visit /hack/ to see what this is

I'll leave it up to the users to decide whether XSS is a bug or a feature
9 years ago · f33e061c9a
parent 019750bea8
commit f33e061c9a
2 changed files with 94 additions and 0 deletions
--- a/www/hack/index.html
+++ b/www/hack/index.html
@ -0,0 +1,52 @@
 <!DOCTYPE html>
 <html>
 <head>
    <meta content="text/html; charset=utf-8" http-equiv="content-type"/>
    <meta name="viewport" content="width=device-width, initial-scale=1.0"/>
    <script data-main="main" src="/bower_components/requirejs/require.js"></script>
    <style>
        html, body{
            padding: 0px;
            margin: 0px;
            overflow: hidden;
            box-sizing: border-box;
        }
        textarea{
            width: 100%;
            height: 100vh;
            max-width: 100%;
            max-height: 100vh;
            font-size: 30px;
            background-color: #073642;
            color: #839496;
            overflow-x: hidden;
            /* disallow textarea resizes */
            resize: none;
        }
        #run {
            position: fixed;
            top: 0px;
            right: 0px;
            z-index: 100;
            width: 5vw;
            height: 5vh;
            background-color: #222;
            color: #CCC;
            display: block;
            text-align: center;
        }
    </style>
 </head>
 <body>
    <textarea></textarea>
    <a href="#" id="run">RUN</a>
 </body>
 </html>
--- a/www/hack/main.js
+++ b/www/hack/main.js
@ -0,0 +1,42 @@
 define([
    '/api/config?cb=' + Math.random().toString(16).substring(2),
    '/common/realtime-input.js',
    '/common/messages.js',
    '/common/crypto.js',
    '/bower_components/jquery/dist/jquery.min.js',
    '/customize/pad.js'
 ], function (Config, Realtime, Messages, Crypto) { 
    var $ = jQuery;
    $(window).on('hashchange', function() {
        window.location.reload();
    });
    if (window.location.href.indexOf('#') === -1) {
        window.location.href = window.location.href + '#' + Crypto.genKey();
        return;
    }
    var key = Crypto.parseKey(window.location.hash.substring(1));
    var $textarea = $('textarea'),
        $run = $('#run');
    var rts = $textarea.toArray().map(function (e, i) {
        var rt = Realtime.start(e, // window
            Config.websocketURL, // websocketUrl
            Crypto.rand64(8), // userName
            key.channel, // channel
            key.cryptKey); // cryptKey
        return rt;
    });
    $run.click(function (e) {
        e.preventDefault();
        var content = $textarea.val();
        try {
            eval(content);
        } catch (err) {
            alert(err.message);
        }
    });
 });