From fbb7dd4c3f2c3f4089fbcbcceb114c85f326ca0a Mon Sep 17 00:00:00 2001
From: bartbutenaers <bart.butenaers@gmail.com>
Date: Sun, 21 Feb 2021 22:52:41 +0100
Subject: [PATCH 1/6] EditableList custom buttons

---
 .../@node-red/editor-client/locales/en-US/editor.json          | 3 ++-
 1 file changed, 2 insertions(+), 1 deletion(-)

diff --git a/packages/node_modules/@node-red/editor-client/locales/en-US/editor.json b/packages/node_modules/@node-red/editor-client/locales/en-US/editor.json
index 99eb34a3f..8c393a3df 100755
--- a/packages/node_modules/@node-red/editor-client/locales/en-US/editor.json
+++ b/packages/node_modules/@node-red/editor-client/locales/en-US/editor.json
@@ -857,7 +857,8 @@
         }
     },
     "editableList": {
-        "add": "add"
+        "add": "add",
+        "addTitle": "add an item"
     },
     "search": {
         "empty": "No matches found",

From 60c8a2c5989e0655dab5d08415d943ca7d67a4c7 Mon Sep 17 00:00:00 2001
From: bartbutenaers <bart.butenaers@gmail.com>
Date: Sun, 21 Feb 2021 22:55:19 +0100
Subject: [PATCH 2/6] Custom buttons

---
 .../src/js/ui/common/editableList.js          | 39 ++++++++++++++++---
 1 file changed, 34 insertions(+), 5 deletions(-)

diff --git a/packages/node_modules/@node-red/editor-client/src/js/ui/common/editableList.js b/packages/node_modules/@node-red/editor-client/src/js/ui/common/editableList.js
index 4089a29af..f0d4b6085 100644
--- a/packages/node_modules/@node-red/editor-client/src/js/ui/common/editableList.js
+++ b/packages/node_modules/@node-red/editor-client/src/js/ui/common/editableList.js
@@ -67,24 +67,53 @@
                 this.topContainer.addClass(this.options.class);
             }
 
+            var buttons = this.options.buttons || [];
+
             if (this.options.addButton !== false) {
-                var addLabel;
+                var addLabel, addTittle;
                 if (typeof this.options.addButton === 'string') {
                     addLabel = this.options.addButton
                 } else {
                     if (RED && RED._) {
                         addLabel = RED._("editableList.add");
+                        addTitle = RED._("editableList.addTitle");
                     } else {
                         addLabel = 'add';
+                        addTitle = 'add new item';
                     }
                 }
-                $('<a href="#" class="red-ui-button red-ui-button-small red-ui-editableList-addButton" style="margin-top: 4px;"><i class="fa fa-plus"></i> '+addLabel+'</a>')
-                    .appendTo(this.topContainer)
+                buttons.unshift({
+                    label: addLabel,
+                    icon: "fa fa-plus",
+                    click: function(evt) {
+                        that.addItem({});
+                    },
+                    title: addTitle
+                });
+            }
+
+            buttons.forEach(function(button) {
+                var innerHtml = "";
+                var titleAttribute="";
+                if (button.icon) {
+                    innerHtml = '<i class="'+button.icon+'"></i> ';
+                }
+                if (button.label) {
+                    innerHtml += button.label;
+                }
+                if (button.title) {
+                    titleAttribute = 'title="'+button.title+'"';
+                }
+                $('<a href="#" class="red-ui-button red-ui-button-small red-ui-editableList-addButton" style="margin-top: 4px; margin-right: 5px;" '+titleAttribute+'>'+innerHtml+'</a>')
+                    .appendTo(that.topContainer)
                     .on("click", function(evt) {
                         evt.preventDefault();
-                        that.addItem({});
+                        if (button.click !== undefined) {
+                            button.click();
+                        }
                     });
-            }
+            });
+ 
             if (this.element.css("position") === "absolute") {
                 ["top","left","bottom","right"].forEach(function(s) {
                     var v = that.element.css(s);

From 8b4aa3f5af3447b8b35bd1fa9b581a0a36830b76 Mon Sep 17 00:00:00 2001
From: bartbutenaers <bart.butenaers@gmail.com>
Date: Sun, 21 Feb 2021 22:57:34 +0100
Subject: [PATCH 3/6] Custom buttons comment

---
 .../@node-red/editor-client/src/js/ui/common/editableList.js     | 1 +
 1 file changed, 1 insertion(+)

diff --git a/packages/node_modules/@node-red/editor-client/src/js/ui/common/editableList.js b/packages/node_modules/@node-red/editor-client/src/js/ui/common/editableList.js
index f0d4b6085..502c40c73 100644
--- a/packages/node_modules/@node-red/editor-client/src/js/ui/common/editableList.js
+++ b/packages/node_modules/@node-red/editor-client/src/js/ui/common/editableList.js
@@ -18,6 +18,7 @@
 /**
  * options:
  *   - addButton : boolean|string - text for add label, default 'add'
+ *   - buttons : array - list of custom buttons (objects with fields 'label', 'icon', 'title', 'click')
  *   - height : number|'auto'
  *   - resize : function - called when list as a whole is resized
  *   - resizeItem : function(item) - called to resize individual item

