Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom

FileSummary (filelist) uses JS Eval #11030

Closed
rullzer opened this issue Sep 3, 2018 · 5 comments
Closed

FileSummary (filelist) uses JS Eval #11030

rullzer opened this issue Sep 3, 2018 · 5 comments
Labels
1. to develop Accepted and waiting to be taken care of enhancement
Milestone
Nextcloud 15

Comments

@rullzer
Copy link
Member

rullzer commented Sep 3, 2018

For https://github.com/orgs/nextcloud/projects/18

The FileSummary uses handlebars and compiles the templates on the fly. This prevents a stricter CSP.
@rullzer
Copy link
Member Author

rullzer commented Sep 3, 2018

@nextcloud/javascript seems that the simplest thing here is just moving this to plain javascript. Converting to vue will happen when the whole fiellist is moved to vue.

For now just moving it to plain js is probably easiest and quickest.

@rullzer rullzer added enhancement 1. to develop Accepted and waiting to be taken care of labels Sep 3, 2018
@rullzer rullzer added this to the Nextcloud 15 milestone Sep 3, 2018
@nextcloud-bot

This comment has been minimized.

Sign in to view
This was referenced Sep 3, 2018
Closed
Closed
@blizzz
Copy link
Member

blizzz commented Sep 3, 2018

thus, handlebars tempalte compilation in general is evil?

@rullzer
Copy link
Member Author

rullzer commented Sep 3, 2018

thus, handlebars tempalte compilation in general is evil?

@blizzz not by definition. Unsafe eval is evil 😉 . You can also compile your templates and upload the compiled js and use the templates then.

@blizzz
Copy link
Member

blizzz commented Sep 4, 2018

we didn't do ship precompiled templates because $forgotten_issues

rullzer added a commit that referenced this issue Sep 27, 2018
@rullzer
Compile filesummary handlebars
b30be56 
Fixes #11030
For https://github.com/orgs/nextcloud/projects/18

This template is now compiled so this no longer has to happen in the
browser. Another step towards a stricter CSP.

Signed-off-by: Roeland Jago Douma <roeland@famdouma.nl>
@rullzer rullzer mentioned this issue Sep 27, 2018
Merged
rullzer added a commit that referenced this issue Sep 27, 2018
@rullzer
Compile filesummary handlebars
ae1250f 
Fixes #11030
For https://github.com/orgs/nextcloud/projects/18

This template is now compiled so this no longer has to happen in the
browser. Another step towards a stricter CSP.

Signed-off-by: Roeland Jago Douma <roeland@famdouma.nl>
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Assignees
No one assigned
Labels
1. to develop Accepted and waiting to be taken care of enhancement
Projects
None yet
Milestone
Nextcloud 15
Development

No branches or pull requests
3 participants
@rullzer @blizzz @nextcloud-bot