From f19efdb859a2305f7012f9ce80eb9e5cabb446dc Mon Sep 17 00:00:00 2001 From: Calvin Montgomery Date: Sat, 18 Aug 2018 13:14:37 -0700 Subject: [PATCH] Fix #762 --- package.json | 2 +- www/js/callbacks.js | 34 +++++++++++++++++++++------------- www/js/util.js | 19 +++++++++++-------- 3 files changed, 33 insertions(+), 22 deletions(-) diff --git a/package.json b/package.json index 6c5ed614..b0d73b02 100644 --- a/package.json +++ b/package.json @@ -2,7 +2,7 @@ "author": "Calvin Montgomery", "name": "CyTube", "description": "Online media synchronizer and chat", - "version": "3.57.0", + "version": "3.57.1", "repository": { "url": "http://github.com/calzoneman/sync" }, diff --git a/www/js/callbacks.js b/www/js/callbacks.js index 1d7b3b10..28fb7c9f 100644 --- a/www/js/callbacks.js +++ b/www/js/callbacks.js @@ -266,7 +266,14 @@ Callbacks = { if(opts.externaljs.trim() != "" && !USEROPTS.ignore_channeljs && opts.externaljs !== CHANNEL.opts.externaljs) { - checkScriptAccess(opts.externaljs, "external", function (pref) { + var viewSource = document.createElement("a"); + viewSource.className = "btn btn-danger"; + viewSource.setAttribute("role", "button"); + viewSource.setAttribute("target", "_blank"); + viewSource.setAttribute("rel", "noopener noreferer"); + viewSource.textContent = "View external script source"; + viewSource.href = opts.externaljs; + checkScriptAccess(viewSource, "external", function (pref) { if (pref === "ALLOW") { $.getScript(opts.externaljs); } @@ -304,19 +311,20 @@ Callbacks = { $("#cs-jstext").val(data.js); if(data.js && !USEROPTS.ignore_channeljs) { - var src = data.js - .replace(/&/g, "&") - .replace(//g, ">") - .replace(/\n/g, "
") - .replace(/\t/g, " ") - .replace(/ /g, " "); - src = encodeURIComponent(src); + var viewSource = document.createElement("button"); + viewSource.className = "btn btn-danger"; + viewSource.textContent = "View inline script source"; + viewSource.onclick = function () { + var content = document.createElement("pre"); + content.textContent = data.js; + modalAlert({ + title: "Inline JS", + htmlContent: content.outerHTML, + dismissText: "Close" + }); + }; - var viewsource = "data:text/html, " + - src + ""; - checkScriptAccess(viewsource, "embedded", function (pref) { + checkScriptAccess(viewSource, "embedded", function (pref) { if (pref === "ALLOW") { $("