HelloZeroNet/ZeroNet
1
0
Fork 0
mirror of https://github.com/HelloZeroNet/ZeroNet.git synced 2023-12-14 04:33:03 +01:00
Code Issues Projects Releases Wiki Activity

Remove wrapper object reference before loading iframe to enhance security

Browse source
This commit is contained in:
shortcutme 2018-02-21 03:03:01 +01:00
parent c438b9f8a5
commit fd56ddaa54
No known key found for this signature in database
GPG key ID: 5B63BAE6CB9613AE
2 changed files with 8 additions and 2 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

6
src/Ui/media/Wrapper.coffee
View file

@ -398,6 +398,12 @@ class Wrapper
@log "Setting title to", window.document.title
onWrapperLoad: =>
# Cleanup secret variables
delete window.wrapper
delete window.wrapper_key
$("#script_init").remove()
# Send message to innerframe
sendInner: (message) ->
@inner.postMessage(message, '*')

4
src/Ui/template/wrapper.html
View file

@ -54,7 +54,7 @@ if (window.self !== window.top && document.execCommand) document.execCommand("St
<iframe src='about:blank' id='inner-iframe' sandbox="allow-forms allow-scripts allow-top-navigation allow-popups allow-modals {sandbox_permissions}" allowfullscreen="true" webkitallowfullscreen="true" mozallowfullscreen="true" oallowfullscreen="true" msallowfullscreen="true"></iframe>
<!-- Site info -->
<script>
<script id="script_init">
document.getElementById("inner-iframe").src = "about:blank"
document.getElementById("inner-iframe").src = "{file_url}{query_string}"
address = "{address}"
@ -71,6 +71,6 @@ if (typeof WebSocket === "undefined")
document.body.innerHTML += "<div class='unsupported'>Your browser is not supported please use <a href='http://outdatedbrowser.com'>Chrome or Firefox</a>.</div>";
</script>
<script type="text/javascript" src="/uimedia/all.js?rev={rev}&lang={lang}"></script>
<script>setTimeout(window.wrapper.onWrapperLoad, 1)</script>
</body>
</html>