Skip to content

Commit 6501996

Browse files
roland-droland-d
authored
Merge pull request #364 from dgrammatiko/patch-1
Drop jQuery, fix a number of XSS
2 parents 7d90255 + 8aad204 commit 6501996

File tree

5 files changed

+150
-128
lines changed

5 files changed

+150
-128
lines changed

‎administrator/components/com_patchtester/src/Controller/StartfetchController.php‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -70,7 +70,7 @@ public function execute($task): void
7070

7171
$testsModel = Factory::getApplication()->bootComponent('com_patchtester')->getMVCFactory()->createModel('Tests', 'Administrator', ['ignore_request' => true]);
7272
try {
73-
// Sanity check, ensure there aren't any applied patches
73+
// Sanity check, ensure there aren't any applied patches
7474
if (count($testsModel->getAppliedPatches()) >= 1) {
7575
$response = new JsonResponse(new \Exception(Text::_('COM_PATCHTESTER_ERROR_APPLIED_PATCHES'), 500));
7676
$this->app->sendHeaders();

‎administrator/components/com_patchtester/tmpl/fetch/default.php‎

Lines changed: 6 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -10,14 +10,18 @@
1010
use Joomla\CMS\Factory;
1111
use Joomla\CMS\HTML\HTMLHelper;
1212
use Joomla\CMS\Language\Text;
13+
use Joomla\CMS\WebAsset\WebAssetManager;
1314

1415
// phpcs:disable PSR1.Files.SideEffects
1516
\defined('_JEXEC') or die;
1617
// phpcs:enable PSR1.Files.SideEffects
1718

18-
HTMLHelper::_('jquery.framework');
19+
/** @var WebAssetManager $wa */
20+
$wa = $this->document->getWebAssetManager();
21+
$wa->useScript('com_patchtester.admin-fetcher-modal');
22+
1923
HTMLHelper::_('behavior.core');
20-
HTMLHelper::_('script', 'com_patchtester/fetcher.js', ['version' => 'auto', 'relative' => true]);
24+
//HTMLHelper::_('script', 'com_patchtester/fetcher.js', ['version' => 'auto', 'relative' => true]);
2125
Text::script('COM_PATCHTESTER_FETCH_AN_ERROR_HAS_OCCURRED');
2226

2327
?>

‎administrator/components/com_patchtester/tmpl/pulls/default.php‎

Lines changed: 5 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -11,15 +11,17 @@
1111
use Joomla\CMS\Language\Text;
1212
use Joomla\CMS\Layout\LayoutHelper;
1313
use Joomla\CMS\Router\Route;
14+
use Joomla\CMS\WebAsset\WebAssetManager;
1415

1516
// phpcs:disable PSR1.Files.SideEffects
1617
\defined('_JEXEC') or die;
1718
// phpcs:enable PSR1.Files.SideEffects
1819

19-
/** @var \Joomla\Component\Patchtester\Administrator\View\Pulls\PullsHtmlView $this */
20+
/** @var \Joomla\Component\Patchtester\Administrator\View\Pulls\HtmlView $this */
2021

21-
HTMLHelper::_('stylesheet', 'com_patchtester/octicons.css', ['version' => '3.5.0', 'relative' => true]);
22-
HTMLHelper::_('script', 'com_patchtester/patchtester.js', ['version' => 'auto', 'relative' => true]);
22+
/** @var WebAssetManager $wa */
23+
$wa = $this->document->getWebAssetManager();
24+
$wa->usePreset('com_patchtester.patchtester');
2325

2426
$listOrder = $this->escape($this->state->get('list.ordering'));
2527
$listDirn = $this->escape($this->state->get('list.direction'));

‎media/com_patchtester/joomla.asset.json‎

Lines changed: 40 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,40 @@
1+
{
2+
"$schema": "https://developer.joomla.org/schemas/json-schema/web_assets.json",
3+
"name": "com_patchtester",
4+
"version": "4.3.2",
5+
"description": "Joomla CMS",
6+
"license": "GPL-2.0-or-later",
7+
"assets": [
8+
{
9+
"name": "com_patchtester.admin-fetcher-modal",
10+
"type": "script",
11+
"uri": "com_patchtester/fetcher.js",
12+
"attributes": {
13+
"type": "module",
14+
"defer": true
15+
}
16+
},
17+
{
18+
"name": "com_patchtester.patchtester",
19+
"type": "script",
20+
"uri": "com_patchtester/patchtester.js",
21+
"attributes": {
22+
"type": "module",
23+
"defer": true
24+
}
25+
},
26+
{
27+
"name": "com_patchtester.octicons",
28+
"type": "style",
29+
"uri": "com_patchtester/octicons.css"
30+
},
31+
{
32+
"name": "com_patchtester.patchtester",
33+
"type": "preset",
34+
"dependencies": [
35+
"com_patchtester.patchtester#script",
36+
"com_patchtester.octicons#style"
37+
]
38+
}
39+
]
40+
}

