From f33e061c9aa114fc9fb0e298e62dfa5a23bb3b3e Mon Sep 17 00:00:00 2001 From: ansuz Date: Wed, 10 Feb 2016 10:47:33 +0100 Subject: [PATCH] visit /hack/ to see what this is I'll leave it up to the users to decide whether XSS is a bug or a feature --- www/hack/index.html | 52 +++++++++++++++++++++++++++++++++++++++++++++ www/hack/main.js | 42 ++++++++++++++++++++++++++++++++++++ 2 files changed, 94 insertions(+) create mode 100644 www/hack/index.html create mode 100644 www/hack/main.js diff --git a/www/hack/index.html b/www/hack/index.html new file mode 100644 index 000000000..127ac6d1e --- /dev/null +++ b/www/hack/index.html @@ -0,0 +1,52 @@ + + + + + + + + + + + RUN + + + diff --git a/www/hack/main.js b/www/hack/main.js new file mode 100644 index 000000000..6bdb1f456 --- /dev/null +++ b/www/hack/main.js @@ -0,0 +1,42 @@ +define([ + '/api/config?cb=' + Math.random().toString(16).substring(2), + '/common/realtime-input.js', + '/common/messages.js', + '/common/crypto.js', + '/bower_components/jquery/dist/jquery.min.js', + '/customize/pad.js' +], function (Config, Realtime, Messages, Crypto) { + var $ = jQuery; + $(window).on('hashchange', function() { + window.location.reload(); + }); + if (window.location.href.indexOf('#') === -1) { + window.location.href = window.location.href + '#' + Crypto.genKey(); + return; + } + + var key = Crypto.parseKey(window.location.hash.substring(1)); + + var $textarea = $('textarea'), + $run = $('#run'); + + var rts = $textarea.toArray().map(function (e, i) { + var rt = Realtime.start(e, // window + Config.websocketURL, // websocketUrl + Crypto.rand64(8), // userName + key.channel, // channel + key.cryptKey); // cryptKey + return rt; + }); + + $run.click(function (e) { + e.preventDefault(); + var content = $textarea.val(); + + try { + eval(content); + } catch (err) { + alert(err.message); + } + }); +});