From ae7a3981c0f9462cb01252fb329a03cfb77330f0 Mon Sep 17 00:00:00 2001
From: bartbutenaers <bart.butenaers@gmail.com>
Date: Sun, 21 Feb 2021 23:24:40 +0100
Subject: [PATCH 4/6] Pass evt to button handler

---
 .../@node-red/editor-client/src/js/ui/common/editableList.js    | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/packages/node_modules/@node-red/editor-client/src/js/ui/common/editableList.js b/packages/node_modules/@node-red/editor-client/src/js/ui/common/editableList.js
index 502c40c73..7a8155260 100644
--- a/packages/node_modules/@node-red/editor-client/src/js/ui/common/editableList.js
+++ b/packages/node_modules/@node-red/editor-client/src/js/ui/common/editableList.js
@@ -110,7 +110,7 @@
                     .on("click", function(evt) {
                         evt.preventDefault();
                         if (button.click !== undefined) {
-                            button.click();
+                            button.click(evt);
                         }
                     });
             });

From 0fef2ab5095f2d554c68b65a8da7991744ad128e Mon Sep 17 00:00:00 2001
From: bartbutenaers <bart.butenaers@gmail.com>
Date: Mon, 22 Feb 2021 21:45:12 +0100
Subject: [PATCH 5/6] Avoid innerHtml

---
 .../editor-client/src/js/ui/common/editableList.js       | 9 +++++----
 1 file changed, 5 insertions(+), 4 deletions(-)

diff --git a/packages/node_modules/@node-red/editor-client/src/js/ui/common/editableList.js b/packages/node_modules/@node-red/editor-client/src/js/ui/common/editableList.js
index 7a8155260..d65a4f9fd 100644
--- a/packages/node_modules/@node-red/editor-client/src/js/ui/common/editableList.js
+++ b/packages/node_modules/@node-red/editor-client/src/js/ui/common/editableList.js
@@ -94,18 +94,19 @@
             }
 
             buttons.forEach(function(button) {
-                var innerHtml = "";
+                var text = "";
                 var titleAttribute="";
                 if (button.icon) {
-                    innerHtml = '<i class="'+button.icon+'"></i> ';
+                    text = '<i class="'+button.icon+'"></i> ';
                 }
                 if (button.label) {
-                    innerHtml += button.label;
+                    text += button.label;
                 }
                 if (button.title) {
                     titleAttribute = 'title="'+button.title+'"';
                 }
-                $('<a href="#" class="red-ui-button red-ui-button-small red-ui-editableList-addButton" style="margin-top: 4px; margin-right: 5px;" '+titleAttribute+'>'+innerHtml+'</a>')
+                $('<a href="#" class="red-ui-button red-ui-button-small red-ui-editableList-addButton" style="margin-top: 4px; margin-right: 5px;" '+titleAttribute+'></a>')
+                    .text(text)
                     .appendTo(that.topContainer)
                     .on("click", function(evt) {
                         evt.preventDefault();

From 02d1369d5b2595501d1c23b51954fd1e945dba18 Mon Sep 17 00:00:00 2001
From: bartbutenaers <bart.butenaers@gmail.com>
Date: Tue, 23 Feb 2021 00:00:23 +0100
Subject: [PATCH 6/6] Escape all user input

---
 .../src/js/ui/common/editableList.js          | 24 +++++++++----------
 1 file changed, 11 insertions(+), 13 deletions(-)

diff --git a/packages/node_modules/@node-red/editor-client/src/js/ui/common/editableList.js b/packages/node_modules/@node-red/editor-client/src/js/ui/common/editableList.js
index d65a4f9fd..7f823289e 100644
--- a/packages/node_modules/@node-red/editor-client/src/js/ui/common/editableList.js
+++ b/packages/node_modules/@node-red/editor-client/src/js/ui/common/editableList.js
@@ -94,19 +94,7 @@
             }
 
             buttons.forEach(function(button) {
-                var text = "";
-                var titleAttribute="";
-                if (button.icon) {
-                    text = '<i class="'+button.icon+'"></i> ';
-                }
-                if (button.label) {
-                    text += button.label;
-                }
-                if (button.title) {
-                    titleAttribute = 'title="'+button.title+'"';
-                }
-                $('<a href="#" class="red-ui-button red-ui-button-small red-ui-editableList-addButton" style="margin-top: 4px; margin-right: 5px;" '+titleAttribute+'></a>')
-                    .text(text)
+                var element = $('<a href="#" class="red-ui-button red-ui-button-small red-ui-editableList-addButton" style="margin-top: 4px; margin-right: 5px;"></a>')
                     .appendTo(that.topContainer)
                     .on("click", function(evt) {
                         evt.preventDefault();
@@ -114,6 +102,16 @@
                             button.click(evt);
                         }
                     });
+                    
+                if (button.title) {
+                    element.attr("title", button.title);
+                }
+                if (button.icon) {
+                    element.append($("<i></i>").attr("class", button.icon));
+                }
+                if (button.label) {
+                    element.append($("<span></span>").text(" " + button.label));
+                }
             });
  
             if (this.element.css("position") === "absolute") {