From 2877bb5a6a869769ac0c2fe345aafde2687b81c7 Mon Sep 17 00:00:00 2001 From: Simon L Date: Thu, 18 Jan 2024 10:24:51 +0100 Subject: [PATCH 1/2] disable scripting in pdfviewer Signed-off-by: Simon L --- README.md | 10 ++++++++++ src/workersrc.js | 2 ++ templates/viewer.php | 6 ++++++ 3 files changed, 18 insertions(+) diff --git a/README.md b/README.md index c6439a0e..8f48b5e1 100644 --- a/README.md +++ b/README.md @@ -4,6 +4,16 @@ files_pdfviewer This application integrates the [PDF.js](https://mozilla.github.io/pdf.js/) library into Nextcloud's Viewer. You can view PDF files as well as Adobe Illustrator files (.ai) +### Enable Javascript execution in PDF files + +To allow Javascript embedded in PDF-files to be executed inside the PDF-viewer inside your browser, enable it with: + +`php occ config:app:set files_pdfviewer enable_scripting --value=yes` + +Disable: + +`php occ config:app:delete files_pdfviewer enable_scripting` + ## 🏗 Development setup 1. ☁ Clone this app into the `apps` folder of your Nextcloud: `git clone https://github.com/nextcloud/files_pdfviewer.git` diff --git a/src/workersrc.js b/src/workersrc.js index 240f0373..c08651e4 100644 --- a/src/workersrc.js +++ b/src/workersrc.js @@ -50,6 +50,8 @@ function initializeCustomPDFViewerApplication() { PDFViewerApplicationOptions.set('workerSrc', document.getElementsByTagName('head')[0].getAttribute('data-workersrc')) PDFViewerApplicationOptions.set('cMapUrl', document.getElementsByTagName('head')[0].getAttribute('data-cmapurl')) PDFViewerApplicationOptions.set('enablePermissions', true) + PDFViewerApplicationOptions.set('sandboxBundleSrc', document.getElementsByTagName('head')[0].getAttribute('data-sandbox')) + PDFViewerApplicationOptions.set('enableScripting', document.getElementsByTagName('head')[0].getAttribute('data-enableScripting') === true) if (canDownload === '0') { const pdfViewer = window.document.querySelector('.pdfViewer') diff --git a/templates/viewer.php b/templates/viewer.php index 769cdab3..22ce52c0 100644 --- a/templates/viewer.php +++ b/templates/viewer.php @@ -3,6 +3,10 @@ /** @var OCP\IURLGenerator $urlGenerator */ $urlGenerator = $_['urlGenerator']; $version = \OC::$server->getAppManager()->getAppVersion('files_pdfviewer'); + $enableScripting = false; + if (\OC::$server->getConfig()->getAppValue('files_pdfviewer', 'enable_scripting', 'no') === 'yes') { + $enableScripting = true; + } ?> @@ -29,6 +33,8 @@ --> From c46ea287b7c6e065ad62e252742d190bd5d9387d Mon Sep 17 00:00:00 2001 From: nextcloud-command Date: Thu, 18 Jan 2024 10:16:44 +0000 Subject: [PATCH 2/2] chore(assets): Recompile assets Signed-off-by: nextcloud-command --- js/files_pdfviewer-workersrc.js | 4 ++-- js/files_pdfviewer-workersrc.js.map | 2 +- 2 files changed, 3 insertions(+), 3 deletions(-) diff --git a/js/files_pdfviewer-workersrc.js b/js/files_pdfviewer-workersrc.js index 718b3d8e..7ebc6410 100644 --- a/js/files_pdfviewer-workersrc.js +++ b/js/files_pdfviewer-workersrc.js @@ -1,3 +1,3 @@ /*! For license information please see files_pdfviewer-workersrc.js.LICENSE.txt */ -(()=>{var t={2200:(t,e,r)=>{"use strict";Object.defineProperty(e,"__esModule",{value:!0}),Object.defineProperty(e,"getRequestToken",{enumerable:!0,get:function(){return