Skip to content

Commit 06ea1db

Browse files
JeroenDeDauwclaude
andcommitted
Fix KML ground overlays never rendering
geoxml3 looks up ProjectedOverlay on window, but ResourceLoader runs module scripts inside a function, where the declaration never becomes global, so every GroundOverlay threw. Export it the way geoxml3.js exports geoXML3. Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
1 parent 06e9b3c commit 06ea1db

3 files changed

Lines changed: 9 additions & 0 deletions

File tree

RELEASE-NOTES.md

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -9,6 +9,7 @@ Released on July 31st, 2026.
99

1010
* Fixed a stored XSS vulnerability in the Google Maps service, where content from KML files loaded via the `kml` parameter was used to build map popups without sanitization, and a `NetworkLink` refresh URL was evaluated as code ([GHSA-rg4f-xvhj-mw22](https://github.com/ProfessionalWiki/Maps/security/advisories/GHSA-rg4f-xvhj-mw22))
1111
* KML popups are now limited to safe HTML: frames, objects and scripts embedded in KML descriptions are no longer rendered
12+
* Fixed `GroundOverlay` images in KML files never rendering
1213

1314
## Maps 14.1.0
1415

resources/GoogleMaps/geoxml3/ProjectedOverlay.js

Lines changed: 5 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -157,3 +157,8 @@ ProjectedOverlay.prototype.setRotation=function(deg)
157157
this.div_.style.oTransform = 'rotate('+deg+'deg)';
158158
this.div_.style.transform = 'rotate('+deg+'deg)';
159159
}
160+
161+
// Local modification (Maps extension): geoxml3 looks this constructor up on window, but
162+
// ResourceLoader runs module scripts inside a function, where a declaration does not become
163+
// global. Export it the way geoxml3.js exports geoXML3, or ground overlays never render.
164+
window.ProjectedOverlay = ProjectedOverlay;

resources/GoogleMaps/geoxml3/README

Lines changed: 3 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -15,4 +15,7 @@ code of its own:
1515
* geoxml3.js: the NetworkLink refresh schedules a call instead of a string for setInterval to evaluate.
1616
* ProjectedOverlay.js: draw() builds the ground overlay image with the DOM API instead of an HTML string.
1717

18+
ProjectedOverlay.js additionally exports its constructor on window, because ResourceLoader runs module
19+
scripts inside a function, where the declaration geoxml3.js looks for never becomes global.
20+
1821
All are marked with a "Local modification" comment. Keep them when updating the library.

0 commit comments

Comments
 (0)