author | Michael Krelin <hacker@klever.net> | 2014-06-30 18:20:13 (UTC) |
---|---|---|
committer | Michael Krelin <hacker@klever.net> | 2014-06-30 18:20:13 (UTC) |
commit | c392fe28606eefa0c814e5c25d641f5ffe623186 (patch) (unidiff) | |
tree | da03fe13ca09fadbebbad9b5d38750757270bae8 /frontend/beta/js/Clipperz/PM | |
parent | d341307d346dee62ee36b27f0f93b8f000748a96 (diff) | |
parent | 6dd16d9359e3a4dc306802588b09acd43947a606 (diff) | |
download | clipperz-c392fe28606eefa0c814e5c25d641f5ffe623186.zip clipperz-c392fe28606eefa0c814e5c25d641f5ffe623186.tar.gz clipperz-c392fe28606eefa0c814e5c25d641f5ffe623186.tar.bz2 |
Merge remote-tracking branch 'github/master' into nmaster
Diffstat (limited to 'frontend/beta/js/Clipperz/PM') (more/less context) (ignore whitespace changes)
5 files changed, 56 insertions, 21 deletions
diff --git a/frontend/beta/js/Clipperz/PM/BookmarkletProcessor.js b/frontend/beta/js/Clipperz/PM/BookmarkletProcessor.js index 2295d3f..369b9ce 100644 --- a/frontend/beta/js/Clipperz/PM/BookmarkletProcessor.js +++ b/frontend/beta/js/Clipperz/PM/BookmarkletProcessor.js | |||
@@ -138,7 +138,7 @@ Clipperz.PM.BookmarkletProcessor.prototype = MochiKit.Base.update(null, { | |||
138 | if (this._hostname == null) { | 138 | if (this._hostname == null) { |
139 | var actionUrl; | 139 | var actionUrl; |
140 | 140 | ||
141 | actionUrl = this.configuration()['form']['attributes']['action']; | 141 | actionUrl = Clipperz.Base.sanitizeUrl(this.configuration()['form']['attributes']['action']); |
142 | //MochiKit.Logging.logDebug("+++ actionUrl: " + actionUrl); | 142 | //MochiKit.Logging.logDebug("+++ actionUrl: " + actionUrl); |
143 | this._hostname = actionUrl.replace(/^https?:\/\/([^\/]*)\/.*/, '$1'); | 143 | this._hostname = actionUrl.replace(/^https?:\/\/([^\/]*)\/.*/, '$1'); |
144 | } | 144 | } |
diff --git a/frontend/beta/js/Clipperz/PM/Components/RecordDetail/DirectLoginBindingComponent.js b/frontend/beta/js/Clipperz/PM/Components/RecordDetail/DirectLoginBindingComponent.js index 0e4640e..a5a4697 100644 --- a/frontend/beta/js/Clipperz/PM/Components/RecordDetail/DirectLoginBindingComponent.js +++ b/frontend/beta/js/Clipperz/PM/Components/RecordDetail/DirectLoginBindingComponent.js | |||
@@ -100,7 +100,7 @@ YAHOO.extendX(Clipperz.PM.Components.RecordDetail.DirectLoginBindingComponent, C | |||
100 | result.push(option); | 100 | result.push(option); |
101 | for (recordFieldKey in recordFields) { | 101 | for (recordFieldKey in recordFields) { |
102 | //TODO: remove the value: field and replace it with element.dom.value = <some value> | 102 | //TODO: remove the value: field and replace it with element.dom.value = <some value> |
103 | option = {tag:'option', value:recordFieldKey, html:recordFields[recordFieldKey].label()} | 103 | option = {tag:'option', value:recordFieldKey, html:Clipperz.Base.sanitizeString(recordFields[recordFieldKey].label())} |
104 | if (recordFieldKey == this.directLoginBinding().fieldKey()) { | 104 | if (recordFieldKey == this.directLoginBinding().fieldKey()) { |
105 | option['selected'] = true; | 105 | option['selected'] = true; |
106 | } | 106 | } |
@@ -150,7 +150,7 @@ YAHOO.extendX(Clipperz.PM.Components.RecordDetail.DirectLoginBindingComponent, C | |||
