github/qBittorrent
1
0
Fork 0
mirror of https://github.com/qbittorrent/qBittorrent synced 2025-08-19 12:59:56 -07:00
Code Issues Projects Releases Packages Wiki Activity Actions 3

Place WebUI RSS description in sandboxed iframe

Browse source
This commit is contained in:
Sepro 2020-10-19 06:39:19 +02:00 • committed by sledgehammer999
commit f49f5ba9a1
No known key found for this signature in database
GPG key ID: 6E4A2D025B7CC9A2
1 changed files with 13 additions and 4 deletions
Download patch file Download diff file Expand all files Collapse all files

17
src/webui/www/private/views/rss.html
View file

@ -72,6 +72,11 @@
width: 100%; width: 100%;
} }
#rssDescription {
width: 100%;
border: none;
}
</style> </style>
<div id="rssView"> <div id="rssView">
@ -423,11 +428,15 @@
return torrentDate; return torrentDate;
})()); })());
// Strip script before interpreting html // Place in iframe with sandbox atribute to prevent js execution
let torrentDescription = document.createRange().createContextualFragment( let torrentDescription = document.createRange().createContextualFragment('<iframe sandbox id="rssDescription"></iframe>');
'<div id="rssTorrentDetailsDescription">' + article.description.stripScripts() + '</div>');
$('rssDetailsView').append(torrentDescription); $('rssDetailsView').append(torrentDescription);
document.getElementById('rssDescription').srcdoc = '<html><head><link rel="stylesheet" type="text/css" href="css/style.css" /></head><body>' + article.description + "</body></html>";
//calculate height to fill screen
document.getElementById('rssDescription').style.height =
"calc(100% - " + document.getElementById('rssTorrentDetailsName').offsetHeight + "px - " +
document.getElementById('rssTorrentDetailsDate').offsetHeight + "px - 5px)";
} }
}; };