@cryptotaxi247 / MeshCentral / commits / 05b93303

MeshMessenger Fixes.

Ylian Saint-Hilaire committed Jun 21, 2020 at 13:41 UTC 05b93303f5f2dc02b9abb79b40efa050b2a12253
12 files changed +130 -28
public/novnc/app/ui.js
+23 -1
@@ -17,7 +17,29 @@ import Keyboard from "../core/input/keyboard.js";
17 import RFB from "../core/rfb.js";
18 import * as WebUtil from "./webutil.js";
19
20 -function parseUriArgs() { var href = window.document.location.href; if (href.endsWith('#')) { href = href.substring(0, href.length - 1); } var name, r = {}, parsedUri = href.split(/[\?&|\=]/); parsedUri.splice(0, 1); for (x in parsedUri) { switch (x % 2) { case 0: { name = decodeURIComponent(parsedUri[x]); break; } case 1: { r[name] = decodeURIComponent(parsedUri[x]); var x = parseInt(r[name]); if (x == r[name]) { r[name] = x; } break; } default: { break; } } } return r; }
20 +// String validation
21 +function isAlphaNumeric(str) { return (str.match(/^[A-Za-z0-9]+$/) != null); };
22 +function isSafeString(str) { return ((typeof str == 'string') && (str.indexOf('<') == -1) && (str.indexOf('>') == -1) && (str.indexOf('&') == -1) && (str.indexOf('"') == -1) && (str.indexOf('\'') == -1) && (str.indexOf('+') == -1) && (str.indexOf('(') == -1) && (str.indexOf(')') == -1) && (str.indexOf('#') == -1) && (str.indexOf('%') == -1) && (str.indexOf(':') == -1) && (str.indexOf('-') == -1)) };
23 +
24 +// Parse URL arguments, only keep safe values
25 +function parseUriArgs() {
26 + var href = window.document.location.href;
27 + if (href.endsWith('#')) { href = href.substring(0, href.length - 1); }
28 + var name, r = {}, parsedUri = href.split(/[\?&|\=]/);
29 + parsedUri.splice(0, 1);
30 + for (x in parsedUri) {
31 + switch (x % 2) {
32 + case 0: { name = decodeURIComponent(parsedUri[x]); break; }
33 + case 1: {
34 + r[name] = decodeURIComponent(parsedUri[x]);
35 + if (!isSafeString(r[name])) { delete r[name]; } else { var x = parseInt(r[name]); if (x == r[name]) { r[name] = x; } }
36 + break;
37 + } default: { break; }
38 + }
39 + }
40 + return r;
41 +}
42 +
43 var urlargs = parseUriArgs();
44
45 const UI = {
public/scripts/common-0.0.1-min.js
+1 -1
@@ -1 +1 @@
1 -function Q(t){return document.getElementById(t)}function QS(t){try{return Q(t).style}catch(t){}}function QE(t,r){try{Q(t).disabled=!r}catch(t){}}function QV(t,r){try{QS(t).display=r?"":"none"}catch(t){}}function QA(t,r){Q(t).innerHTML+=r}function QH(t,r){Q(t).innerHTML=r}function QC(t){try{return Q(t).classList}catch(t){}}function inputBoxFocus(t){Q(t).focus();var r=Q(t).value;Q(t).value="",Q(t).value=r}function ReadShort(t,r){return(t.charCodeAt(r)<<8)+t.charCodeAt(r+1)}function ReadShortX(t,r){return(t.charCodeAt(r+1)<<8)+t.charCodeAt(r)}function ReadInt(t,r){return 16777216*t.charCodeAt(r)+(t.charCodeAt(r+1)<<16)+(t.charCodeAt(r+2)<<8)+t.charCodeAt(r+3)}function ReadSInt(t,r){return(t.charCodeAt(r)<<24)+(t.charCodeAt(r+1)<<16)+(t.charCodeAt(r+2)<<8)+t.charCodeAt(r+3)}function ReadIntX(t,r){return 16777216*t.charCodeAt(r+3)+(t.charCodeAt(r+2)<<16)+(t.charCodeAt(r+1)<<8)+t.charCodeAt(r)}function ShortToStr(t){return String.fromCharCode(t>>8&255,255&t)}function ShortToStrX(t){return String.fromCharCode(255&t,t>>8&255)}function IntToStr(t){return String.fromCharCode(t>>24&255,t>>16&255,t>>8&255,255&t)}function IntToStrX(t){return String.fromCharCode(255&t,t>>8&255,t>>16&255,t>>24&255)}function MakeToArray(t){return t&&null!=t&&"object"!=typeof t?