5 files changed, 52 insertions, 17 deletions
diff --git a/frontend/beta/js/Clipperz/PM/BookmarkletProcessor.js b/frontend/beta/js/Clipperz/PM/BookmarkletProcessor.js index 2295d3f..369b9ce 100644 --- a/frontend/beta/js/Clipperz/PM/BookmarkletProcessor.js +++ b/frontend/beta/js/Clipperz/PM/BookmarkletProcessor.js | |||
@@ -139,5 +139,5 @@ Clipperz.PM.BookmarkletProcessor.prototype = MochiKit.Base.update(null, { | |||
139 | var actionUrl; | 139 | var actionUrl; |
140 | 140 | ||
141 | actionUrl = this.configuration()['form']['attributes']['action']; | 141 | actionUrl = Clipperz.Base.sanitizeUrl(this.configuration()['form']['attributes']['action']); |
142 | //MochiKit.Logging.logDebug("+++ actionUrl: " + actionUrl); | 142 | //MochiKit.Logging.logDebug("+++ actionUrl: " + actionUrl); |
143 | this._hostname = actionUrl.replace(/^https?:\/\/([^\/]*)\/.*/, '$1'); | 143 | this._hostname = actionUrl.replace(/^https?:\/\/([^\/]*)\/.*/, '$1'); |
diff --git a/frontend/beta/js/Clipperz/PM/Components/RecordDetail/DirectLoginBindingComponent.js b/frontend/beta/js/Clipperz/PM/Components/RecordDetail/DirectLoginBindingComponent.js index 0e4640e..a5a4697 100644 --- a/frontend/beta/js/Clipperz/PM/Components/RecordDetail/DirectLoginBindingComponent.js +++ b/frontend/beta/js/Clipperz/PM/Components/RecordDetail/DirectLoginBindingComponent.js | |||
@@ -101,5 +101,5 @@ YAHOO.extendX(Clipperz.PM.Components.RecordDetail.DirectLoginBindingComponent, C | |||
101 | for (recordFieldKey in recordFields) { | 101 | for (recordFieldKey in recordFields) { |
102 | //TODO: remove the value: field and replace it with element.dom.value = <some value> | 102 | //TODO: remove the value: field and replace it with element.dom.value = <some value> |
103 | option = {tag:'option', value:recordFieldKey, html:recordFields[recordFieldKey].label()} | 103 | option = {tag:'option', value:recordFieldKey, html:Clipperz.Base.sanitizeString(recordFields[recordFieldKey].label())} |
104 | if (recordFieldKey == this.directLoginBinding().fieldKey()) { | 104 | if (recordFieldKey == this.directLoginBinding().fieldKey()) { |
105 | option['selected'] = true; | 105 | option['selected'] = true; |
@@ -151,5 +151,5 @@ YAHOO.extendX(Clipperz.PM.Components.RecordDetail.DirectLoginBindingComponent, C | |||
151 | this.getElement('viewModeBox').show(); | 151 | this.getElement('viewModeBox').show(); |
152 | 152 | ||
153 | this.getElement('viewValue').update(this.directLoginBinding().field().label()); | 153 | this.getElement('viewValue').update(Clipperz.Base.sanitizeString(this.directLoginBinding().field().label())); |
154 | //MochiKit.Logging.logDebug("<<< DirectLoginBindingComponent.updateViewMode"); | 154 | //MochiKit.Logging.logDebug("<<< DirectLoginBindingComponent.updateViewMode"); |
155 | }, | 155 | }, |
diff --git a/frontend/beta/js/Clipperz/PM/DataModel/DirectLogin.js b/frontend/beta/js/Clipperz/PM/DataModel/DirectLogin.js index c0cfa3c..56d9d59 100644 --- a/frontend/beta/js/Clipperz/PM/DataModel/DirectLogin.js +++ b/frontend/beta/js/Clipperz/PM/DataModel/DirectLogin.js | |||
