The_Great_Archive/cryptpad
1
0
Fork 0
mirror of https://github.com/cryptpad/cryptpad.git synced 2026-09-14 11:05:41 +05:00
Code Issues Packages Projects Releases Wiki Activity

Fix redirect issue

Browse Source
This commit is contained in:
yflory 2025-05-02 15:28:42 +02:00
parent 3664c4a3f3
commit 157483cea9
4 changed files with 21 additions and 11 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

21
www/bounce/main.js
View File

@ -11,13 +11,32 @@ define(['/api/config'], function (ApiConfig) {
*/
// when a URL is rejected we close the window
var reject = function () {
window.close();
};
// only redirect if the request comes from CryptPad's sandbox
const safeOrigin = new URL(ApiConfig.httpSafeOrigin).origin;
if (!document.referrer) {
window.alert('This link only works when loaded from a CryptPad document');
return void reject();
}
try {
const parsed = new URL(document.referrer);
if (parsed.origin !== safeOrigin) {
window.alert('Invalid referrer');
return void reject();
}
} catch (e) {
console.error("Invalid referrer", e);
return;
}
// this app is intended to be loaded and used exclusively from the sandbox domain
// where stricter CSP blocks various attacks. Reject any other usage.
if (ApiConfig.httpSafeOrigin !== window.location.origin) {
if (safeOrigin !== window.location.origin) {
window.alert('The bounce application must only be used from the sandbox domain, ' +
'please report this issue on https://github.com/cryptpad/cryptpad');
return void reject();

1
www/common/common-interface.js
View File

@ -1126,6 +1126,7 @@ define([
window.open('/bounce/#'+encodeURIComponent(href));
return;
}
// XXX
window.parent.location = href;
});
if (exitable) {

6
www/common/sframe-common-outer.js
View File

@ -1038,12 +1038,6 @@ define([
});
sframeChan.on('EV_OPEN_URL', openURL);
sframeChan.on('EV_OPEN_UNSAFE_URL', function (url) {
if (url) {
window.open(ApiConfig.httpSafeOrigin + '/bounce/#' + encodeURIComponent(url));
}
});
sframeChan.on('Q_GET_PAD_METADATA', function (data, cb) {
if (!data || !data.channel) {
data = {

4
www/common/sframe-common.js
View File

@ -708,10 +708,6 @@ define([
return window.location.origin + '/bounce/#' + encodeURIComponent(url);
};
funcs.openUnsafeURL = function (url) {
var app = ctx.metadataMgr.getPrivateData().app;
if (app === "sheet") {
return void ctx.sframeChan.event('EV_OPEN_UNSAFE_URL', url);
}
var bounceHref = window.location.origin + '/bounce/#' + encodeURIComponent(url);
window.open(bounceHref);
};