author | Giulio Cesare Solaroli <giulio.cesare@clipperz.com> | 2014-05-02 15:14:18 (UTC) |
---|---|---|
committer | Giulio Cesare Solaroli <giulio.cesare@clipperz.com> | 2014-05-02 15:24:45 (UTC) |
commit | ed6b4edc82b0f65c77980713cd525053fcbc1dd2 (patch) (side-by-side diff) | |
tree | 80eb0e6ccfc4efa15c6488cc83448d8a865169df /frontend/beta/js/Clipperz/PM/BookmarkletProcessor.js | |
parent | 03659f6b3d9766898854e8a769c0c9341b3de80c (diff) | |
download | clipperz-ed6b4edc82b0f65c77980713cd525053fcbc1dd2.zip clipperz-ed6b4edc82b0f65c77980713cd525053fcbc1dd2.tar.gz clipperz-ed6b4edc82b0f65c77980713cd525053fcbc1dd2.tar.bz2 |
Fixed issues reported by cure53.de
Fixed issues CLP-01-014 and CLP-01-015
Diffstat (limited to 'frontend/beta/js/Clipperz/PM/BookmarkletProcessor.js') (more/less context) (ignore whitespace changes)
-rw-r--r-- | frontend/beta/js/Clipperz/PM/BookmarkletProcessor.js | 2 |
1 files changed, 1 insertions, 1 deletions
diff --git a/frontend/beta/js/Clipperz/PM/BookmarkletProcessor.js b/frontend/beta/js/Clipperz/PM/BookmarkletProcessor.js index 2295d3f..369b9ce 100644 --- a/frontend/beta/js/Clipperz/PM/BookmarkletProcessor.js +++ b/frontend/beta/js/Clipperz/PM/BookmarkletProcessor.js @@ -45,193 +45,193 @@ Clipperz.PM.BookmarkletProcessor.versions['abstract'].prototype = MochiKit.Base. return "BookmarkletProcessor - " + this.user(); }, //------------------------------------------------------------------------- 'user': function() { return this._user; }, //------------------------------------------------------------------------- 'configuration': function() { return this._configuration; }, //------------------------------------------------------------------------- 'record': function() { throw Clipperz.Base.exception.AbstractMethod; }, //------------------------------------------------------------------------- __syntaxFix__: "syntax fix" }); */ Clipperz.PM.BookmarkletProcessor = function(anUser, aConfiguration) { this._user = anUser; this._configuration = aConfiguration; this._recordTitle = null; this._record = null; this._editableFields = null; this._favicon = null; return this; } Clipperz.PM.BookmarkletProcessor.prototype = MochiKit.Base.update(null, { 'toString': function() { return "BookmarkletProcessor - " + this.user(); }, //------------------------------------------------------------------------- 'user': function() { return this._user; }, //------------------------------------------------------------------------- 'configuration': function() { return this._configuration; }, //------------------------------------------------------------------------- 'recordTitle': function() { if (this._recordTitle == null) { this._recordTitle = this.configuration().page.title; } return this._recordTitle; }, //------------------------------------------------------------------------- 'fields': function() { return this.configuration().form.inputs; }, //------------------------------------------------------------------------- 'editableFields': function() { if (this._editableFields == null) { this._editableFields = MochiKit.Base.filter(function(aField) { var result; var type; type = aField['type'].toLowerCase(); result = ((type != 'hidden') && (type != 'submit') && (type != 'checkbox') && (type != 'radio') && (type != 'select')); return result; }, this.fields()) } return this._editableFields; }, //------------------------------------------------------------------------- 'hostname': function() { if (this._hostname == null) { var actionUrl; - actionUrl = this.configuration()['form']['attributes']['action']; + actionUrl = Clipperz.Base.sanitizeUrl(this.configuration()['form']['attributes']['action']); //MochiKit.Logging.logDebug("+++ actionUrl: " + actionUrl); this._hostname = actionUrl.replace(/^https?:\/\/([^\/]*)\/.*/, '$1'); } return this._hostname; }, 'favicon': function() { if (this._favicon == null) { this._favicon = "http://" + this.hostname() + "/favicon.ico"; //MochiKit.Logging.logDebug("+++ favicon: " + this._favicon); } return this._favicon; }, //------------------------------------------------------------------------- 'record': function() { if (this._record == null) { var record; var recordVersion; var directLogin; var bindings; var i,c; record = new Clipperz.PM.DataModel.Record({ label:this.recordTitle(), notes:"", user:this.user() }); recordVersion = new Clipperz.PM.DataModel.RecordVersion(record, {}) record.setCurrentVersion(recordVersion); bindings = {}; c = this.editableFields().length; for (i=0; i<c; i++) { var formField; var recordField; //MochiKit.Logging.logDebug(">>> adding a field"); formField = this.editableFields()[i]; recordField = new Clipperz.PM.DataModel.RecordField({ recordVersion:recordVersion, label:formField['name'], value:formField['value'], type:Clipperz.PM.Strings.inputTypeToRecordFieldType[formField['type']], hidden:false }); recordVersion.addField(recordField); bindings[formField['name']] = recordField.key(); //MochiKit.Logging.logDebug("<<< adding a field"); } directLogin = new Clipperz.PM.DataModel.DirectLogin({ record:record, label:this.recordTitle() + Clipperz.PM.Strings['newDirectLoginLabelSuffix'], // bookmarkletVersion:this.version(), bookmarkletVersion:'0.2', favicon:this.favicon(), formData:this.configuration()['form'], bindingData:bindings }); record.addDirectLogin(directLogin); this.user().addRecord(record); this._record = record; } return this._record; }, //------------------------------------------------------------------------- __syntaxFix__: "syntax fix" }); //############################################################################# Clipperz.PM.BookmarkletProcessor.createRecordFromBookmarkletConfiguration = function(anUser, aConfiguration) { var processor; processor = new Clipperz.PM.BookmarkletProcessor(anUser, aConfiguration); return processor.record(); }; //----------------------------------------------------------------------------- Clipperz.PM.BookmarkletProcessor.sanitizeBookmarkletConfiguration = function(aConfiguration) { var result; // throw "XSS Bookmarklet attempt"; |