[t]:t}function SplitArray(t){return t.split(",")}function Clone(t){return JSON.parse(JSON.stringify(t))}function EscapeHtml(t){return"string"==typeof t?t.replace(/&/g,"&amp;").replace(/>/g,"&gt;").replace(/</g,"&lt;").replace(/"/g,"&quot;").replace(/'/g,"&apos;"):"boolean"==typeof t?t:"number"==typeof t?t:void 0}function EscapeHtmlBreaks(t){return"string"==typeof t?t.replace(/&/g,"&amp;").replace(/>/g,"&gt;").replace(/</g,"&lt;").replace(/"/g,"&quot;").replace(/'/g,"&apos;").replace(/\r/g,"<br />").replace(/\n/g,"").replace(/\t/g,"&nbsp;&nbsp;"):"boolean"==typeof t?t:"number"==typeof t?t:void 0}function ArrayElementMove(t,r,n){t.splice(n,0,t.splice(r,1)[0])}function ObjectToStringEx(t,r){var n="";if(0!=t&&(!t||null==t))return"(Null)";if(t instanceof Array)for(var e in t)n+="<br />"+gap(r)+"Item #"+e+": "+ObjectToStringEx(t[e],r+1);else if(t instanceof Object)for(var e in t)n+="<br />"+gap(r)+e+" = "+ObjectToStringEx(t[e],r+1);else n+=EscapeHtml(t);return n}function ObjectToStringEx2(t,r){var n="";if(0!=t&&(!t||null==t))return"(Null)";if(t instanceof Array)for(var e in t)n+="\r\n"+gap2(r)+"Item #"+e+": "+ObjectToStringEx2(t[e],r+1);else if(t instanceof Object)for(var e in t)n+="\r\n"+gap2(r)+e+" = "+ObjectToStringEx2(t[e],r+1);else n+=EscapeHtml(t);return n}function gap(t){for(var r="",n=0;n<4*t;n++)r+="&nbsp;";return r}function gap2(t){for(var r="",n=0;n<4*t;n++)r+=" ";return r}function ObjectToString(t){return ObjectToStringEx(t,0)}function ObjectToString2(t){return ObjectToStringEx2(t,0)}function hex2rstr(t){if("string"!=typeof t||0==t.length)return"";for(var r,n="",e=(""+t).match(/../g);r=e.shift();)n+=String.fromCharCode("0x"+r);return n}function char2hex(t){return(t+256).toString(16).substr(-2).toUpperCase()}function rstr2hex(t){var r,n="";for(r=0;r<t.length;r++)n+=char2hex(t.charCodeAt(r));return n}function encode_utf8(t){return unescape(encodeURIComponent(t))}function decode_utf8(t){return decodeURIComponent(escape(t))}function data2blob(t){for(var r=new Array(t.length),n=0;n<t.length;n++)r[n]=t.charCodeAt(n);return new Blob([new Uint8Array(r)])}function utf2blob(t){for(var r=[],n=unescape(encodeURIComponent(t)),e=0;e<n.length;e++)r.push(n.charCodeAt(e));return new Blob([new Uint8Array(r)])}function random(t){return Math.floor(Math.random()*t)}function trademarks(t){return t.replace(/\(R\)/g,"&reg;").replace(/\(TM\)/g,"&trade;")}function zeroPad(t,r){null==r&&(r=2);var n="00000000"+t;return n.substr(n.length-r)}String.prototype.startsWith||(String.prototype.startsWith=function(t){return 0===this.lastIndexOf(t,0)}),String.prototype.endsWith||(String.prototype.endsWith=function(t){return-1!==this.indexOf(t,this.length-t.length)})
\ No newline at end of file
1 +function Q(t){return document.getElementById(t)}function QS(t){try{return Q(t).style}catch(t){}}function QE(t,n){try{Q(t).disabled=!n}catch(t){}}function QV(t,n){try{QS(t).display=n?"":"none"}catch(t){}}function QA(t,n){Q(t).innerHTML+=n}function QH(t,n){Q(t).innerHTML=n}function QC(t){try{return Q(t).classList}catch(t){}}function inputBoxFocus(t){Q(t).focus();var n=Q(t).value;Q(t).value="",Q(t).value=n}function ReadShort(t,n){return(t.charCodeAt(n)<<8)+t.charCodeAt(n+1)}function ReadShortX(t,n){return(t.charCodeAt(n+1)<<8)+t.charCodeAt(n)}function ReadInt(t,n){return 16777216*t.charCodeAt(n)+(t.charCodeAt(n+1)<<16)+(t.charCodeAt(n+2)<<8)+t.charCodeAt(n+3)}function ReadSInt(t,n){return(t.charCodeAt(n)<<24)+(t.charCodeAt(n+1)<<16)+(t.charCodeAt(n+2)<<8)+t.charCodeAt(n+3)}function ReadIntX(t,n){return 16777216*t.charCodeAt(n+3)+(t.charCodeAt(n+2)<<16)+(t.charCodeAt(n+1)<<8)+t.charCodeAt(n)}function ShortToStr(t){return String.fromCharCode(t>>8&255,255&t)}function ShortToStrX(t){return String.fromCharCode(255&t,t>>8&255)}function IntToStr(t){return String.fromCharCode(t>>24&255,t>>16&255,t>>8&255,255&t)}function IntToStrX(t){return String.fromCharCode(255&t,t>>8&255,t>>16&255,t>>24&255)}function MakeToArray(t){return t&&null!