Ajaxify Cors section in Personal settings #37560
Conversation
|
Thanks for opening this pull request! The maintainers of this repository would appreciate it if you would create a changelog item based on your changes. |
VicDeo
force-pushed
the
bugfix/e4050
branch
4 times, most recently
from
0be3ced to
b4ee363
Compare
VicDeo
changed the title
VicDeo
force-pushed
the
bugfix/e4050
branch
3 times, most recently
from
0b8d577 to
03eab90
Compare
Codecov Report
@@ Coverage Diff @@
## master #37560 +/- ##
============================================
+ Coverage 64.66% 64.69% +0.03%
- Complexity 19343 19345 +2
============================================
Files 1279 1279
Lines 75600 75589 -11
Branches 1333 1333
============================================
+ Hits 48885 48902 +17
+ Misses 26323 26295 -28
Partials 392 392
Continue to review full report at Codecov.
|
VicDeo
force-pushed
the
bugfix/e4050
branch
2 times, most recently
from
b54a7c4 to
3bcc4bd
Compare
|
@VicDeo can you point to the Support case? |
| \array_push($domains, $domain); | ||
|
|
||
| // In case same domain is added | ||
| $domains = \array_unique($domains); |
There was a problem hiding this comment.
If the initial domain list is already sanitized, an in_array(...) check should be faster to know if the domain is there.
If we don't trust the list is sanitized, we should assume the same in every place where we're retrieving the list from the user's preferences (removeDomain function would just remove one domain, but not the duplicates, if any)
There was a problem hiding this comment.
I didn't touch this code - just wrapped it with if condition https://github.com/owncloud/core/pull/37560/files?w=1
In addition it is not something that expected to have millions of domains and to be used on daily basis.
settings/js/panels/cors.js
Outdated
| @@ -1,33 +1,67 @@ | |||
| var PersonalCors = { | |||
| renderRow: function(domain){ | |||
| var row = $('<tr />').appendTo('#cors .grid tbody'); | |||
There was a problem hiding this comment.
Maybe something like var htmlRow = '<tr><td>' + domain + '</td><td><input ..... /></td></tr>' (with a readable format) is easier to follow?
Then just $('#cors .grid tbody').append(htmlRow);
There was a problem hiding this comment.
nope, what if domain contains <script>alert(1)</script>
There was a problem hiding this comment.
Well, I'd expect the domain to be sanitized at that point... 😅
Maybe...
var row = $('<tr></tr>')
.append($('<td></td>').text(domain))
.append('<td><input ..... /></td>')
$('#cors .grid tbody').append(row);
or maybe
var col1 = $('<td></td>').text(domain);
var col2 = '<td><input .... /></td>';
var row = $('<tr></tr>').append(col1).append(col2);
$('#cors .grid tbody').append(row);
anyway, up to you.
There was a problem hiding this comment.
There is only one requested change for readability, but not critical. Up to @VicDeo to decide
Description
CORS section silently fail when a new domain is incorrect
Motivation and Context
How Has This Been Tested?
Expected
Domain is not added, Error message
Actual
Domain is not added, No error message
Screenshot
Types of changes
Checklist: