }");
+    clicked().connect
+      ("function(o,e) { "
+       WT_CLASS ".WPopupWidget.popupClicked = o;"
+       "$(document).trigger('click', e);"
+       WT_CLASS ".WPopupWidget.popupClicked = null;"
+       "}");
     clicked().preventPropagation();
   }
 

src/Wt/WDialog.C

@@ -35,8 +35,8 @@ class WText;
  * The synchronous use of a messagebox involves the use of the static
  * show() method, which blocks the current thread until the user has
  * processed the messabebox. Since this uses the WDialog::exec(), it
- * suffers from the same scalability issues. See documentation of
- * WDialog for more details.
+ * suffers from the same scalability issues as well as
+ * limitations. See documentation of WDialog for more details.
  * 
  * \if cpp
  * Example code (using the exec() method, not recommended):

src/Wt/WInteractWidget.C

@@ -123,6 +123,7 @@ void WPopupWidget::defineJS()
   LOAD_JAVASCRIPT(app, "js/WPopupWidget.js", "WPopupWidget", wtjs1);
 
   WStringStream jsObj;
+
   jsObj << "new " WT_CLASS ".WPopupWidget("
 	<< app->javaScriptClass() << ',' << jsRef() << ','
 	<< transient_ << ',' << autoHideDelay_ << ','