=t&&"object"!=typeof t?[t]:t}function SplitArray(t){return t.split(",")}function Clone(t){return JSON.parse(JSON.stringify(t))}function EscapeHtml(t){return"string"==typeof t?t.replace(/&/g,"&amp;").replace(/>/g,"&gt;").replace(/</g,"&lt;").replace(/"/g,"&quot;").replace(/'/g,"&apos;"):"boolean"==typeof t?t:"number"==typeof t?t:void 0}function EscapeHtmlBreaks(t){return"string"==typeof t?t.replace(/&/g,"&amp;").replace(/>/g,"&gt;").replace(/</g,"&lt;").replace(/"/g,"&quot;").replace(/'/g,"&apos;").replace(/\r/g,"<br />").replace(/\n/g,"").replace(/\t/g,"&nbsp;&nbsp;"):"boolean"==typeof t?t:"number"==typeof t?t:void 0}function ArrayElementMove(t,n,r){t.splice(r,0,t.splice(n,1)[0])}function ObjectToStringEx(t,n){var r="";if(0!=t&&(!t||null==t))return"(Null)";if(t instanceof Array)for(var e in t)r+="<br />"+gap(n)+"Item #"+e+": "+ObjectToStringEx(t[e],n+1);else if(t instanceof Object)for(var e in t)r+="<br />"+gap(n)+e+" = "+ObjectToStringEx(t[e],n+1);else r+=EscapeHtml(t);return r}function ObjectToStringEx2(t,n){var r="";if(0!=t&&(!t||null==t))return"(Null)";if(t instanceof Array)for(var e in t)r+="\r\n"+gap2(n)+"Item #"+e+": "+ObjectToStringEx2(t[e],n+1);else if(t instanceof Object)for(var e in t)r+="\r\n"+gap2(n)+e+" = "+ObjectToStringEx2(t[e],n+1);else r+=EscapeHtml(t);return r}function gap(t){for(var n="",r=0;r<4*t;r++)n+="&nbsp;";return n}function gap2(t){for(var n="",r=0;r<4*t;r++)n+=" ";return n}function ObjectToString(t){return ObjectToStringEx(t,0)}function ObjectToString2(t){return ObjectToStringEx2(t,0)}function hex2rstr(t){if("string"!=typeof t||0==t.length)return"";for(var n,r="",e=(""+t).match(/../g);n=e.shift();)r+=String.fromCharCode("0x"+n);return r}function char2hex(t){return(t+256).toString(16).substr(-2).toUpperCase()}function rstr2hex(t){var n,r="";for(n=0;n<t.length;n++)r+=char2hex(t.charCodeAt(n));return r}function encode_utf8(t){return unescape(encodeURIComponent(t))}function decode_utf8(t){return decodeURIComponent(escape(t))}function data2blob(t){for(var n=new Array(t.length),r=0;r<t.length;r++)n[r]=t.charCodeAt(r);return new Blob([new Uint8Array(n)])}function utf2blob(t){for(var n=[],r=unescape(encodeURIComponent(t)),e=0;e<r.length;e++)n.push(r.charCodeAt(e));return new Blob([new Uint8Array(n)])}function random(t){return Math.floor(Math.random()*t)}function trademarks(t){return t.replace(/\(R\)/g,"&reg;").replace(/\(TM\)/g,"&trade;")}function zeroPad(t,n){null==n&&(n=2);var r="00000000"+t;return r.substr(r.length-n)}function isAlphaNumeric(t){return null!=t.match(/^[A-Za-z0-9]+$/)}function isSafeString(t){return"string"==typeof t&&-1==t.indexOf("<")&&-1==t.indexOf(">")&&-1==t.indexOf("&")&&-1==t.indexOf('"')&&-1==t.indexOf("'")&&-1==t.indexOf("+")&&-1==t.indexOf("(")&&-1==t.indexOf(")")&&-1==t.indexOf("#")&&-1==t.indexOf("%")&&-1==t.indexOf(":")&&-1==t.indexOf("-")}function parseUriArgs(){var t=window.document.location.href;t.endsWith("#")&&(t=t.substring(0,t.length-1));var n,r={},e=t.split(/[\?&|\=]/);for(o in e.splice(0,1),e)switch(o%2){case 0:n=decodeURIComponent(e[o]);break;case 1:if(r[n]=decodeURIComponent(e[o]),isSafeString(r[n])){var o=parseInt(r[n]);o==r[n]&&(r[n]=o)}else delete r[n]}return r}String.prototype.startsWith||(String.prototype.startsWith=function(t){return 0===this.lastIndexOf(t,0)}),String.prototype.endsWith||(String.prototype.endsWith=function(t){return-1!==this.indexOf(t,this.length-t.length)})
\ No newline at end of file
public/scripts/common-0.0.1.js
+21 -1
@@ -110,4 +110,24 @@ function trademarks(x) { return x.replace(/\(R\)/g, '&reg;').replace(/\(TM\)/g,
110 function zeroPad(num, c) { if (c == null) { c = 2; } var s = "00000000" + num; return s.substr(s.length - c); }
