Ensure that roomId is validated before accessing room-based widgets.

This commit is contained in:
Richard Lewis 2018-02-23 14:53:52 +00:00
parent fefc325b12
commit 46f94b3c5a

View file

@ -334,7 +334,6 @@ function setWidget(event, roomId) {
}; };
if (userWidget) { if (userWidget) {
console.warn('Adding user widget');
const client = MatrixClientPeg.get(); const client = MatrixClientPeg.get();
const userWidgets = client.getAccountData('m.widgets').getContent() || {}; const userWidgets = client.getAccountData('m.widgets').getContent() || {};
@ -357,7 +356,6 @@ function setWidget(event, roomId) {
} }
client.setAccountData('m.widgets', userWidgets); client.setAccountData('m.widgets', userWidgets);
console.warn(`Set user widgets to:`, client.getAccountData('m.widgets'));
sendResponse(event, { sendResponse(event, {
success: true, success: true,
}); });
@ -619,17 +617,14 @@ const onMessage = function(event) {
const userId = event.data.user_id; const userId = event.data.user_id;
// These APIs don't require roomId // These APIs don't require roomId
// Get and set user widgets (not associated with a specific room)
// If roomId is specified, it must be validated, so room-based widgets agreed
// handled further down.
if (event.data.action === "get_widgets") { if (event.data.action === "get_widgets") {
getWidgets(event, roomId); getWidgets(event, null);
return; return;
} else if (event.data.action === "set_widget") { } else if (event.data.action === "set_widget") {
setWidget(event, roomId); setWidget(event, null);
return;
} else if (event.data.action === "add_widget_asset") {
addWidgetAsset(event, roomId);
return;
} else if (event.data.action === "remove_widget_asset") {
removeWidgetAsset(event, roomId);
return; return;
} }
@ -656,6 +651,15 @@ const onMessage = function(event) {
return; return;
} }
// Get and set room-based widgets
if (event.data.action === "get_widgets") {
getWidgets(event, null);
return;
} else if (event.data.action === "set_widget") {
setWidget(event, null);
return;
}
// These APIs don't require userId // These APIs don't require userId
if (event.data.action === "join_rules_state") { if (event.data.action === "join_rules_state") {
getJoinRules(event, roomId); getJoinRules(event, roomId);