chyrp/chyrp — pull request #165 by xenocrat (2013-07-12 15:35:12+00:00)
Title: Admin theme overhaul; Comments module security fix; Audio feather improvements

# Admin theme overhaul

The default admin theme has been made mobile-friendly as follows:

1) CSS media queries for screens < 768px to reflow the document to for best use of the available space.
2) A new set of SVG icons authored.
3) All PNG icon references in core admin and module admin pages have been changed to SVG icon references.
4) Admin pages modified where necessary to offer small screen controls that do not require drag-drop or hover.
5) Badly broken `expand()` function in plugins.js has been bug fixed and made compatible with responsive design.
6) `ifixpng()` function in plugins.js has been removed: no longer of much need since SVG icons are the default.
7) `fixsvg()` function added to plugins.js to provide PNG fallback for older browsers that do not support SVG.
8) admin.js.php modified to reflect the above changes, and fixed to be responsive-design-friendly on Extend pages.
9) Like module modified to serve custom stylesheet for its admin page, in order to better support small screens.

Testing performed in Safari 6, Firefox 22, Chrome 28, iOS 6.

Further information can be found in [this](http://chyrp.net/discuss/topic/making-admin-mobile-friendly/) Chyrp forum thread.

# Comments module security fix

Comments module allows script tags to be submitted if the user's group is allowed to post HTML in comments. Doesn't seem to be any good reason for posting live scripts into comments other than for mischief, so script tags are now sanitized upon comment submission and update. The sanitization results in the script tag being visible in the comment text.

Further information can be found in [this](http://chyrp.net/discuss/topic/script-is-allowed-to-be-used-in-comments/) Chyrp forum thread.

# Audio feather improvements

Audio feather has been improved in the following ways:

1) Format support significantly expanded to mp3, m4a, mp4, oga, ogg, webm.
2) Flash player fallback removed since it can only handle MP3 playback.
3) Fallback for browsers not supporting the audio tag is now a hyperlink to the audio file.
4) Broken smart fallback script has been fixed. Previously it could not handle multiple audio feathers on one page.
5) Smart fallback for browsers that cannot play the media type is now a hyperlink to the audio file.