111
112 // String validation
113 -function isAlphaNumeric(str) { return (str.match(/^[A-Za-z0-9]+$/) != null); };
\ No newline at end of file
113 +function isAlphaNumeric(str) { return (str.match(/^[A-Za-z0-9]+$/) != null); };
114 +function isSafeString(str) { return ((typeof str == 'string') && (str.indexOf('<') == -1) && (str.indexOf('>') == -1) && (str.indexOf('&') == -1) && (str.indexOf('"') == -1) && (str.indexOf('\'') == -1) && (str.indexOf('+') == -1) && (str.indexOf('(') == -1) && (str.indexOf(')') == -1) && (str.indexOf('#') == -1) && (str.indexOf('%') == -1) && (str.indexOf(':') == -1) && (str.indexOf('-') == -1)) };
115 +
116 +// Parse URL arguments, only keep safe values
117 +function parseUriArgs() {
118 + var href = window.document.location.href;
119 + if (href.endsWith('#')) { href = href.substring(0, href.length - 1); }
120 + var name, r = {}, parsedUri = href.split(/[\?&|\=]/);
121 + parsedUri.splice(0, 1);
122 + for (x in parsedUri) {
123 + switch (x % 2) {
124 + case 0: { name = decodeURIComponent(parsedUri[x]); break; }
125 + case 1: {
126 + r[name] = decodeURIComponent(parsedUri[x]);
127 + if (!isSafeString(r[name])) { delete r[name]; } else { var x = parseInt(r[name]); if (x == r[name]) { r[name] = x; } }
128 + break;
129 + } default: { break; }
130 + }
131 + }
132 + return r;
133 +}
\ No newline at end of file
translate/translate.json
+32 -7
@@ -1120,6 +1120,12 @@
1120 "default.handlebars->container->dialog->dialogBody->dialog7->d7meshkvm->5->d7bitmapscaling->13"
1121 ]
1122 },
1123 + {
1124 + "en": "256 colors",
1125 + "xloc": [
1126 + "player.handlebars->3->18"
1127 + ]
1128 + },
1129 {
1130 "cs": "2-faktorové ověřování zapnuto",
1131 "de": "Zweifaktorauthentifizierung eingeschaltet",
@@ -1472,6 +1478,12 @@
1478 "default.handlebars->27->359"
1479 ]
1480 },
1481 + {
1482 + "en": "65536 colors",
1483 + "xloc": [
1484 + "player.handlebars->3->20"
1485 + ]
1486 + },
1487 {
1488 "cs": "Stav přihlášení za 7 dnů",
1489 "de": "7-Tage-Anmelde-Status",
@@ -5828,6 +5840,13 @@
5840 "default.handlebars->27->741"
5841 ]
5842 },
5843 + {
5844 + "en": "Color Quality",
5845 + "xloc": [
5846 + "player.handlebars->3->17",
5847 + "player.handlebars->3->19"
5848 + ]
5849 + },
5850 {
5851 "cs": "Sloupce",
5852 "de": "Spalten",
@@ -9286,7 +9305,7 @@
9305 "ru": "Перетащите .mcrec файл или нажмите \\\"Открыть файл ... \\\"",
9306 "zh-chs": "拖放.mcrec文件或單擊 “打開文件...”",
9307 "xloc": [
9289 - "player.handlebars->3->20"
9308 + "player.handlebars->3->25"
9309 ]
9310 },
9311 {
@@ -12831,7 +12850,7 @@
12850 "ru": "Индексируется каждые {0} секунд",
12851 "zh-chs": "每{0}秒索引一次",
12852 "xloc": [
12834 - "player.handlebars->3->17"
12853 + "player.handlebars->3->22"
12854 ]
12855 },
12856 {
@@ -13307,6 +13326,12 @@
13326 "xterm.handlebars->9->5"
13327 ]
13328 },
13329 + {
13330 + "en": "Intel&reg; AMT KVM",
13331 + "xloc": [
13332 + "player.handlebars->3->15"
13333 + ]
13334 + },
13335 {
13336 "cs": "Intel® AMT zásada",
13337 "de": "Intel&reg; AMT Regelwerk",
@@ -19281,7 +19306,7 @@
19306 "ru": "Открыть файл...",
19307 "zh-chs": "打開文件...",
19308 "xloc": [
19284 - "player.handlebars->3->21",
19309 + "player.handlebars->3->26",
19310 "player.handlebars->p11->deskarea0->deskarea1->3"
19311 ]
19312 },
@@ -20618,8 +20643,8 @@
20643 "ru": "Нажмите [пробел] для проигрывания/паузы.",
20644 "zh-chs": "按[空格]播放/暫停。",
20645 "xloc": [
20621 - "player.handlebars->3->18",
20622 - "player.handlebars->3->19"
20646 + "player.handlebars->3->23",
20647 + "player.handlebars->3->24"
20648 ]
20649 },
20650 {
@@ -20716,7 +20741,7 @@
20741 "zh-chs": "協議",
20742 "xloc": [
20743 "default.handlebars->27->1718",
