gru/rustpad
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

security upgrade

Browse Source
This commit is contained in:
Mateusz Gruszczyński
2026-07-30 09:57:43 +02:00
parent 2274cf57c9
commit f6b8e016a8
24 changed files with 1100 additions and 272 deletions
Download Patch File Download Diff File Expand all files Collapse all files
static/js/workspace.js
+8 -12
View File
@@ -24,7 +24,6 @@ let info;
const shareToken = new URLSearchParams(location.search).get("share");
let accessToken = shareToken || getAccessToken("workspace", slug);
let nickname = getNickname();
if (shareToken) setAccessToken("workspace", slug, shareToken);
const dialog = document.querySelector("#password-dialog");
const identityDialog = document.querySelector("#identity-dialog");
const workspaceContent = document.querySelector("#workspace-content");
@@ -136,11 +135,11 @@ async function openWorkspace() {
}
async function init() {
try {
const headers = accessToken ? { Authorization: `Bearer ${accessToken}` } : {};
const headers = accessToken && accessToken !== "cookie" ? { Authorization: `Bearer ${accessToken}` } : {};
info = await api(`/api/workspaces/${encodeURIComponent(slug)}`, { headers });
document.querySelector("#workspace-title").textContent = info.title;
document.querySelector("#workspace-url").textContent = location.pathname;
if (info.protected && !accessToken) dialog.showModal(); else openWorkspace();
if (info.protected && !accessToken && !getAuthToken()) dialog.showModal(); else openWorkspace();
} catch (e) {
if (e.status === 403 || e.status === 404) await showSystemNotFound();
else document.querySelector("#workspace-error").textContent = e.message;
@@ -151,8 +150,8 @@ document.querySelector("#password-form").addEventListener("submit", async e => {
try {
const password = document.querySelector("#open-password").value;
const result = await api("/api/access-token", { method: "POST", body: JSON.stringify({ kind: "workspace", slug, password }) });
accessToken = result.access_token;
setAccessToken("workspace", slug, accessToken);
setAccessToken("workspace", slug, result.granted);
accessToken = getAccessToken("workspace", slug);
document.querySelector("#open-password").value = "";
document.querySelector("#password-error").textContent = "";
openWorkspace();
@@ -195,11 +194,8 @@ document.querySelector("#copy-workspace-link").addEventListener("click", async (
catch (e) { toast(e.message); }
});
async function startAuthorizedWorkspace() {
const hadAccountToken = Boolean(getAuthToken());
if (hadAccountToken) {
const session = await validateCurrentSession();
nickname = session?.nickname || getNickname();
}
const session = await validateCurrentSession();
nickname = session?.nickname || getNickname();
if (!nickname) {
workspaceContent.hidden = true;
@@ -207,7 +203,7 @@ async function startAuthorizedWorkspace() {
return;
}
accessToken = shareToken || getAuthToken() || getAccessToken("workspace", slug);
accessToken = shareToken || getAccessToken("workspace", slug);
workspaceContent.hidden = false;
await init();
}
@@ -216,7 +212,7 @@ bindIdentityDialog({
dialog: identityDialog,
onIdentity: async value => {
nickname = value;
accessToken = shareToken || getAuthToken() || getAccessToken("workspace", slug);
accessToken = shareToken || getAccessToken("workspace", slug);
workspaceContent.hidden = false;
await init();
},