150 | this.getElement('editModeBox').hide(); | 150 | this.getElement('editModeBox').hide(); |
151 | this.getElement('viewModeBox').show(); | 151 | this.getElement('viewModeBox').show(); |
152 | 152 | ||
153 | this.getElement('viewValue').update(this.directLoginBinding().field().label()); | 153 | this.getElement('viewValue').update(Clipperz.Base.sanitizeString(this.directLoginBinding().field().label())); |
154 | //MochiKit.Logging.logDebug("<<< DirectLoginBindingComponent.updateViewMode"); | 154 | //MochiKit.Logging.logDebug("<<< DirectLoginBindingComponent.updateViewMode"); |
155 | }, | 155 | }, |
156 | 156 | ||
diff --git a/frontend/beta/js/Clipperz/PM/DataModel/DirectLogin.js b/frontend/beta/js/Clipperz/PM/DataModel/DirectLogin.js index c0cfa3c..56d9d59 100644 --- a/frontend/beta/js/Clipperz/PM/DataModel/DirectLogin.js +++ b/frontend/beta/js/Clipperz/PM/DataModel/DirectLogin.js | |||
@@ -38,7 +38,7 @@ Clipperz.PM.DataModel.DirectLogin = function(args) { | |||
38 | this._record = args.record || null; | 38 | this._record = args.record || null; |
39 | this._label = args.label || "unnamed record" | 39 | this._label = args.label || "unnamed record" |
40 | this._reference = args.reference || Clipperz.PM.Crypto.randomKey(); | 40 | this._reference = args.reference || Clipperz.PM.Crypto.randomKey(); |
41 | this._favicon = args.favicon || null; | 41 | this._favicon = Clipperz.Base.sanitizeFavicon(args.favicon) || null; |
42 | this._bookmarkletVersion = args.bookmarkletVersion || "0.1"; | 42 | this._bookmarkletVersion = args.bookmarkletVersion || "0.1"; |
43 | 43 | ||
44 | this._directLoginInputs = null; | 44 | this._directLoginInputs = null; |
@@ -102,9 +102,9 @@ Clipperz.PM.DataModel.DirectLogin.prototype = MochiKit.Base.update(null, { | |||
102 | varactionUrl; | 102 | varactionUrl; |
103 | var hostname; | 103 | var hostname; |
104 | 104 | ||
105 | actionUrl = this.formData()['attributes']['action']; | 105 | actionUrl = this.action(); |
106 | hostname = actionUrl.replace(/^https?:\/\/([^\/]*)\/.*/, '$1'); | 106 | hostname = actionUrl.replace(/^https?:\/\/([^\/]*)\/.*/, '$1'); |
107 | this._favicon = "http://" + hostname + "/favicon.ico"; | 107 | this._favicon = Clipperz.Base.sanitizeFavicon("http://" + hostname + "/favicon.ico"); |
108 | } | 108 | } |
109 | 109 | ||
110 | return this._favicon; | 110 | return this._favicon; |
@@ -137,6 +137,14 @@ Clipperz.PM.DataModel.DirectLogin.prototype = MochiKit.Base.update(null, { | |||
137 | this._fixedFavicon = aValue; | 137 | this._fixedFavicon = aValue; |
138 | }, | 138 | }, |
139 | 139 | ||
140 | 'action': function () { | ||
141 | varresult; | ||
142 | |||
143 | result = Clipperz.Base.sanitizeUrl(this.formData()['attributes']['action']); | ||
144 | |||
145 | return result; | ||
146 | }, | ||
147 | |||
140 | //------------------------------------------------------------------------- | 148 | //------------------------------------------------------------------------- |
141 | 149 | ||
142 | 'bookmarkletVersion': function() { | 150 | 'bookmarkletVersion': function() { |
@@ -442,7 +450,7 @@ Clipperz.PM.DataModel.DirectLogin.prototype = MochiKit.Base.update(null, { | |||
442 | //MochiKit.Logging.logDebug("### runDirectLogin - 4"); | 450 | //MochiKit.Logging.logDebug("### runDirectLogin - 4"); |
