haskal
/
jiti-meet
1
0
Fork 0
Code Issues Pull Requests Packages Projects Releases Wiki Activity

Merge pull request #847 from jitsi/cs-custom-scriptUrl 

Skips some url parameters that can inject scripts.
This commit is contained in:
Paweł Domas 2016-09-08 18:09:04 -05:00 committed by GitHub
parent 62c4ff719e d65479abc9
commit 9a0d8616ed
1 changed files with 6 additions and 0 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

6
modules/config/URLProcessor.js
View File

@ -36,6 +36,12 @@ var URLProcessor = {
if (key.indexOf("config.") === 0) { if (key.indexOf("config.") === 0) {
confObj = configJSON.config; confObj = configJSON.config;
confKey = key.substr("config.".length); confKey = key.substr("config.".length);
// prevent passing some parameters which can inject scripts
if (confKey === 'analyticsScriptUrl'
|| confKey === 'callStatsCustomScriptUrl')
continue;
} else if (key.indexOf("interfaceConfig.") === 0) { } else if (key.indexOf("interfaceConfig.") === 0) {
confObj = configJSON.interfaceConfig; confObj = configJSON.interfaceConfig;
confKey = key.substr("interfaceConfig.".length); confKey = key.substr("interfaceConfig.".length);