dnrops
/
cryptpad
mirror of https://github.com/xwiki-labs/cryptpad
1
0
Fork 0
Code Issues Packages Projects Releases Wiki Activity

tolerate trailing slashes in httpSafeDomain

This commit is contained in:
ansuz 2020-04-03 10:37:23 -04:00
parent 3b05d24f10
commit 9fa93172cf
2 changed files with 6 additions and 12 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

14
server.js
View File

@ -42,7 +42,8 @@ if (process.env.PACKAGE) {
throw new Error("No 'httpUnsafeOrigin' provided"); throw new Error("No 'httpUnsafeOrigin' provided");
} }
config.httpUnsafeOrigin = config.httpUnsafeOrigin.trim().replace(/\/$/, ''); config.httpUnsafeOrigin = config.httpUnsafeOrigin.trim();
config.httpSafeOrigin = config.httpSafeOrigin.trim().replace(/\/$/, '');
// fall back to listening on a local address // fall back to listening on a local address
// if httpAddress is not a string // if httpAddress is not a string
@ -125,15 +126,12 @@ var setHeaders = (function () {
if (Object.keys(headers).length) { if (Object.keys(headers).length) {
return function (req, res) { return function (req, res) {
const h = [ const h = [
/^\/+pad\/inner\.html.*/, /^\/pad\/inner\.html.*/,
/^\/common\/onlyoffice\/.*\/index\.html.*/, /^\/common\/onlyoffice\/.*\/index\.html.*/,
/^\/+(sheet|ooslide|oodoc)\/in.*\.html.*/, /^\/(sheet|ooslide|oodoc)\/inner\.html.*/,
].some((regex) => { ].some((regex) => {
if (regex.test('' + req.url)) { return regex.test(req.url);
console.log('CSP MATCH: [%s] <= [%s]', regex, req.url); }) ? padHeaders : headers;
return true;
}
}) ? padHeaders: headers;
for (let header in h) { res.setHeader(header, h[header]); } for (let header in h) { res.setHeader(header, h[header]); }
}; };
} }

4
www/common/sframe-app-outer.js
View File

@ -31,10 +31,6 @@ define([
ApiConfig.httpSafeOrigin + window.location.pathname + 'inner.html?' + ApiConfig.httpSafeOrigin + window.location.pathname + 'inner.html?' +
requireConfig.urlArgs + '#' + encodeURIComponent(JSON.stringify(req))); requireConfig.urlArgs + '#' + encodeURIComponent(JSON.stringify(req)));
console.log(ApiConfig.httpSafeOrigin);
console.error(document.getElementById('sbox-iframe').getAttribute('src'));
// This is a cheap trick to avoid loading sframe-channel in parallel with the // This is a cheap trick to avoid loading sframe-channel in parallel with the
// loading screen setup. // loading screen setup.
var done = waitFor(); var done = waitFor();