Files
port-ui/app/static/js/iframe.js

194 lines
6.4 KiB
JavaScript
Raw Normal View History

2025-03-19 17:16:44 +01:00
// Global variables to store elements and original state
let mainElement, originalContent, originalMainStyle, container, customScrollbar, scrollbarContainer;
2025-07-08 14:39:13 +02:00
let currentIframeUrl = null;
2025-07-08 17:16:57 +02:00
// === Auto-open iframe if URL parameter is present ===
window.addEventListener('DOMContentLoaded', () => {
const paramUrl = new URLSearchParams(window.location.search).get('iframe');
if (paramUrl) {
currentIframeUrl = paramUrl;
enterFullscreen();
openIframe(paramUrl);
}
});
// Synchronize the height of the iframe to match the scroll-container or main element
function syncIframeHeight() {
const iframe = mainElement.querySelector("iframe");
if (iframe) {
if (scrollbarContainer) {
// Prefer inline height, otherwise inline max-height
const inlineHeight = scrollbarContainer.style.height;
const inlineMax = scrollbarContainer.style.maxHeight;
const target = inlineHeight || inlineMax;
if (target) {
iframe.style.height = target;
} else {
iframe.style.height = mainElement.style.height;
}
} else {
iframe.style.height = mainElement.style.height;
}
2025-03-19 16:53:49 +01:00
}
}
2025-03-19 16:14:06 +01:00
// Function to open a URL in an iframe (jQuery version mit 1500 ms Fade)
function openIframe(url) {
fix(modal): stop untrusted content reaching innerHTML and the iframe Every one of these paths checked a string that the browser reinterprets afterwards. isSafeUrl now hangs the value on an <a> and reads back probe.protocol, so the check sees what the browser will see: a pre-parse test reads "&#106;avascript:" as a relative path and passes it, and the HTML parser then decodes it to "javascript:". marked passes raw HTML through and emits hrefs unescaped. renderMarkdown escapes the angle brackets before parsing, parses into an inert DOMParser document where no script runs and no image loads, and drops anchors and images whose scheme is not http, https or mailto. Blockquotes and <autolinks> stop working as a result; neither appears in the configuration. modalTitle and the alternatives list interpolated subitem.name and icon.class into innerHTML. Both are built as nodes now. name is a translatable key, so it arrives from the machine-written catalogues. The link kept its click handler and its class across popups, because one anchor serves all of them: a later, unrelated click opened whatever an earlier popup pointed at, and addEventListener stacked one handler per open. Both are reset per popup and the handler is assigned, not added. openIframe guards its own argument. Removing the href alone left the handler passing the raw URL on, and ?iframe= in the query string reaches the same sink with no configuration involved at all. Verified in headless Chromium: decimal and hex character references, &Tab;- and &NewLine;-split schemes, reference-style links, raw HTML as a link's text, and the two name sinks all executed before these changes. injection.spec.js keeps all fifteen payloads. Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
2026-08-22 00:04:25 +02:00
if (!isSafeUrl(url)) {
return;
}
var $container = scrollbarContainer ? $(scrollbarContainer) : null;
var $customScroll = customScrollbar ? $(customScrollbar) : null;
var $main = $(mainElement);
2025-03-18 14:59:54 +01:00
// Original-Content ausblenden mit 1500 ms
var promises = [];
if ($container) promises.push($container.fadeOut(1500).promise());
if ($customScroll) promises.push($customScroll.fadeOut(1500).promise());
$.when.apply($, promises).done(function() {
2025-07-08 17:16:57 +02:00
// now that scroll areas are hidden, go fullscreen
enterFullscreen();
// create iframe if it doesnt exist yet
var $iframe = $main.find('iframe');
if ($iframe.length === 0) {
originalMainStyle = $main.attr('style') || null;
$iframe = $('<iframe>', {
width: '100%',
frameborder: 0,
scrolling: 'auto'
}).css({ overflow: 'auto', display: 'none' });
$main.append($iframe);
}
2025-03-18 14:59:54 +01:00
// Quelle setzen und mit 1500 ms einblenden
$iframe
.attr('src', url)
.fadeIn(1500, function() {
syncIframeHeight();
2025-07-07 23:40:35 +02:00
observeIframeNavigation();
});
2025-07-05 11:54:20 +02:00
// URL-State pushen
var newUrl = new URL(window.location);
newUrl.searchParams.set('iframe', url);
window.history.pushState({ iframe: url }, '', newUrl);
});
2025-03-19 17:16:44 +01:00
}
2025-03-18 14:59:54 +01:00
2025-07-08 17:16:57 +02:00
/**
* Restore the original <main> content and exit fullscreen.