@@ -39,5 +39,5 @@ Clipperz.PM.DataModel.DirectLogin = function(args) { | |||
39 | this._label = args.label || "unnamed record" | 39 | this._label = args.label || "unnamed record" |
40 | this._reference = args.reference || Clipperz.PM.Crypto.randomKey(); | 40 | this._reference = args.reference || Clipperz.PM.Crypto.randomKey(); |
41 | this._favicon = args.favicon || null; | 41 | this._favicon = Clipperz.Base.sanitizeFavicon(args.favicon) || null; |
42 | this._bookmarkletVersion = args.bookmarkletVersion || "0.1"; | 42 | this._bookmarkletVersion = args.bookmarkletVersion || "0.1"; |
43 | 43 | ||
@@ -103,7 +103,7 @@ Clipperz.PM.DataModel.DirectLogin.prototype = MochiKit.Base.update(null, { | |||
103 | var hostname; | 103 | var hostname; |
104 | 104 | ||
105 | actionUrl = this.formData()['attributes']['action']; | 105 | actionUrl = this.action(); |
106 | hostname = actionUrl.replace(/^https?:\/\/([^\/]*)\/.*/, '$1'); | 106 | hostname = actionUrl.replace(/^https?:\/\/([^\/]*)\/.*/, '$1'); |
107 | this._favicon = "http://" + hostname + "/favicon.ico"; | 107 | this._favicon = Clipperz.Base.sanitizeFavicon("http://" + hostname + "/favicon.ico"); |
108 | } | 108 | } |
109 | 109 | ||
@@ -138,4 +138,12 @@ Clipperz.PM.DataModel.DirectLogin.prototype = MochiKit.Base.update(null, { | |||
138 | }, | 138 | }, |
139 | 139 | ||
140 | 'action': function () { | ||
141 | varresult; | ||
142 | |||
143 | result = Clipperz.Base.sanitizeUrl(this.formData()['attributes']['action']); | ||
144 | |||
145 | return result; | ||
146 | }, | ||
147 | |||
140 | //------------------------------------------------------------------------- | 148 | //------------------------------------------------------------------------- |
141 | 149 | ||
@@ -443,5 +451,5 @@ Clipperz.PM.DataModel.DirectLogin.prototype = MochiKit.Base.update(null, { | |||
443 | //console.log(this.formData()['attributes']); | 451 | //console.log(this.formData()['attributes']); |
444 | formElement = MochiKit.DOM.FORM(MochiKit.Base.update({id:'directLoginForm'}, {'method':this.formData()['attributes']['method'], | 452 | formElement = MochiKit.DOM.FORM(MochiKit.Base.update({id:'directLoginForm'}, {'method':this.formData()['attributes']['method'], |
445 | 'action':this.formData()['attributes']['action']})); | 453 | 'action': this.action()})); |
446 | //MochiKit.Logging.logDebug("### runDirectLogin - 5"); | 454 | //MochiKit.Logging.logDebug("### runDirectLogin - 5"); |
447 | formSubmitFunction = MochiKit.Base.method(formElement, 'submit'); | 455 | formSubmitFunction = MochiKit.Base.method(formElement, 'submit'); |
@@ -488,7 +496,7 @@ Clipperz.PM.DataModel.DirectLogin.prototype = MochiKit.Base.update(null, { | |||
488 | //console.log("formData.attributes", this.formData()['attributes']); | 496 | //console.log("formData.attributes", this.formData()['attributes']); |
489 | // if (/^javascript/.test(this.formData()['attributes']['action'])) { | 497 | // if (/^javascript/.test(this.formData()['attributes']['action'])) { |
490 | if ((/^(https?|webdav|ftp)\:/.test(this.formData()['attributes']['action']) == false) && | 498 | if ((/^(https?|webdav|ftp)\:/.test(this.action()) == false) && |
