mbk-lab
/
nextcloud
2
0
Fork 0
Code Issues Pull Requests Projects Releases Wiki Activity

Merge pull request #12677 from nextcloud/bugfix/12601/fix-csp-issue-updater 

Open the updater via a POST form submit instead of eval the JS code directly
This commit is contained in:
Morris Jobke 2018-11-28 19:29:49 +01:00 committed by GitHub
parent 802a978bb5 7b90e05507
commit 422f48e3aa
No known key found for this signature in database
GPG Key ID: 4AEE18F83AFDEB23
3 changed files with 24 additions and 37 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

20
apps/updatenotification/js/updatenotification.js
View File

File diff suppressed because one or more lines are too long

2
apps/updatenotification/js/updatenotification.js.map
View File

File diff suppressed because one or more lines are too long

39
apps/updatenotification/src/components/root.vue
View File

@ -251,34 +251,21 @@
clickUpdaterButton: function() { clickUpdaterButton: function() {
$.ajax({ $.ajax({
url: OC.generateUrl('/apps/updatenotification/credentials') url: OC.generateUrl('/apps/updatenotification/credentials')
}).success(function(data) { }).success(function(token) {
$.ajax({ // create a form to send a proper post request to the updater
url: OC.getRootPath()+'/updater/', var form = document.createElement('form');
headers: { form.setAttribute('method', 'post');
'X-Updater-Auth': data form.setAttribute('action', OC.getRootPath() + '/updater/');
},
method: 'POST',
success: function(data){
if(data !== 'false') {
var body = $('body');
$('head').remove();
body.html(data);
// Eval the script elements in the response var hiddenField = document.createElement('input');
var dom = $(data); hiddenField.setAttribute('type', 'hidden');
dom.filter('script').each(function() { hiddenField.setAttribute('name', 'updater-secret-input');
eval(this.text || this.textContent || this.innerHTML || ''); hiddenField.setAttribute('value', token);
});
body.removeAttr('id'); form.appendChild(hiddenField);
body.attr('id', 'body-settings');
} document.body.appendChild(form);
}, form.submit();
error: function() {
OC.Notification.showTemporary(t('updatenotification', 'Could not start updater, please try the manual update'));
this.updaterEnabled = false;
}.bind(this)
});
}.bind(this)); }.bind(this));
}, },
changeReleaseChannel: function() { changeReleaseChannel: function() {