Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

IVYPORTAL-18029 High - Client-side cross-site scripting #1307

Merged
merged 3 commits into from
Dec 16, 2024
+38 −29
Merged

IVYPORTAL-18029 High - Client-side cross-site scripting #1307

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
3 commits
Select commit Hold shift + click to select a range
6b4aa0a
IVYPORTAL-18029 High - Client-side cross-site scripting
mnhnam-axonivy Dec 16, 2024
c8474f3
IVYPORTAL-18029 High - Client-side cross-site scripting
mnhnam-axonivy Dec 16, 2024
960f088
IVYPORTAL-18029 High - Client-side cross-site scripting
mnhnam-axonivy Dec 16, 2024
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
7 changes: 7 additions & 0 deletions AxonIvyPortal/portal/src/ch/ivy/addon/portal/generic/bean/IFrameTaskTemplateBean.java
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -54,6 +54,7 @@ public class IFrameTaskTemplateBean extends AbstractTaskTemplateBean implements
public static final String PORTAL_GROWL_MESSGE_PARAM = "portalGrowlMessage";
private static final String DEFAULT_TASK_ICON = "si si-task-list-edit";
private static final String TASK_ICON = "taskIcon";
private static final String TASK_URL = "taskUrl";

private int currentProcessStep;
private List<String> processSteps;
Expand All @@ -74,6 +75,12 @@ public class IFrameTaskTemplateBean extends AbstractTaskTemplateBean implements

private Long caseId = null;

public String getTaskUrl() {
return Optional.ofNullable(FacesContext.getCurrentInstance()
.getExternalContext().getRequestParameterMap().get(TASK_URL))
.orElse(StringUtils.EMPTY);
}

public void useTaskInIFrame() {
keepOverridePortalGrowl();
Map<String, String> requestParamMap = getRequestParameterMap();
Expand Down
49 changes: 31 additions & 18 deletions AxonIvyPortal/portal/webContent/layouts/restricted/IFrameTaskTemplate.xhtml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -70,24 +70,24 @@
**2. JavaScript-Based Configuration:**
Example:
<script>
window.taskName = "Approve Investment";
window.taskIcon = "si si-bulb";
window.isHideTaskName = false;
window.caseId = "123456";
window.isHideCaseInfo = false;
window.currentProcessStep = 0;
window.processSteps = ["Create Investment Request", "Approve Investment Request"];
// Convert Java List of steps to JSON format if needed:
window.processSteps = #{portalComponentUtilsBean.convertToJSON(data.steps)};
window.isShowAllSteps = true;
window.processChainDirection = "VERTICAL";
window.processChainShape = "LINE";
window.isHideTaskAction = false;
window.isWorkingOnATask = false;
window.announcementInvisible = false;
window.isCardFrame = true;
window.viewName = "TASK_DETAIL";
</script>
window.taskName = "Approve Investment";
window.taskIcon = "si si-bulb";
window.isHideTaskName = false;
window.caseId = "123456";
window.isHideCaseInfo = false;
window.currentProcessStep = 0;
window.processSteps = ["Create Investment Request", "Approve Investment Request"];
// Convert Java List of steps to JSON format if needed:
window.processSteps = #{portalComponentUtilsBean.convertToJSON(data.steps)};
window.isShowAllSteps = true;
window.processChainDirection = "VERTICAL";
window.processChainShape = "LINE";
window.isHideTaskAction = false;
window.isWorkingOnATask = false;
window.announcementInvisible = false;
window.isCardFrame = true;
window.viewName = "TASK_DETAIL";
</script>
-->


Expand All @@ -113,6 +113,19 @@
<ui:param name="taskIcon" value="#{iFrameTaskTemplateBean.taskIcon}" />

<ui:define name="content">
<script>
$(document).ready(function() {
var taskUrl = '#{iFrameTaskTemplateBean.taskUrl}';
if (taskUrl){
if(taskUrl.endsWith('blank')){
window.history.back(document.referrer);
}
getPortalIframe().src = taskUrl;
}

loadIframe(false);
});
</script>
<h:form>
<p:remoteCommand name="redirectToEndPageCommand" actionListener="#{iFrameTaskTemplateBean.navigateToEndPage()}" />
<p:remoteCommand name="displayPortalGrowlMessageCommand" actionListener="#{iFrameTaskTemplateBean.displayPortalGrowlMessage()}" />
Expand Down
11 changes: 0 additions & 11 deletions AxonIvyPortal/portal/webContent/resources/js/iframe-task-template.js
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -1,16 +1,5 @@
var invalidIFrameSrcPath = false;

let taskUrl = new URLSearchParams(window.location.search).get("taskUrl");
let updateIframeSrc = (newSrc) => {
getPortalIframe().src = newSrc;
}
if (taskUrl){
if(taskUrl.endsWith('blank')){
window.history.back(document.referrer);
}
updateIframeSrc(taskUrl)
}
loadIframe(false);
var recheckFrameTimer;
function loadIframe(recheckIndicator) {
var iframe = getPortalIframe();
Expand Down
Loading