n.getRequestToken}}),Object.defineProperty(e,"onRequestTokenUpdate",{enumerable:!0,get:function(){return n.onRequestTokenUpdate}}),Object.defineProperty(e,"getCurrentUser",{enumerable:!0,get:function(){return o.getCurrentUser}});var n=r(1894),o=r(1618)},1894:(t,e,r)=>{"use strict";var n=r(5108);r(9554),Object.defineProperty(e,"__esModule",{value:!0}),e.getRequestToken=function(){return a},e.onRequestTokenUpdate=function(t){c.push(t)};var o=r(2089),i=document.getElementsByTagName("head")[0],a=i?i.getAttribute("data-requesttoken"):null,c=[];(0,o.subscribe)("csrf-token-update",(function(t){a=t.token,c.forEach((function(e){try{e(t.token)}catch(t){n.error("error updating CSRF token observer",t)}}))}))},1618:(t,e)=>{"use strict";Object.defineProperty(e,"__esModule",{value:!0}),e.getCurrentUser=function(){if(null===n)return null;return{uid:n,displayName:i,isAdmin:a}};var r=document.getElementsByTagName("head")[0],n=r?r.getAttribute("data-user"):null,o=document.getElementsByTagName("head")[0],i=o?o.getAttribute("data-user-displayname"):null,a="undefined"!=typeof OC&&OC.isUserAdmin()},2089:(t,e,r)=>{"use strict";r.r(e),r.d(e,{emit:()=>Ho,subscribe:()=>Wo,unsubscribe:()=>Xo});var n=r(4155),o=r(5108),i="undefined"!=typeof globalThis?globalThis:"undefined"!=typeof window?window:void 0!==r.g?r.g:"undefined"!=typeof self?self:{};function a(t){var e={exports:{}};return t(e,e.exports),e.exports}var c=function(t){return t&&t.Math==Math&&t},u=c("object"==typeof globalThis&&globalThis)||c("object"==typeof window&&window)||c("object"==typeof self&&self)||c("object"==typeof i&&i)||function(){return this}()||Function("return this")(),s=function(t){try{return!!t()}catch(t){return!0}},f=!s((function(){return 7!=Object.defineProperty({},1,{get:function(){return 7}})[1]})),l={}.propertyIsEnumerable,p=Object.getOwnPropertyDescriptor,y={f:p&&!l.call({1:2},1)?function(t){var e=p(this,t);return!!e&&e.enumerable}:l},g=function(t,e){return{enumerable:!(1&t),configurable:!(2&t),writable:!(4&t),value:e}},h={}.toString,v=function(t){return h.call(t).slice(8,-1)},d="".split,b=s((function(){return!Object("z").propertyIsEnumerable(0)}))?function(t){return"String"==v(t)?d.call(t,""):Object(t)}:Object,m=function(t){if(null==t)throw TypeError("Can't call method on "+t);return t},E=function(t){return b(m(t))},O=function(t){return"object"==typeof t?null!==t:"function"==typeof t},w=function(t,e){if(!O(t))return t;var r,n;if(e&&"function"==typeof(r=t.toString)&&!O(n=r.call(t)))return n;if("function"==typeof(r=t.valueOf)&&!O(n=r.call(t)))return n;if(!e&&"function"==typeof(r=t.toString)&&!O(n=r.call(t)))return n;throw TypeError("Can't convert object to primitive value")},S=function(t){return Object(m(t))},A={}.hasOwnProperty,j=function(t,e){return A.call(S(t),e)},I=u.document,x=O(I)&&O(I.createElement),R=function(t){return x?I.createElement(t):{}},P=!f&&!s((function(){return 7!=Object.defineProperty(R("div"),"a",{get:function(){return 7}}).a})),T=Object.getOwnPropertyDescriptor,N={f:f?T:function(t,e){if(t=E(t),e=w(e,!0),P)try{return T(t,e)}catch(t){}if(j(t,e))return g(!y.f.call(t,e),t[e])}},L=function(t){if(!O(t))throw TypeError(String(t)+" is not an object");return t},k=Object.defineProperty,F={f:f?k:function(t,e,r){if(L(t),e=w(e,!0),L(r),P)try{return k(t,e,r)}catch(t){}if("get"in r||"set"in r)throw TypeError("Accessors not supported");return"value"in r&&(t[e]=r.value),t}},_=f?function(t,e,r){return F.f(t,e,g(1,r))}:function(t,e,r){return t[e]=r,t},D=function(t,e){try{_(u,t,e)}catch(r){u[t]=e}return e},M="__core-js_shared__",U=u[M]||D(M,{}),C=Function.toString;"function"!