‎media/com_patchtester/js/fetcher.js‎

Lines changed: 98 additions & 122 deletions
Original file line numberDiff line numberDiff line change
@@ -1,134 +1,110 @@
11
/**
22
* Patch testing component for the Joomla! CMS
33
*
4-
* @copyright Copyright (C) 2011 - 2012 Ian MacLennan, Copyright (C) 2013 - 2018 Open Source Matters, Inc. All rights reserved.
4+
* @copyright Copyright (C) 2023 Open Source Matters, Inc. All rights reserved.
55
* @license GNU General Public License version 2 or later
66
*/
77

8-
if (typeof jQuery === 'undefined') {
9-
throw new Error('PatchFetcher JavaScript requires jQuery')
10-
}
11-
128
if (typeof Joomla === 'undefined') {
139
throw new Error('PatchFetcher JavaScript requires the Joomla core JavaScript API')
1410
}
1511

16-
!function (jQuery, Joomla, window) {
17-
'use strict';
18-
19-
/**
20-
* Initialize the PatchFetcher object
21-
*
22-
* @constructor
23-
*/
24-
var PatchFetcher = function () {
25-
var offset = null,
26-
progress = null,
27-
path = 'index.php?option=com_patchtester&tmpl=component&format=json',
28-
lastPage = null,
29-
progressBar = jQuery('#progress-bar');
30-
31-
var initialize = function () {
32-
offset = 0;
33-
progress = 0;
34-
path = path + '&' + jQuery('#patchtester-token').attr('name') + '=1';
35-
36-
getRequest('startfetch');
37-
};
38-
39-
var getRequest = function (task) {
40-
jQuery.ajax({
41-
type: 'GET',
42-
url: path,
43-
data: `task=${task}.${task}`,
44-
dataType: 'json',
45-
success: function (response, textStatus, xhr) {
46-
try {
47-
if (response === null) {
48-
throw textStatus;
49-
}
50-
51-
if (response.error) {
52-
throw response;
53-
}
54-
55-
if (response.success === false) {
56-
throw response;
57-
}
58-
59-
// Store the last page if it is part of this request and not a boolean false
60-
if (typeof response.data.lastPage !== 'undefined' && response.data.lastPage !== false) {
61-
lastPage = response.data.lastPage;
62-
}
63-
64-
// Update the progress bar if we have the data to do so
65-
if (typeof response.data.page !== 'undefined') {
66-
progress = (response.data.page / lastPage) * 100;
67-
68-
if (progress < 100) {
69-
progressBar.css('width', progress + '%').attr('aria-valuenow', progress);
70-
} else {
71-
// Both BS2 and BS4 classes are targeted to keep this script simple
72-
progressBar
73-
.removeClass('bar-success bg-success')
74-
.addClass('bar-warning bg-warning')
75-
.css('width', progress + '%')
76-
.attr('aria-valuemin', 100)
77-
.attr('aria-valuemax', 200)
78-
.attr('aria-valuenow', progress);
79-
}
80-
}
81-
82-
jQuery('#patchtester-progress-message').html(response.message);
83-
84-
if (response.data.header) {
85-
jQuery('#patchtester-progress-header').html(response.data.header);
86-
}
87-
88-
if (!response.data.complete) {
89-
// Send another request
90-
getRequest('fetch');
91-
} else {
92-
jQuery('#progress').remove();
93-
jQuery('#modal-sync button.btn-close', window.parent.document).trigger('click');
94-
}
95-
} catch (error) {
96-
try {
97-
if (response.error || response.success === false) {
98-
jQuery('#patchtester-progress-header').text(Joomla.JText._('COM_PATCHTESTER_FETCH_AN_ERROR_HAS_OCCURRED'));
99-
jQuery('#patchtester-progress-message').html(response.message);
100-
}
101-
} catch (ignore) {
102-
if (error === '') {
103-
error = Joomla.JText._('COM_PATCHTESTER_NO_ERROR_RETURNED');
104-
}
105-
106-
jQuery('#patchtester-progress-header').text(Joomla.JText._('COM_PATCHTESTER_FETCH_AN_ERROR_HAS_OCCURRED'));
107-
jQuery('#patchtester-progress-message').html(error);
108-
jQuery('#progress').remove();
109-
}
110-
}
111-
return true;
112-
},
113-
error: function (jqXHR, textStatus, errorThrown) {
114-
var json = (typeof jqXHR === 'object' && jqXHR.responseText) ? jqXHR.responseText : null;
115-
jQuery('#patchtester-progress-header').text(Joomla.JText._('COM_PATCHTESTER_FETCH_AN_ERROR_HAS_OCCURRED'));
116-
jQuery('#patchtester-progress-message').html(json);
117-
jQuery('#progress').remove();
118-
}
119-
});
120-
};
121-
122-
initialize();
123-
};
124-
125-
jQuery(function () {
126-
new PatchFetcher();
127-
128-
if (typeof window.parent.SqueezeBox === 'object') {
129-
jQuery(window.parent.SqueezeBox).on('close', function () {
130-