443 | //console.log(this.formData()['attributes']); | 451 | //console.log(this.formData()['attributes']); |
444 | formElement = MochiKit.DOM.FORM(MochiKit.Base.update({id:'directLoginForm'}, {'method':this.formData()['attributes']['method'], | 452 | formElement = MochiKit.DOM.FORM(MochiKit.Base.update({id:'directLoginForm'}, {'method':this.formData()['attributes']['method'], |
445 | 'action':this.formData()['attributes']['action']})); | 453 | 'action': this.action()})); |
446 | //MochiKit.Logging.logDebug("### runDirectLogin - 5"); | 454 | //MochiKit.Logging.logDebug("### runDirectLogin - 5"); |
447 | formSubmitFunction = MochiKit.Base.method(formElement, 'submit'); | 455 | formSubmitFunction = MochiKit.Base.method(formElement, 'submit'); |
448 | //MochiKit.Logging.logDebug("### runDirectLogin - 6"); | 456 | //MochiKit.Logging.logDebug("### runDirectLogin - 6"); |
@@ -487,9 +495,9 @@ Clipperz.PM.DataModel.DirectLogin.prototype = MochiKit.Base.update(null, { | |||
487 | 495 | ||
488 | //console.log("formData.attributes", this.formData()['attributes']); | 496 | //console.log("formData.attributes", this.formData()['attributes']); |
489 | // if (/^javascript/.test(this.formData()['attributes']['action'])) { | 497 | // if (/^javascript/.test(this.formData()['attributes']['action'])) { |
490 | if ((/^(https?|webdav|ftp)\:/.test(this.formData()['attributes']['action']) == false) && | 498 | if ((/^(https?|webdav|ftp)\:/.test(this.action()) == false) && |
491 | (this.formData()['attributes']['type'] != 'http_auth')) | 499 | (this.formData()['attributes']['type'] != 'http_auth') |
492 | { | 500 | ) { |
493 | var messageBoxConfiguration; | 501 | var messageBoxConfiguration; |
494 | 502 | ||
495 | if (typeof(aNewWindow) != 'undefined') { | 503 | if (typeof(aNewWindow) != 'undefined') { |
diff --git a/frontend/beta/js/Clipperz/PM/DataModel/DirectLoginReference.js b/frontend/beta/js/Clipperz/PM/DataModel/DirectLoginReference.js index 236d7c9..ba302da 100644 --- a/frontend/beta/js/Clipperz/PM/DataModel/DirectLoginReference.js +++ b/frontend/beta/js/Clipperz/PM/DataModel/DirectLoginReference.js | |||
@@ -47,7 +47,7 @@ Clipperz.PM.DataModel.DirectLoginReference = function(args) { | |||
47 | this._reference = args.reference; | 47 | this._reference = args.reference; |
48 | this._recordReference = args.record; | 48 | this._recordReference = args.record; |
49 | this._label = args.label; | 49 | this._label = args.label; |
50 | this._favicon = args.favicon || null; | 50 | this._favicon = Clipperz.Base.sanitizeFavicon(args.favicon) || null; |
51 | 51 | ||
52 | this._directLogin = null; | 52 | this._directLogin = null; |
53 | this._record = null; | 53 | this._record = null; |
diff --git a/frontend/beta/js/Clipperz/PM/Proxy/Proxy.Offline.DataStore.js b/frontend/beta/js/Clipperz/PM/Proxy/Proxy.Offline.DataStore.js index 1a5caff..b0b9b63 100644 --- a/frontend/beta/js/Clipperz/PM/Proxy/Proxy.Offline.DataStore.js +++ b/frontend/beta/js/Clipperz/PM/Proxy/Proxy.Offline.DataStore.js | |||
@@ -37,6 +37,7 @@ Clipperz.PM.Proxy.Offline.DataStore = function(args) { | |||
37 | this._tolls = {}; | 37 | this._tolls = {}; |
38 | this._connections = {}; | 38 | this._connections = {}; |
39 | 39 | ||
40 | this._C = null; | ||
