PrivateCoffee/element-web
4
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions 3

Ensure that roomId is validated before accessing room-based widgets.

Browse source
This commit is contained in:
Richard Lewis 2018-02-23 14:53:52 +00:00
parent fefc325b12
commit 46f94b3c5a
1 changed files with 14 additions and 10 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

24
src/ScalarMessaging.js
View file

@ -334,7 +334,6 @@ function setWidget(event, roomId) {
};
if (userWidget) {
console.warn('Adding user widget');
const client = MatrixClientPeg.get();
const userWidgets = client.getAccountData('m.widgets').getContent() || {};
@ -357,7 +356,6 @@ function setWidget(event, roomId) {
}
client.setAccountData('m.widgets', userWidgets);
console.warn(`Set user widgets to:`, client.getAccountData('m.widgets'));
sendResponse(event, {
success: true,
});
@ -619,17 +617,14 @@ const onMessage = function(event) {
const userId = event.data.user_id;
// These APIs don't require roomId
// Get and set user widgets (not associated with a specific room)
// If roomId is specified, it must be validated, so room-based widgets agreed
// handled further down.
if (event.data.action === "get_widgets") {
getWidgets(event, roomId);
getWidgets(event, null);
return;
} else if (event.data.action === "set_widget") {
setWidget(event, roomId);
return;
} else if (event.data.action === "add_widget_asset") {
addWidgetAsset(event, roomId);
return;
} else if (event.data.action === "remove_widget_asset") {
removeWidgetAsset(event, roomId);
setWidget(event, null);
return;
}
@ -656,6 +651,15 @@ const onMessage = function(event) {
return;
}
// Get and set room-based widgets
if (event.data.action === "get_widgets") {
getWidgets(event, null);
return;
} else if (event.data.action === "set_widget") {
setWidget(event, null);
return;
}
// These APIs don't require userId
if (event.data.action === "join_rules_state") {
getJoinRules(event, roomId);