=typeof U.inspectSource&&(U.inspectSource=function(t){return C.call(t)});var G,B,q,V=U.inspectSource,$=u.WeakMap,z="function"==typeof $&&/native code/.test(V($)),W=a((function(t){(t.exports=function(t,e){return U[t]||(U[t]=void 0!==e?e:{})})("versions",[]).push({version:"3.11.2",mode:"global",copyright:"© 2021 Denis Pushkarev (zloirock.ru)"})})),X=0,H=Math.random(),Y=function(t){return"Symbol("+String(void 0===t?"":t)+")_"+(++X+H).toString(36)},J=W("keys"),K=function(t){return J[t]||(J[t]=Y(t))},Z={},Q="Object already initialized",tt=u.WeakMap;if(z){var et=U.state||(U.state=new tt),rt=et.get,nt=et.has,ot=et.set;G=function(t,e){if(nt.call(et,t))throw new TypeError(Q);return e.facade=t,ot.call(et,t,e),e},B=function(t){return rt.call(et,t)||{}},q=function(t){return nt.call(et,t)}}else{var it=K("state");Z[it]=!0,G=function(t,e){if(j(t,it))throw new TypeError(Q);return e.facade=t,_(t,it,e),e},B=function(t){return j(t,it)?t[it]:{}},q=function(t){return j(t,it)}}var at={set:G,get:B,has:q,enforce:function(t){return q(t)?B(t):G(t,{})},getterFor:function(t){return function(e){var r;if(!O(e)||(r=B(e)).type!==t)throw TypeError("Incompatible receiver, "+t+" required");return r}}},ct=a((function(t){var e=at.get,r=at.enforce,n=String(String).split("String");(t.exports=function(t,e,o,i){var a,c=!!i&&!!i.unsafe,s=!!i&&!!i.enumerable,f=!!i&&!!i.noTargetGet;"function"==typeof o&&("string"!=typeof e||j(o,"name")||_(o,"name",e),(a=r(o)).source||(a.source=n.join("string"==typeof e?e:""))),t!==u?(c?!f&&t[e]&&(s=!0):delete t[e],s?t[e]=o:_(t,e,o)):s?t[e]=o:D(e,o)})(Function.prototype,"toString",(function(){return"function"==typeof this&&e(this).source||V(this)}))})),ut=u,st=function(t){return"function"==typeof t?t:void 0},ft=function(t,e){return arguments.length<2?st(ut[t])||st(u[t]):ut[t]&&ut[t][e]||u[t]&&u[t][e]},lt=Math.ceil,pt=Math.floor,yt=function(t){return isNaN(t=+t)?0:(t>0?pt:lt)(t)},gt=Math.min,ht=function(t){return t>0?gt(yt(t),9007199254740991):0},vt=Math.max,dt=Math.min,bt=function(t){return function(e,r,n){var o,i=E(e),a=ht(i.length),c=function(t,e){var r=yt(t);return r<0?vt(r+e,0):dt(r,e)}(n,a);if(t&&r!=r){for(;a>c;)if((o=i[c++])!=o)return!0}else for(;a>c;c++)if((t||c in i)&&i[c]===r)return t||c||0;return!t&&-1}},mt={includes:bt(!0),indexOf:bt(!1)}.indexOf,Et=function(t,e){var r,n=E(t),o=0,i=[];for(r in n)!j(Z,r)&&j(n,r)&&i.push(r);for(;e.length>o;)j(n,r=e[o++])&&(~mt(i,r)||i.push(r));return i},Ot=["constructor","hasOwnProperty","isPrototypeOf","propertyIsEnumerable","toLocaleString","toString","valueOf"],wt=Ot.concat("length","prototype"),St={f:Object.getOwnPropertyNames||function(t){return Et(t,wt)}},At={f:Object.getOwnPropertySymbols},jt=ft("Reflect","ownKeys")||function(t){var e=St.f(L(t)),r=At.f;return r?e.concat(r(t)):e},It=function(t,e){for(var r=jt(e),n=F.f,o=N.f,i=0;ii;)F.f(t,r=n[i++],e[r]);return t},Bt=ft("document","documentElement"),qt=K("IE_PROTO"),Vt=function(){},$t=function(t){return"