|
|
@@ -21,10 +21,16 @@ module.exports = function sendToken (req, res, next) {
|
|
|
const state = (req.session.grant || {}).state
|
|
|
if (state) {
|
|
|
const origin = oAuthState.getFromState(state, 'origin', req.uppy.options.secret)
|
|
|
+ const clientVersion = oAuthState.getFromState(
|
|
|
+ state,
|
|
|
+ 'clientVersion',
|
|
|
+ req.uppy.options.secret
|
|
|
+ )
|
|
|
const allowedClients = req.uppy.options.clients
|
|
|
// if no preset clients then allow any client
|
|
|
if (!allowedClients || hasMatch(origin, allowedClients) || hasMatch(parseUrl(origin).host, allowedClients)) {
|
|
|
- return res.send(htmlContent(uppyAuthToken, origin))
|
|
|
+ // @todo do a more secure client version check, see https://www.npmjs.com/package/semver
|
|
|
+ return res.send(clientVersion ? htmlContent(uppyAuthToken, origin) : oldHtmlContent(uppyAuthToken, origin))
|
|
|
}
|
|
|
}
|
|
|
next()
|
|
|
@@ -49,3 +55,23 @@ const htmlContent = (token, origin) => {
|
|
|
<body></body>
|
|
|
</html>`
|
|
|
}
|
|
|
+
|
|
|
+/**
|
|
|
+ * @todo remove this function in next major release
|
|
|
+ * @param {string} token uppy auth token
|
|
|
+ * @param {string} origin url string
|
|
|
+ */
|
|
|
+const oldHtmlContent = (token, origin) => {
|
|
|
+ return `
|
|
|
+ <!DOCTYPE html>
|
|
|
+ <html>
|
|
|
+ <head>
|
|
|
+ <meta charset="utf-8" />
|
|
|
+ <script>
|
|
|
+ window.opener.postMessage({token: "${token}"}, "${sanitizeHtml(origin)}")
|
|
|
+ window.close()
|
|
|
+ </script>
|
|
|
+ </head>
|
|
|
+ <body></body>
|
|
|
+ </html>`
|
|
|
+}
|
Ifedapo .A. Olarewaju