DotVVM 2.3

New Features

• The context.ReturnFile method can now specify the Content-Disposition header. Until now, the header was always attachment.
• Added context.LocalRedirect method which checks whether the specified URL is local. We strongly recommend using this method on all places where the user can inject his own URL to redirect - e.g. Account/Login?returnUrl=something
• GridViewDataSet methods that apply sorting and paging operations on IQueryable were made public to allow writing the LoadFromQueryableAsync extension method. See #688.
• Added infrastructure for rendering script[type=html] templates. This will be useful for control developers using the Knockout template binding, especially DotVVM Business Pack.

Fixes

• Fixed error in IncludedInPage property when the resource binding was used.
• Validation errors collection was not cleared when some parts of the viewmodel were set to null or reinitialized with new objectS. The validator binding handler update method was not used at all.
• Validator.InvalidCssClass functionality didn't work properly for multiple CSS classes and didn't remove all classes in some situations.
• Fixed XSS vulnerability in registration of DotVVM polyfill resources.

Breaking changes

• CheckBox was rendering different HTML structure for the case when the text was empty. This structure did not include the label element, that is in most cases used as a base element for restyling of the checkbox design. Now, the label element is rendered in both cases.