491 | (this.formData()['attributes']['type'] != 'http_auth')) | 499 | (this.formData()['attributes']['type'] != 'http_auth') |
492 | { | 500 | ) { |
493 | var messageBoxConfiguration; | 501 | var messageBoxConfiguration; |
494 | 502 | ||
diff --git a/frontend/beta/js/Clipperz/PM/DataModel/DirectLoginReference.js b/frontend/beta/js/Clipperz/PM/DataModel/DirectLoginReference.js index 236d7c9..ba302da 100644 --- a/frontend/beta/js/Clipperz/PM/DataModel/DirectLoginReference.js +++ b/frontend/beta/js/Clipperz/PM/DataModel/DirectLoginReference.js | |||
@@ -48,5 +48,5 @@ Clipperz.PM.DataModel.DirectLoginReference = function(args) { | |||
48 | this._recordReference = args.record; | 48 | this._recordReference = args.record; |
49 | this._label = args.label; | 49 | this._label = args.label; |
50 | this._favicon = args.favicon || null; | 50 | this._favicon = Clipperz.Base.sanitizeFavicon(args.favicon) || null; |
51 | 51 | ||
52 | this._directLogin = null; | 52 | this._directLogin = null; |
diff --git a/frontend/beta/js/Clipperz/PM/Proxy/Proxy.Offline.DataStore.js b/frontend/beta/js/Clipperz/PM/Proxy/Proxy.Offline.DataStore.js index 1a5caff..b0b9b63 100644 --- a/frontend/beta/js/Clipperz/PM/Proxy/Proxy.Offline.DataStore.js +++ b/frontend/beta/js/Clipperz/PM/Proxy/Proxy.Offline.DataStore.js | |||
@@ -38,4 +38,5 @@ Clipperz.PM.Proxy.Offline.DataStore = function(args) { | |||
38 | this._connections = {}; | 38 | this._connections = {}; |
39 | 39 | ||
40 | this._C = null; | ||
40 | this._b = null; | 41 | this._b = null; |
41 | this._B = null; | 42 | this._B = null; |
@@ -145,4 +146,14 @@ Clipperz.PM.Proxy.Offline.DataStore.prototype = MochiKit.Base.update(null, { | |||
145 | //========================================================================= | 146 | //========================================================================= |
146 | 147 | ||
148 | 'C': function() { | ||
149 | return this._C; | ||
150 | }, | ||
151 | |||
152 | 'set_C': function(aValue) { | ||
153 | this._C = aValue; | ||
154 | }, | ||
155 | |||
156 | //------------------------------------------------------------------------- | ||
157 | |||
147 | 'b': function() { | 158 | 'b': function() { |
148 | return this._b; | 159 | return this._b; |
@@ -341,7 +352,8 @@ Clipperz.PM.Proxy.Offline.DataStore.prototype = MochiKit.Base.update(null, { | |||
341 | 352 | ||
342 | randomBytes = Clipperz.Crypto.Base.generateRandomSeed(); | 353 | randomBytes = Clipperz.Crypto.Base.generateRandomSeed(); |
354 | this.set_C(someParameters.parameters.C); | ||
343 | this.set_b(new Clipperz.Crypto.BigInt(randomBytes, 16)); | 355 | this.set_b(new Clipperz.Crypto.BigInt(randomBytes, 16)); |
344 | v = new Clipperz.Crypto.BigInt(this.userData()['v'], 16); | 356 | v = new Clipperz.Crypto.BigInt(this.userData()['v'], 16); |
345 | this.set_B(v.add(Clipperz.Crypto.SRP.g().powerModule(this.b(), Clipperz.Crypto.SRP.n()))); | 357 | this.set_B((Clipperz.Crypto.SRP.k().multiply(v)).add(Clipperz.Crypto.SRP.g().powerModule(this.b(), Clipperz.Crypto.SRP.n()))); |
