Added login throttling test, updated reset-pw test method names

[bookstack] / resources / js / services / drawio.js

diff --git a/resources/js/services/drawio.js b/resources/js/services/drawio.js
index 17e57cd6b9165d567aa09f48197ea95e8b62551f..dfca832117f28b8c5ac12014a729bc0fc0610483 100644 (file)
--- a/resources/js/services/drawio.js
+++ b/resources/js/services/drawio.js
@@ -1,5 +1,5 @@
 let iFrame = null;
 let iFrame = null;

-
+let lastApprovedOrigin;

 let onInit, onSave;
 
 /**
 let onInit, onSave;
 
 /**


@@ -19,15 +19,22 @@ function show(drawioUrl, onInitCallback, onSaveCallback) {
     iFrame.setAttribute('class', 'fullscreen');
     iFrame.style.backgroundColor = '#FFFFFF';
     document.body.appendChild(iFrame);
     iFrame.setAttribute('class', 'fullscreen');
     iFrame.style.backgroundColor = '#FFFFFF';
     document.body.appendChild(iFrame);

+    lastApprovedOrigin = (new URL(drawioUrl)).origin;

 }
 
 function close() {
     drawEventClose();
 }
 
 }
 
 function close() {
     drawEventClose();
 }
 

+/**
+ * Receive and handle a message event from the draw.io window.
+ * @param {MessageEvent} event
+ */

 function drawReceive(event) {
     if (!event.data || event.data.length < 1) return;
 function drawReceive(event) {
     if (!event.data || event.data.length < 1) return;

-    let message = JSON.parse(event.data);
+    if (event.origin !== lastApprovedOrigin) return;
+
+    const message = JSON.parse(event.data);

     if (message.event === 'init') {
         drawEventInit();
     } else if (message.event === 'exit') {
     if (message.event === 'init') {
         drawEventInit();
     } else if (message.event === 'exit') {


@@ -36,6 +43,8 @@ function drawReceive(event) {
         drawEventSave(message);
     } else if (message.event === 'export') {
         drawEventExport(message);
         drawEventSave(message);
     } else if (message.event === 'export') {
         drawEventExport(message);

+    } else if (message.event === 'configure') {
+        drawEventConfigure();

     }
 }
 
     }
 }
 


@@ -56,13 +65,19 @@ function drawEventInit() {
     });
 }
 
     });
 }
 

+function drawEventConfigure() {
+    const config = {};
+    window.$events.emitPublic(iFrame, 'editor-drawio::configure', {config});
+    drawPostMessage({action: 'configure', config});
+}
+

 function drawEventClose() {
     window.removeEventListener('message', drawReceive);
     if (iFrame) document.body.removeChild(iFrame);
 }
 
 function drawPostMessage(data) {
 function drawEventClose() {
     window.removeEventListener('message', drawReceive);
     if (iFrame) document.body.removeChild(iFrame);
 }
 
 function drawPostMessage(data) {

-    iFrame.contentWindow.postMessage(JSON.stringify(data), '*');
+    iFrame.contentWindow.postMessage(JSON.stringify(data), lastApprovedOrigin);

 }
 
 async function upload(imageData, pageUploadedToId) {
 }
 
 async function upload(imageData, pageUploadedToId) {