External/5chan
1
0
Fork 0
mirror of https://github.com/bitsocialnet/5chan.git synced 2026-08-03 07:41:04 +02:00
Code Issues Packages Projects Releases Wiki Activity

add link to node stats in the settings

Browse Source
This commit is contained in:
plebeius.eth
2023-07-04 13:42:19 +02:00
parent ee0788a90a
commit e9377ae1aa
3 changed files with 34 additions and 20 deletions
Download Patch File Download Diff File Expand all files Collapse all files
electron/main.js
+23 -19
View File
@@ -117,15 +117,18 @@ const createMainWindow = () => {
// only open valid https urls to prevent remote execution
// will throw if url isn't valid
const validatedUrl = new URL(originalUrl);
if (validatedUrl.protocol !== 'https:') {
throw Error(`can't open url '${originalUrl}' not https`);
let serializedUrl = '';
// make an exception for ipfs stats
if (validatedUrl.toString() === 'http://localhost:5001/webui/') {
serializedUrl = validatedUrl.toString();
} else if (validatedUrl.protocol === 'https:') {
// open serialized url to prevent remote execution
serializedUrl = validatedUrl.toString();
} else {
throw Error(`can't open url '${originalUrl}', it's not https and not the allowed http exception`);
}
// do not open http protocol, not private
// do not open any other protocol, will lead to remote execution
// open serialized url to prevent remote execution
const serializedUrl = validatedUrl.toString();
shell.openExternal(serializedUrl);
} catch (e) {
console.warn(e);
@@ -136,7 +139,7 @@ const createMainWindow = () => {
// open links (with target="_blank") in external browser
// do not open links in plebchan or will lead to remote execution
mainWindow.webContents.setWindowOpenHandler(({url}) => {
const originalUrl = url
const originalUrl = url;
try {
// do not let the user open any url with shell.openExternal
// or it will lead to remote execution https://benjamin-altpeter.de/shell-openexternal-dangers/
@@ -144,25 +147,26 @@ const createMainWindow = () => {
// only open valid https urls to prevent remote execution
// will throw if url isn't valid
const validatedUrl = new URL(originalUrl);
if (validatedUrl.protocol !== 'https:') {
throw Error(`can't open url '${originalUrl}' not https`);
let serializedUrl = '';
// make an exception for ipfs stats
if (validatedUrl.toString() === 'http://localhost:5001/webui/') {
serializedUrl = validatedUrl.toString();
} else if (validatedUrl.protocol === 'https:') {
// open serialized url to prevent remote execution
serializedUrl = validatedUrl.toString();
} else {
throw Error(`can't open url '${originalUrl}', it's not https and not the allowed http exception`);
}
// do not open http protocol, not private
// do not open any other protocol, will lead to remote execution
// open serialized url to prevent remote execution
const serializedUrl = validatedUrl.toString();
shell.openExternal(serializedUrl);
setImmediate(() => {
shell.openExternal(serializedUrl)
})
} catch (e) {
console.warn(e);
}
return {action: 'deny'}
return {action: 'deny'};
})
// deny permissions like location, notifications, etc https://www.electronjs.org/docs/latest/tutorial/security#5-handle-session-permission-requests-from-remote-content
mainWindow.webContents.session.setPermissionRequestHandler((webContents, permission, callback) => {
// deny all permissions