20719 - "player.handlebars->3->15"
20744 + "player.handlebars->3->16"
20745 ]
20746 },
20747 {
@@ -22862,7 +22887,7 @@
22887 "ru": "Ищу",
22888 "zh-chs": "尋求",
22889 "xloc": [
22865 - "player.handlebars->3->16"
22890 + "player.handlebars->3->21"
22891 ]
22892 },
22893 {
views/default-mobile.handlebars
-1
@@ -4212,7 +4212,6 @@
4212 function joinPaths() { var x = []; for (var i in arguments) { var w = arguments[i]; if ((w != null) && (w != '')) { while (w.endsWith('/') || w.endsWith('\\')) { w = w.substring(0, w.length - 1); } while (w.startsWith('/') || w.startsWith('\\')) { w = w.substring(1); } x.push(w); } } return x.join('/'); }
4213 function focusTextBox(x) { setTimeout(function () { Q(x).selectionStart = Q(x).selectionEnd = 65535; Q(x).focus(); }, 0); }
4214 var isFilenameValid = (function () { var x1 = /^[^\\/:\*\?"<>\|]+$/, x2 = /^\./, x3 = /^(nul|prn|con|lpt[0-9]|com[0-9])(\.|$)/i; return function isFilenameValid(fname) { return x1.test(fname) && !x2.test(fname) && !x3.test(fname) && (fname[0] != '.'); } })();
4215 - function parseUriArgs() { var href = window.document.location.href; if (href.endsWith('#')) { href = href.substring(0, href.length - 1); } var name, r = {}, parsedUri = href.split(/[\?&|\=]/); parsedUri.splice(0, 1); for (x in parsedUri) { switch (x % 2) { case 0: { name = decodeURIComponent(parsedUri[x]); break; } case 1: { r[name] = decodeURIComponent(parsedUri[x]); var x = parseInt(r[name]); if (x == r[name]) { r[name] = x; } break; } default: { break; } } } return r; }
4215 function printDate(d) { return d.toLocaleDateString(args.locale); }
4216 function printTime(d) { return d.toLocaleTimeString(args.locale); }
4217 function printDateTime(d) { return d.toLocaleString(args.locale); }
views/default.handlebars
-1
@@ -12871,7 +12871,6 @@
12871 function addHtmlValue2(t, v) { return '<div><div style=display:inline-block;float:right>' + v + '</div><div style=display:inline-block>' + t + '</div></div>'; }
12872 function addHtmlValue3(t, v) { return '<div><b>' + t + '</b></div><div style=margin-left:16px>' + v + '</div>'; }
12873 function addHtmlValue4(t, v) { return '<table style=width:100%><td style=width:120px>' + t + '<td style=text-align:right><b>' + v + '</b></table>'; }
12874 - function parseUriArgs() { var href = window.document.location.href; if (href.endsWith('#')) { href = href.substring(0, href.length - 1); } var name, r = {}, parsedUri = href.split(/[\?&|\=]/); parsedUri.splice(0, 1); for (x in parsedUri) { switch (x % 2) { case 0: { name = decodeURIComponent(parsedUri[x]); break; } case 1: { r[name] = decodeURIComponent(parsedUri[x]); var x = parseInt(r[name]); if (x == r[name]) { r[name] = x; } break; } default: { break; } } } return r; }
12874 function focusTextBox(x) { setTimeout(function(){ Q(x).selectionStart = Q(x).selectionEnd = 65535; Q(x).focus(); }, 0); }
12875 function validateEmail(v) { var emailReg = /^(([^<>()\[\]\\.,;:\s@"]+(\.[^<>()\[\]\\.,;:\s@"]+)*)|(".+"))@((\[[0-9]{1,3}\.[0-9]{1,3}\.[0-9]{1,3}\.[0-9]{1,3}])|(([a-zA-Z\-0-9]+\.)+[a-zA-Z]{2,}))$/; return emailReg.test(v); } // New version
12876 function isPrivateIP(a) { return (a.startsWith('10.') || a.startsWith('172.16.') || a.startsWith('192.168.')); }
views/invite.handlebars
+1 -2
@@ -102,6 +102,7 @@
102 <script>
103 'use strict';
104 var urlargs = parseUriArgs();
105 + if (urlargs.key && (isAlphaNumeric(urlargs.key) == false)) { delete urlargs.key; }
106 var uiMode = parseInt(getstore('uiMode', 1));
107 var webPageStackMenu = false;
108 var webPageFullScreen = true;
@@ -195,8 +196,6 @@
196 function putstore(name, val) { try { if (typeof (localStorage) === 'undefined') return; localStorage.setItem(name, val); } catch (e) { } }