40 | this._b = null; | 41 | this._b = null; |
41 | this._B = null; | 42 | this._B = null; |
42 | this._A = null; | 43 | this._A = null; |
@@ -144,6 +145,16 @@ Clipperz.PM.Proxy.Offline.DataStore.prototype = MochiKit.Base.update(null, { | |||
144 | 145 | ||
145 | //========================================================================= | 146 | //========================================================================= |
146 | 147 | ||
148 | 'C': function() { | ||
149 | return this._C; | ||
150 | }, | ||
151 | |||
152 | 'set_C': function(aValue) { | ||
153 | this._C = aValue; | ||
154 | }, | ||
155 | |||
156 | //------------------------------------------------------------------------- | ||
157 | |||
147 | 'b': function() { | 158 | 'b': function() { |
148 | return this._b; | 159 | return this._b; |
149 | }, | 160 | }, |
@@ -236,8 +247,8 @@ Clipperz.PM.Proxy.Offline.DataStore.prototype = MochiKit.Base.update(null, { | |||
236 | }, | 247 | }, |
237 | 248 | ||
238 | //========================================================================= | 249 | //========================================================================= |
239 | 250 | ||
240 | 'processMessage': function(aFunctionName, someParameters) { | 251 | 'processMessage': function (aFunctionName, someParameters) { |
241 | var result; | 252 | var result; |
242 | 253 | ||
243 | switch(aFunctionName) { | 254 | switch(aFunctionName) { |
@@ -303,14 +314,14 @@ Clipperz.PM.Proxy.Offline.DataStore.prototype = MochiKit.Base.update(null, { | |||
303 | throw "user already exists"; | 314 | throw "user already exists"; |
304 | } | 315 | } |
305 | } else { | 316 | } else { |
306 | throw Clipperz.PM.Proxy.Offline.DataStore.exception.ReadOnly; | 317 | throw Clipperz.PM.Proxy.Offline.DataStore.exception.ReadOnly; |
307 | } | 318 | } |
308 | 319 | ||
309 | result = { | 320 | result = { |
310 | result: { | 321 | result: { |
311 | 'lock': this.data()['users'][someParameters['credentials']['C']]['lock'], | 322 | 'lock': this.data()['users'][someParameters['credentials']['C']]['lock'], |
312 | 'result':'done' | 323 | 'result':'done' |
313 | }, | 324 | }, |
314 | toll: this.getTollForRequestType('CONNECT') | 325 | toll: this.getTollForRequestType('CONNECT') |
315 | } | 326 | } |
316 | 327 | ||
@@ -340,9 +351,10 @@ Clipperz.PM.Proxy.Offline.DataStore.prototype = MochiKit.Base.update(null, { | |||
340 | } | 351 | } |
341 | 352 | ||
342 | randomBytes = Clipperz.Crypto.Base.generateRandomSeed(); | 353 | randomBytes = Clipperz.Crypto.Base.generateRandomSeed(); |
354 | this.set_C(someParameters.parameters.C); | ||
343 | this.set_b(new Clipperz.Crypto.BigInt(randomBytes, 16)); | 355 | this.set_b(new Clipperz.Crypto.BigInt(randomBytes, 16)); |
344 | v = new Clipperz.Crypto.BigInt(this.userData()['v'], 16); | 356 | v = new Clipperz.Crypto.BigInt(this.userData()['v'], 16); |
345 | this.set_B(v.add(Clipperz.Crypto.SRP.g().powerModule(this.b(), Clipperz.Crypto.SRP.n()))); | 357 | this.set_B((Clipperz.Crypto.SRP.k().multiply(v)).add(Clipperz.Crypto.SRP.g().powerModule(this.b(), Clipperz.Crypto.SRP.n()))); |
346 | 358 | ||
347 | this.set_A(someParameters.parameters.A); | 359 | this.set_A(someParameters.parameters.A); |
348 | 360 | ||
