Merge remote-tracking branch 'origin/next' into next

docs/mithril.request.md

@@ -272,6 +272,7 @@ data.append("file", file)
 m.request({
 	method: "POST",
 	url: "/upload",
+	data: data,
 	serialize: function(data) {return data}
 })
 ```

mithril.js

@@ -1176,9 +1176,41 @@
 				$document.createRange().createContextualFragment(data))
 		} catch (e) {
 			parentElement.insertAdjacentHTML("beforeend", data)
+			replaceScriptNodes(parentElement)
 		}
 	}
 
+	// Replace script tags inside given DOM element with executable ones.
+	// Will also check children recursively and replace any found script
+	// tags in same manner.
+	function replaceScriptNodes(node) {
+		if (node.tagName === "SCRIPT") {
+			node.parentNode.replaceChild(buildExecutableNode(node), node)
+		} else {
+			var children = node.childNodes
+			if (children && children.length) {
+				for (var i = 0; i < children.length; i++) {
+					replaceScriptNodes(children[i])
+				}
+			}
+		}
+
+		return node
+	}
+
+	// Replace script element with one whose contents are executable.
+	function buildExecutableNode(node){
+		var scriptEl = document.createElement("script")
+		var attrs = node.attributes
+
+		for (var i = 0; i < attrs.length; i++) {
+			scriptEl.setAttribute(attrs[i].name, attrs[i].value)
+		}
+
+		scriptEl.text = node.innerHTML
+		return scriptEl
+	}
+
 	function injectHTML(parentElement, index, data) {
 		var nextSibling = parentElement.childNodes[index]
 		if (nextSibling) {

test/mithril.trust.js

@@ -65,5 +65,21 @@ describe("m.trust()", function () {
 			expect(root.innerHTML)
 				.to.equal("<div><p>&amp;copy;</p><p>©</p>©</div>")
 		})
+
+		// https://github.com/lhorie/mithril.js/issues/1045
+		it("correctly injects script tags and executes them", function () {
+			var HTMLString =
+			"<script>document.getElementById('root').innerText='After'</script>"
+			var root = document.createElement("div")
+			var child = document.createElement("div")
+			root.id = "root"
+			root.innerText = "Before"
+			root.appendChild(child)
+			document.body.appendChild(root)
+
+			m.render(child, m.trust(HTMLString))
+
+			expect(root.innerText).to.equal("After")
+		})
 	})
 })