197 function getstore(name, val) { try { if (typeof (localStorage) === 'undefined') return val; var v = localStorage.getItem(name); if ((v == null) || (v == null)) return val; return v; } catch (e) { return val; } }
198 function format(format) { var args = Array.prototype.slice.call(arguments, 1); return format.replace(/{(\d+)}/g, function (match, number) { return typeof args[number] != 'undefined' ? args[number] : match; }); };
198 - function parseUriArgs() { var href = window.document.location.href; if (href.endsWith('#')) { href = href.substring(0, href.length - 1); } var name, r = {}, parsedUri = href.split(/[\?&|\=]/); parsedUri.splice(0, 1); for (x in parsedUri) { switch (x % 2) { case 0: { name = decodeURIComponent(parsedUri[x]); break; } case 1: { r[name] = decodeURIComponent(parsedUri[x]); var x = parseInt(r[name]); if (x == r[name]) { r[name] = x; } break; } default: { break; } } } return r; }
199 -
199 </script>
200 </body>
201 </html>
views/login.handlebars
-1
@@ -854,7 +854,6 @@
854 function getstore(name, val) { try { if (typeof (localStorage) === 'undefined') return val; var v = localStorage.getItem(name); if ((v == null) || (v == null)) return val; return v; } catch (e) { return val; } }
855 function format(format) { var args = Array.prototype.slice.call(arguments, 1); return format.replace(/{(\d+)}/g, function (match, number) { return typeof args[number] != 'undefined' ? args[number] : match; }); };
856 function addTextLink(subtext, text, link) { var i = text.toLowerCase().indexOf(subtext.toLowerCase()); if (i == -1) { return text; } return text.substring(0, i) + '<a href="' + link + '">' + subtext + '</a>' + text.substring(i + subtext.length); }
857 - function parseUriArgs() { var href = window.document.location.href; if (href.endsWith('#')) { href = href.substring(0, href.length - 1); } var name, r = {}, parsedUri = href.split(/[\?&|\=]/); parsedUri.splice(0, 1); for (x in parsedUri) { switch (x % 2) { case 0: { name = decodeURIComponent(parsedUri[x]); break; } case 1: { r[name] = decodeURIComponent(parsedUri[x]); var x = parseInt(r[name]); if (x == r[name]) { r[name] = x; } break; } default: { break; } } } return r; }
857 function addHtmlValue(t, v) { return '<table><td style=width:120px;text-align:left>' + t + '<td><b>' + v + '</b></table>'; }
858
859 </script>
views/messenger.handlebars
+4 -5
@@ -68,7 +68,7 @@
68 var currentFileDownload = null;
69
70 // Set the title
71 - if (args.title) { QH('xtitle', args.title.split(' ').join('&nbsp')); document.title = document.title + ' - ' + args.title; }
71 + if (args.title) { QH('xtitle', EscapeHtml(args.title).split(' ').join('&nbsp')); document.title = document.title + ' - ' + args.title; }
72
73 // Setup web notifications
74 if (Notification) { QV('notifyButton', Notification.permission != 'granted'); }
@@ -149,7 +149,7 @@
149
150 // Display a control message
151 function displayControl(msg) {
152 - QA('xmsg', '<div style="clear:both"><div style="color:gray;float:left;margin-bottom:2px">' + msg + '</div><div></div></div>');
152 + QA('xmsg', '<div style="clear:both"><div style="color:gray;float:left;margin-bottom:2px">' + EscapeHtml(msg) + '</div><div></div></div>');
153 Q('xmsg').scrollTop = Q('xmsg').scrollHeight;
154 }
155
@@ -163,7 +163,7 @@
163
164 // Display a message from the remote user
165 function displayRemote(msg) {
166 - QA('xmsg', '<div style="clear:both"><div class="remoteBubble">' + msg + '</div><div></div></div>');
166 + QA('xmsg', '<div style="clear:both"><div class="remoteBubble">' + EscapeHtml(msg) + '</div><div></div></div>');
167 Q('xmsg').scrollTop = Q('xmsg').scrollHeight;
168
169 // If web notifications are granted, use it.