346 | 358 | ||
347 | this.set_A(someParameters.parameters.A); | 359 | this.set_A(someParameters.parameters.A); |
@@ -352,19 +364,34 @@ Clipperz.PM.Proxy.Offline.DataStore.prototype = MochiKit.Base.update(null, { | |||
352 | nextTollRequestType = 'CONNECT'; | 364 | nextTollRequestType = 'CONNECT'; |
353 | } else if (someParameters.message == "credentialCheck") { | 365 | } else if (someParameters.message == "credentialCheck") { |
354 | var v, u, S, A, K, M1; | 366 | var v, u, s, S, A, K, M1; |
367 | var stringHash = function (aValue) { | ||
368 | return Clipperz.PM.Crypto.encryptingFunctions.versions[someParameters.version].hash(new Clipperz.ByteArray(aValue)).toHexString().substring(2); | ||
369 | }; | ||
355 | 370 | ||
356 | //console.log(">>> Proxy.Offline.DataStore._handshake.credentialCheck", someParameters); | 371 | //console.log(">>> Proxy.Offline.DataStore._handshake.credentialCheck", someParameters); |
357 | v = new Clipperz.Crypto.BigInt(this.userData()['v'], 16); | 372 | v = new Clipperz.Crypto.BigInt(this.userData()['v'], 16); |
358 | u = new Clipperz.Crypto.BigInt(Clipperz.PM.Crypto.encryptingFunctions.versions[someParameters.version].hash(new Clipperz.ByteArray(this.B().asString(10))).toHexString(), 16); | ||
359 | A = new Clipperz.Crypto.BigInt(this.A(), 16); | 373 | A = new Clipperz.Crypto.BigInt(this.A(), 16); |
374 | u = new Clipperz.Crypto.BigInt(Clipperz.PM.Crypto.encryptingFunctions.versions[someParameters.version].hash(new Clipperz.ByteArray(A.asString(10) + this.B().asString(10))).toHexString(), 16); | ||
375 | s = new Clipperz.Crypto.BigInt(this.userData()['s'], 16); | ||
360 | S = (A.multiply(v.powerModule(u, Clipperz.Crypto.SRP.n()))).powerModule(this.b(), Clipperz.Crypto.SRP.n()); | 376 | S = (A.multiply(v.powerModule(u, Clipperz.Crypto.SRP.n()))).powerModule(this.b(), Clipperz.Crypto.SRP.n()); |
361 | 377 | ||
362 | K = Clipperz.PM.Crypto.encryptingFunctions.versions[someParameters.version].hash(new Clipperz.ByteArray(S.asString(10))).toHexString().slice(2); | 378 | K = stringHash(S.asString(10)); |
363 | 379 | ||
364 | M1 = Clipperz.PM.Crypto.encryptingFunctions.versions[someParameters.version].hash(new Clipperz.ByteArray(A.asString(10) + this.B().asString(10) + K)).toHexString().slice(2); | 380 | M1 = stringHash( |
381 | "597626870978286801440197562148588907434001483655788865609375806439877501869636875571920406529" + | ||
382 | stringHash(this.C()) + | ||
383 | s.asString(10) + | ||
384 | A.asString(10) + | ||
385 | this.B().asString(10) + | ||
386 | K | ||
387 | ); | ||
365 | if (someParameters.parameters.M1 == M1) { | 388 | if (someParameters.parameters.M1 == M1) { |
366 | var M2; | 389 | var M2; |
367 | 390 | ||
368 | M2 = Clipperz.PM.Crypto.encryptingFunctions.versions[someParameters.version].hash(new Clipperz.ByteArray(A.asString(10) + someParameters.parameters.M1 + K)).toHexString().slice(2); | 391 | M2 = stringHash( |
392 | A.asString(10) + | ||
393 | someParameters.parameters.M1 + | ||
394 | K | ||
395 | ); | ||
369 | result['M2'] = M2; | 396 | result['M2'] = M2; |
370 | } else { | 397 | } else { |