*/
2025-07-05 13:17:38 +02:00
function restoreOriginal() {
2025-07-08 17:16:57 +02:00
// Exit fullscreen (collapse header/footer and run recalcs)
exitFullscreen();
2025-07-05 13:17:38 +02:00
2025-07-08 17:16:57 +02:00
// Replace <main> innerHTML with the snapshot we took on load
mainElement.innerHTML = originalContent;
2025-07-05 13:17:38 +02:00
2025-07-08 17:16:57 +02:00
// Reset any inline styles on mainElement
if (originalMainStyle !== null) {
mainElement.setAttribute('style', originalMainStyle);
} else {
mainElement.removeAttribute('style');
}
2025-07-05 13:17:38 +02:00
2025-07-08 17:16:57 +02:00
// Re-run height adjustments for scroll container & thumb
adjustScrollContainerHeight();
updateCustomScrollbar();
2025-07-05 13:17:38 +02:00
2025-07-08 17:16:57 +02:00
// Clear iframe state and URL param
currentIframeUrl = null;
history.replaceState(null, '', window.location.pathname);
2025-07-05 13:17:38 +02:00
}
// Initialize event listeners after DOM content is loaded
document.addEventListener("DOMContentLoaded", function() {
// Cache references to elements and original state
2025-03-19 17:16:44 +01:00
mainElement = document.querySelector("main");
originalContent = mainElement.innerHTML;
originalMainStyle = mainElement.getAttribute("style"); // may be null
2025-03-19 17:16:44 +01:00
container = document.querySelector(".container");
customScrollbar = document.getElementById("custom-scrollbar");
scrollbarContainer = container.querySelector(".scroll-container")
2025-03-18 15:03:03 +01:00
document.querySelectorAll(".js-restore").forEach(el => {
el.style.cursor = "pointer";
el.addEventListener("click", restoreOriginal);
});
2025-07-08 17:16:57 +02:00
// === Close iframe & exit fullscreen when any .js-restore is clicked ===
document.querySelectorAll('.js-restore').forEach(el => {
el.style.cursor = 'pointer';
el.addEventListener('click', () => {
// first collapse header/footer and recalc container
2025-07-08 14:39:13 +02:00
exitFullscreen();
2025-07-08 17:16:57 +02:00
// then fade out and remove the iframe, fade content back
restoreOriginal();
// clear stored URL and reset browser address
2025-07-08 14:39:13 +02:00
currentIframeUrl = null;
history.replaceState(null, '', window.location.pathname);
2025-07-08 17:16:57 +02:00
});
2025-07-08 14:39:13 +02:00
});
2025-03-18 14:59:54 +01:00
});
/**
* Opens the current iframe URL in a new browser tab.
*/
function openIframeInNewTab() {
const params = new URLSearchParams(window.location.search);
const iframeUrl = params.get('iframe');
if (iframeUrl) {
window.open(iframeUrl, '_blank');
} else {
alert('No iframe is currently open.');
}
}
// expose globally so your templates onclick can find it
window.openIframeInNewTab = openIframeInNewTab;
// Adjust iframe height on window resize
window.addEventListener('resize', syncIframeHeight);
2025-07-07 23:40:35 +02:00
/**
* Observe iframe location changes (Same-Origin only).
*/
function observeIframeNavigation() {
const iframe = mainElement.querySelector("iframe");
if (!iframe || !iframe.contentWindow) return;
let lastUrl = iframe.contentWindow.location.href;
setInterval(() => {
try {
const currentUrl = iframe.contentWindow.location.href;
if (currentUrl !== lastUrl) {
lastUrl = currentUrl;
const newUrl = new URL(window.location);
newUrl.searchParams.set('iframe', currentUrl);
window.history.replaceState({}, '', newUrl);
}
} catch (e) {
// Cross-origin ignore
}
}, 500);
}
2025-07-08 14:39:13 +02:00
2025-07-08 17:16:57 +02:00
// Remember, open iframe, enter fullscreen, AND set the URL param immediately
2025-07-08 14:39:13 +02:00
document.querySelectorAll(".iframe-link").forEach(link => {
link.addEventListener("click", function(event) {
event.preventDefault();
currentIframeUrl = this.href;
2025-07-08 17:16:57 +02:00
2025-07-08 14:39:13 +02:00
enterFullscreen();
openIframe(currentIframeUrl);
2025-07-08 17:16:57 +02:00
// Update the browser URL right away
const newUrl = new URL(window.location);
newUrl.searchParams.set('iframe', currentIframeUrl);
window.history.replaceState({ iframe: currentIframeUrl }, '', newUrl);
2025-07-08 14:39:13 +02:00
});
});