@@ -185,14 +185,13 @@
185 var outtext = Q('xouttext').value;
186 if (outtext.length > 0) {
187 Q('xouttext').value = '';
188 - QA('xmsg', '<div style="clear:both"><div class="localBubble">' + outtext + '</div><div></div></div>');
188 + QA('xmsg', '<div style="clear:both"><div class="localBubble">' + EscapeHtml(outtext) + '</div><div></div></div>');
189 Q('xmsg').scrollTop = Q('xmsg').scrollHeight;
190 send({ action: 'chat', msg: outtext });
191 }
192 }
193
194 function haltEvent(e) { if (e.preventDefault) e.preventDefault(); if (e.stopPropagation) e.stopPropagation(); return false; }
195 - function parseUriArgs() { var name, r = {}, parsedUri = window.document.location.href.split(/[\?&|\=]/); parsedUri.splice(0, 1); for (x in parsedUri) { switch (x % 2) { case 0: { name = decodeURIComponent(parsedUri[x]); break; } case 1: { r[name] = decodeURIComponent(parsedUri[x]); var x = parseInt(r[name]); if (x == r[name]) { r[name] = x; } break; } default: { break; } } } return r; }
195
196 // Update user controls
197 function updateControls() {
views/mstsc.handlebars
+24 -1
@@ -68,6 +68,7 @@
68 var client = null;
69 var canvas = null;
70 var urlargs = parseUriArgs();
71 + if (urlargs.key && (isAlphaNumeric(urlargs.key) == false)) { delete urlargs.key; }
72 var cookie = '{{{cookie}}}';
73 var name = decodeURIComponent('{{{name}}}');
74 if (name != '') { document.title = name + ' - ' + document.title; }
@@ -105,9 +106,31 @@
106 function QA(x, y) { Q(x).innerHTML += y; } // "Q" append
107 function QH(x, y) { Q(x).innerHTML = y; } // "Q" html
108 function QC(x) { try { return Q(x).classList; } catch (x) { } } // "Q" class
108 - function parseUriArgs() { var href = window.document.location.href; if (href.endsWith('#')) { href = href.substring(0, href.length - 1); } var name, r = {}, parsedUri = href.split(/[\?&|\=]/); parsedUri.splice(0, 1); for (x in parsedUri) { switch (x % 2) { case 0: { name = decodeURIComponent(parsedUri[x]); break; } case 1: { r[name] = decodeURIComponent(parsedUri[x]); var x = parseInt(r[name]); if (x == r[name]) { r[name] = x; } break; } default: { break; } } } return r; }
109 function EscapeHtml(x) { if (typeof x == 'string') return x.replace(/&/g, '&amp;').replace(/>/g, '&gt;').replace(/</g, '&lt;').replace(/"/g, '&quot;').replace(/'/g, '&apos;'); if (typeof x == 'boolean') return x; if (typeof x == 'number') return x; }
110 function EscapeHtmlBreaks(x) { if (typeof x == 'string') return x.replace(/&/g, '&amp;').replace(/>/g, '&gt;').replace(/</g, '&lt;').replace(/"/g, '&quot;').replace(/'/g, '&apos;').replace(/\r/g, '<br />').replace(/\n/g, '').replace(/\t/g, '&nbsp;&nbsp;'); if (typeof x == 'boolean') return x; if (typeof x == 'number') return x; }
111 +
112 + // String validation
113 + function isAlphaNumeric(str) { return (str.match(/^[A-Za-z0-9]+$/) != null); };
114 + function isSafeString(str) { return ((typeof str == 'string') && (str.indexOf('<') == -1) && (str.indexOf('>') == -1) && (str.indexOf('&') == -1) && (str.indexOf('"') == -1) && (str.indexOf('\'') == -1) && (str.indexOf('+') == -1) && (str.indexOf('(') == -1) && (str.indexOf(')') == -1) && (str.indexOf('#') == -1) && (str.indexOf('%') == -1) && (str.indexOf(':') == -1) && (str.indexOf('-') == -1)) };
115 +
116 + // Parse URL arguments, only keep safe values
117 + function parseUriArgs() {
118 + var href = window.document.location.href;
119 + if (href.endsWith('#')) { href = href.substring(0, href.length - 1); }
120 + var name, r = {}, parsedUri = href.split(/[\?&|\=]/);
121 + parsedUri.splice(0, 1);
122 + for (x in parsedUri) {
123 + switch (x % 2) {
124 + case 0: { name = decodeURIComponent(parsedUri[x]); break; }
125 + case 1: {
126 + r[name] = decodeURIComponent(parsedUri[x]);
127 + if (!isSafeString(r[name])) { delete r[name]; } else { var x = parseInt(r[name]); if (x == r[name]) { r[name] = x; } }
128 + break;
129 + } default: { break; }
130 + }
131 + }
132 + return r;
133 + }
134 </script>
135 </head>
136 <body onload='load()' style="position:absolute;top:0px;right:0;left:0;bottom:0px">
