Skip to content
This repository was archived by the owner on Nov 14, 2018. It is now read-only.

Add new site target option to External Site options #2221

Closed
pirate wants to merge 9 commits into from
Closed

Add new site target option to External Site options #2221

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
9 commits
Select commit Hold shift + click to select a range
33157ed
add new site target option to external site
pirate Sep 9, 2017
9353202
cleanup array generation code
pirate Sep 9, 2017
69e9b67
remove comment
pirate Sep 9, 2017
77dfd89
fix targets_desc name
pirate Sep 9, 2017
5e461d4
save config arrays to variables
pirate Sep 9, 2017
36d1002
define targets locally instead of global
pirate Sep 9, 2017
fba2461
dont change delete code
pirate Sep 9, 2017
d5a4e56
unnecessary comments
pirate Sep 9, 2017
a558c2f
darn semicolons
pirate Sep 9, 2017
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
13 changes: 12 additions & 1 deletion external/ajax/setsites.php
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -11,10 +11,21 @@
OCP\User::checkAdminUser();
OCP\JSON::callCheck();

$valid_targets = array('_blank', '_top', '_self'); // TODO: import this from external/settings.php

$sites = array();
for ($i = 0; $i < sizeof($_POST['site_name']); $i++) {
if (!empty($_POST['site_name'][$i]) && !empty($_POST['site_url'][$i])) {
array_push($sites, array(strip_tags($_POST['site_name'][$i]), strip_tags($_POST['site_url'][$i]), strip_tags($_POST['site_icon'][$i])));
// make sure site_target is a safe link target type
if (!in_array($_POST['site_target'][$i], $valid_targets)) {
throw new Exception('Invalid site target, must be one of: ' . implode(", ", $valid_targets));
}
array_push($sites, array(
strip_tags($_POST['site_name'][$i]),
strip_tags($_POST['site_url'][$i]),
strip_tags($_POST['site_icon'][$i]),
strip_tags($_POST['site_target'][$i]),
));
Copy link

@peterprochaska peterprochaska Sep 12, 2017

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

I think strip_tags is not enough here. Because you always can inject " onLoad="javascript:alert('XSS')" <- which tags should strip_tags remove?
Use htmlspecialchars or similar for escaping.

}
}

Expand Down
21 changes: 16 additions & 5 deletions external/appinfo/app.php
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -31,12 +31,23 @@
$navigationManager = \OC::$server->getNavigationManager();
for ($i = 0; $i < sizeof($sites); $i++) {
$navigationEntry = function () use ($i, $urlGenerator, $sites) {
$site_id = ($i + 1);
$href = $sites[$i][1];
if ($target == '_self') {
// if link is iframed, change href to point to internal url /external/<site_id>
$href = $urlGenerator->linkToRoute('external_index', ['id'=> $site_id]);
}
$icon_name = empty($sites[$i][2]) ? 'external.svg' : $sites[$i][2];
$icon = $urlGenerator->imagePath('external', $icon_name);
$name = $sites[$i][0];
$target = $sites[$i][3];
return [
'id' => 'external_index' . ($i + 1),
'order' => 80 + $i,
'href' => $urlGenerator->linkToRoute('external_index', ['id'=> $i + 1]),
'icon' => $urlGenerator->imagePath('external', !empty($sites[$i][2]) ? $sites[$i][2] : 'external.svg'),
'name' => $sites[$i][0],
'id' => 'external_index' . $site_id,
'order' => 80 + $i,
'href' => $href,
'icon' => $icon,
'name' => $name,
'target' => $target,
];
};
$navigationManager->add($navigationEntry);
Expand Down
6 changes: 6 additions & 0 deletions external/settings.php
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -27,4 +27,10 @@

$tmpl->assign('images', $images);

$targets = array('_blank', '_top', '_self');
$targets_desc = array('New Window', 'Replace Current Window', 'Inside OwnCloud Frame');
$tmpl->assign('targets', $targets);
$tmpl->assign('targets_desc', $targets_desc);


return $tmpl->fetchPage();
8 changes: 8 additions & 0 deletions external/templates/settings.php
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -30,6 +30,14 @@
} else {
print_unescaped('<option value="">'.$l->t('Select an icon').'</option>');
}
print_unescaped('</select><select class="site_target" name="site_target[]">');
foreach($_['targets'] as $idx=>$target) {
if ($target == $sites[$i][3]) {
print_unescaped('<option value="'.$target.'" selected>'.$_['targets_desc'][$idx].'</option>');
} else {
print_unescaped('<option value="'.$target.'">'.$_['targets_desc'][$idx].'</option>');
}
}
print_unescaped('</select>
<img class="svg action delete_button" src="'.OCP\image_path("", "actions/delete.svg") .'" title="'.$l->t("Remove site").'" />
</li>');
Expand Down