@@ -351,21 +363,36 @@ Clipperz.PM.Proxy.Offline.DataStore.prototype = MochiKit.Base.update(null, { | |||
351 | 363 | ||
352 | nextTollRequestType = 'CONNECT'; | 364 | nextTollRequestType = 'CONNECT'; |
353 | } else if (someParameters.message == "credentialCheck") { | 365 | } else if (someParameters.message == "credentialCheck") { |
354 | var v, u, S, A, K, M1; | 366 | var v, u, s, S, A, K, M1; |
367 | var stringHash = function (aValue) { | ||
368 | return Clipperz.PM.Crypto.encryptingFunctions.versions[someParameters.version].hash(new Clipperz.ByteArray(aValue)).toHexString().substring(2); | ||
369 | }; | ||
355 | 370 | ||
356 | //console.log(">>> Proxy.Offline.DataStore._handshake.credentialCheck", someParameters); | 371 | //console.log(">>> Proxy.Offline.DataStore._handshake.credentialCheck", someParameters); |
357 | v = new Clipperz.Crypto.BigInt(this.userData()['v'], 16); | 372 | v = new Clipperz.Crypto.BigInt(this.userData()['v'], 16); |
358 | u = new Clipperz.Crypto.BigInt(Clipperz.PM.Crypto.encryptingFunctions.versions[someParameters.version].hash(new Clipperz.ByteArray(this.B().asString(10))).toHexString(), 16); | ||
359 | A = new Clipperz.Crypto.BigInt(this.A(), 16); | 373 | A = new Clipperz.Crypto.BigInt(this.A(), 16); |
374 | u = new Clipperz.Crypto.BigInt(Clipperz.PM.Crypto.encryptingFunctions.versions[someParameters.version].hash(new Clipperz.ByteArray(A.asString(10) + this.B().asString(10))).toHexString(), 16); | ||
375 | s = new Clipperz.Crypto.BigInt(this.userData()['s'], 16); | ||
360 | S = (A.multiply(v.powerModule(u, Clipperz.Crypto.SRP.n()))).powerModule(this.b(), Clipperz.Crypto.SRP.n()); | 376 | S = (A.multiply(v.powerModule(u, Clipperz.Crypto.SRP.n()))).powerModule(this.b(), Clipperz.Crypto.SRP.n()); |
361 | 377 | ||
362 | K = Clipperz.PM.Crypto.encryptingFunctions.versions[someParameters.version].hash(new Clipperz.ByteArray(S.asString(10))).toHexString().slice(2); | 378 | K = stringHash(S.asString(10)); |
363 | 379 | ||
364 | M1 = Clipperz.PM.Crypto.encryptingFunctions.versions[someParameters.version].hash(new Clipperz.ByteArray(A.asString(10) + this.B().asString(10) + K)).toHexString().slice(2); | 380 | M1 = stringHash( |
381 | "597626870978286801440197562148588907434001483655788865609375806439877501869636875571920406529" + | ||
382 | stringHash(this.C()) + | ||
383 | s.asString(10) + | ||
384 | A.asString(10) + | ||
385 | this.B().asString(10) + | ||
386 | K | ||
387 | ); | ||
365 | if (someParameters.parameters.M1 == M1) { | 388 | if (someParameters.parameters.M1 == M1) { |
366 | var M2; | 389 | var M2; |
367 | 390 | ||
368 | M2 = Clipperz.PM.Crypto.encryptingFunctions.versions[someParameters.version].hash(new Clipperz.ByteArray(A.asString(10) + someParameters.parameters.M1 + K)).toHexString().slice(2); | 391 | M2 = stringHash( |
392 | A.asString(10) + | ||
393 | someParameters.parameters.M1 + | ||
394 | K | ||
395 | ); | ||
369 | result['M2'] = M2; | 396 | result['M2'] = M2; |
370 | } else { | 397 | } else { |
371 | throw new Error("Client checksum verification failed! Expected <" + M1 + ">, received <" + someParameters.parameters.M1 + ">.", "Error"); | 398 | throw new Error("Client checksum verification failed! Expected <" + M1 + ">, received <" + someParameters.parameters.M1 + ">.", "Error"); |