views/terms.handlebars
+2 -6
@@ -173,10 +173,8 @@
173
174 // Fix links if a loginKey if used
175 var urlargs = parseUriArgs();
176 - if (urlargs.key) {
177 - console.log('aa', urlargs.key);
178 - Q('backLink').href += '?key=' + urlargs.key;
179 - }
176 + if (urlargs.key && (isAlphaNumeric(urlargs.key) == false)) { delete urlargs.key; }
177 + if (urlargs.key) { Q('backLink').href += '?key=' + urlargs.key; }
178
179 // Setup logout control
180 var logoutControl = '';
@@ -250,8 +248,6 @@
248 function putstore(name, val) { try { if (typeof (localStorage) === 'undefined') return; localStorage.setItem(name, val); } catch (e) { } }
249 function getstore(name, val) { try { if (typeof (localStorage) === 'undefined') return val; var v = localStorage.getItem(name); if ((v == null) || (v == null)) return val; return v; } catch (e) { return val; } }
250 function format(format) { var args = Array.prototype.slice.call(arguments, 1); return format.replace(/{(\d+)}/g, function (match, number) { return typeof args[number] != 'undefined' ? args[number] : match; }); };
253 - function parseUriArgs() { var href = window.document.location.href; if (href.endsWith('#')) { href = href.substring(0, href.length - 1); } var name, r = {}, parsedUri = href.split(/[\?&|\=]/); parsedUri.splice(0, 1); for (x in parsedUri) { switch (x % 2) { case 0: { name = decodeURIComponent(parsedUri[x]); break; } case 1: { r[name] = decodeURIComponent(parsedUri[x]); var x = parseInt(r[name]); if (x == r[name]) { r[name] = x; } break; } default: { break; } } } return r; }
254 -
251 </script>
252 </body>
253 </html>
views/xterm.handlebars
+22 -1
@@ -92,6 +92,7 @@
92 function start() {
93 // Parse any URL arguments
94 args = parseUriArgs();
95 + if (args.key && (isAlphaNumeric(args.key) == false)) { delete args.key; }
96
97 // Connect to the mesh server
98 meshserver = MeshServerCreateControl(domainUrl, authCookie);
@@ -303,7 +304,27 @@
304 function haltEvent(e) { if (e.preventDefault) e.preventDefault(); if (e.stopPropagation) e.stopPropagation(); return false; }
305 function pad2(num) { var s = '00' + num; return s.substr(s.length - 2); }
306 function format(format) { var args = Array.prototype.slice.call(arguments, 1); return format.replace(/{(\d+)}/g, function (match, number) { return typeof args[number] != 'undefined' ? args[number] : match; }); };
306 - function parseUriArgs() { var name, r = {}, parsedUri = window.document.location.href.split(/[\?&|\=]/); parsedUri.splice(0, 1); for (x in parsedUri) { switch (x % 2) { case 0: { name = decodeURIComponent(parsedUri[x]); break; } case 1: { r[name] = decodeURIComponent(parsedUri[x]); var x = parseInt(r[name]); if (x == r[name]) { r[name] = x; } break; } default: { break; } } } return r; }
307 + function isAlphaNumeric(str) { return (str.match(/^[A-Za-z0-9]+$/) != null); };
308 + function isSafeString(str) { return ((typeof str == 'string') && (str.indexOf('<') == -1) && (str.indexOf('>') == -1) && (str.indexOf('&') == -1) && (str.indexOf('"') == -1) && (str.indexOf('\'') == -1) && (str.indexOf('+') == -1) && (str.indexOf('(') == -1) && (str.indexOf(')') == -1) && (str.indexOf('#') == -1) && (str.indexOf('%') == -1) && (str.indexOf(':') == -1) && (str.indexOf('-') == -1)) };
309 +
310 + // Parse URL arguments, only keep safe values
311 + function parseUriArgs() {
312 + var href = window.document.location.href;
313 + if (href.endsWith('#')) { href = href.substring(0, href.length - 1); }
314 + var name, r = {}, parsedUri = href.split(/[\?&|\=]/);
315 + parsedUri.splice(0, 1);
316 + for (x in parsedUri) {
317 + switch (x % 2) {
318 + case 0: { name = decodeURIComponent(parsedUri[x]); break; }
319 + case 1: {
320 + r[name] = decodeURIComponent(parsedUri[x]);
321 + if (!isSafeString(r[name])) { delete r[name]; } else { var x = parseInt(r[name]); if (x == r[name]) { r[name] = x; } }
322 + break;
323 + } default: { break; }
324 + }
325 + }
326 + return r;
327 + }
328
329 start();
330 </script>