From 52019dc763f652e5037f615b0c7ee19b9c4d20a1 Mon Sep 17 00:00:00 2001
From: ansuz <ansuz@transitiontech.ca>
Date: Thu, 31 Aug 2017 18:02:44 +0200
Subject: [PATCH] make get and set pad attribute return only cloned data

---
 www/common/userObject.js | 9 +++++++--
 1 file changed, 7 insertions(+), 2 deletions(-)

diff --git a/www/common/userObject.js b/www/common/userObject.js
index 431e9c9dc..8317728a0 100644
--- a/www/common/userObject.js
+++ b/www/common/userObject.js
@@ -9,6 +9,11 @@ define([
     var TRASH = module.TRASH = "trash";
     var TEMPLATE = module.TEMPLATE = "template";
 
+    var clone = function (o) {
+        try { return JSON.parse(JSON.stringify(o)); }
+        catch (e) { return undefined; }
+    };
+
     module.init = function (files, config) {
         var exp = {};
         var Cryptpad = config.Cryptpad;
@@ -137,7 +142,7 @@ define([
             var id = exp.getIdFromHref(href);
             if (!id) { return void cb(null, undefined); }
             var data = getFileData(id);
-            cb(null, data[attr]);
+            cb(null, clone(data[attr]));
         };
         exp.setAttribute = function (href, attr, value, cb) {
             cb = cb || $.noop;
@@ -145,7 +150,7 @@ define([
             if (!id) { return void cb("E_INVAL_HREF"); }
             if (!attr || !attr.trim()) { return void cb("E_INVAL_ATTR"); }
             var data = getFileData(id);
-            data[attr] = value;
+            data[attr] = clone(value);
         };
 
         // PATHS