window.parent.location.reload(true);
131-
});
12+
const defaultSettings = {
13+
progress: null,
14+
lastPage: null,
15+
baseURL: `${Joomla.getOptions('system.paths').baseFull}index.php?option=com_patchtester&tmpl=component&format=json`,
16+
};
17+
18+
class PatchFetcher {
19+
constructor(settings = defaultSettings) {
20+
this.url = new URL(settings.baseURL);
21+
this.progress = settings.progress;
22+
this.lastPage = settings.lastPage;
23+
24+
this.progressBar = document.getElementById('progress-bar');
25+
this.url.searchParams.append(document.getElementById('patchtester-token').getAttribute('name'), 1);
26+
27+
this.request('startfetch');
28+
}
29+
30+
request(task) {
31+
this.url.searchParams.append('task', `${task}.${task}`);
32+
33+
Joomla.request({
34+
url: this.url.toString(),
35+
method: 'GET',
36+
headers: { 'Content-Type': 'application/json' },
37+
perform: true,
38+
onSuccess: (response) => {
39+
response = JSON.parse(response)
40+
try {
41+
if (response === null || response.error || response.success === false) {
42+
throw response;
43+
}
44+
// {"success":true,"message":"Processing page 1 of GitHub data","messages":null,"data":{"complete":false,"header":"Processing data from GitHub"}}
45+
// Store the last page if it is part of this request and not a boolean false
46+
if (typeof response.data.lastPage !== 'undefined' && response.data.lastPage !== false) {
47+
this.lastPage = response.data.lastPage;
48+
}
49+
50+
// Update the progress bar if we have the data to do so
51+
if (typeof response.data.page !== 'undefined') {
52+
this.progress = (response.data.page / this.lastPage) * 100;
53+
54+
if (this.progress < 100) {
55+
this.progressBar.style.width = `${this.progress}%`;
56+
this.progressBar.setAttribute('aria-valuenow', this.progress);
57+
} else {
58+
// Both BS2 and BS4 classes are targeted to keep this script simple
59+
this.progressBar.classList.remove(['bar-success', 'bg-success']);
60+
this.progressBar.classList.remove(['bar-warning', 'bg-warning']);
61+
this.progressBar.style.width = `${this.progress}%`;
62+
this.progressBar.setAttribute('aria-valuemin', 100);
63+
this.progressBar.setAttribute('aria-valuemax', 200);
64+
this.progressBar.setAttribute('aria-valuenow', this.progress);
65+
}
66+
}
67+
68+
document.getElementById('patchtester-progress-message').innerHTML = Joomla.sanitizeHtml(response.message);
69+
70+
if (response.data.header) {
71+
document.getElementById('patchtester-progress-header').innerHTML = Joomla.sanitizeHtml(response.data.header);
72+
}
73+
74+
if (!response.data.complete) {
75+
this.url.searchParams.append(document.querySelector('#patchtester-token').getAttribute('name'), 1);
76+
this.url.searchParams.append('task', `${task}.${task}`);
77+
this.request('fetch');
78+
} else {
79+
document.getElementById('progress').remove();
80+
window.parent.document.querySelector('#modal-sync button.btn-close').click();
81+
}
82+
} catch (error) {
83+
try {
84+
if (response.error || response.success === false) {
85+
document.getElementById('patchtester-progress-header').innerText(Joomla.JText._('COM_PATCHTESTER_FETCH_AN_ERROR_HAS_OCCURRED'));
86+
document.getElementById('patchtester-progress-message').innerHTML = Joomla.sanitizeHtml(response.message);
87+
}
88+
} catch (ignore) {
89+
if (error === '') {
90+
error = Joomla.JText._('COM_PATCHTESTER_NO_ERROR_RETURNED');
91+
}
92+
93+
document.getElementById('patchtester-progress-header').innerText(Joomla.JText._('COM_PATCHTESTER_FETCH_AN_ERROR_HAS_OCCURRED'));
94+
document.getElementById('patchtester-progress-message').innerHTML = Joomla.sanitizeHtml(error);
95+
document.getElementById('progress').remove();
96+
}
13297
}
98+
return true;
99+
},
100+
onError: (jqXHR) => {
101+
const json = (typeof jqXHR === 'object' && jqXHR.responseText) ? jqXHR.responseText : null;
102+
document.getElementById('patchtester-progress-header').innerText(Joomla.JText._('COM_PATCHTESTER_FETCH_AN_ERROR_HAS_OCCURRED'));
103+
document.getElementById('patchtester-progress-message').innerHTML = Joomla.sanitizeHtml(json);
104+
document.getElementById('progress').remove();
105+
}
133106
});
134-
}(jQuery, Joomla, window);
107+
}
108+
}
109+
110+
new PatchFetcher();

0 commit comments

Comments
 (0)