feat: add webPreferences.enableRemoteModule option (#13028)

This commit is contained in:
Milan Burda 2018-10-13 19:50:07 +02:00 committed by Alexey Kuzmin
parent 72db5ed7cb
commit d3efc52745
36 changed files with 303 additions and 45 deletions

View file

@ -270,6 +270,8 @@ It creates a new `BrowserWindow` with native properties as set by the `options`.
are more limited. Read more about the option [here](sandbox-option.md).
**Note:** This option is currently experimental and may change or be
removed in future Electron releases.
* `enableRemoteModule` Boolean (optional) - Whether to enable the [`remote`](remote.md) module.
Default is `true`.
* `session` [Session](session.md#class-session) (optional) - Sets the session used by the
page. Instead of passing the Session object directly, you can also choose to
use the `partition` option instead, which accepts a partition string. When

View file

@ -4,6 +4,9 @@
Process: [Main](../glossary.md#main-process), [Renderer](../glossary.md#renderer-process)
In the renderer process context it depends on the [`remote`](remote.md) module on Linux,
it is therefore not available when this module is disabled.
The following example shows how to write a string to the clipboard:
```javascript

View file

@ -24,6 +24,10 @@ win.loadURL('https://github.com')
**Note:** For the reverse (access the renderer process from the main process),
you can use [webContents.executeJavaScript](web-contents.md#contentsexecutejavascriptcode-usergesture-callback).
**Note:** The remote module can be disabled for security reasons in the following contexts:
- [`BrowserWindow`](browser-window.md) - by setting the `enableRemoteModule` option to `false`.
- [`<webview>`](webview-tag.md) - by setting the `enableremotemodule` attribute to `false`.
## Remote Objects
Each object (including functions) returned by the `remote` module represents an
@ -180,7 +184,7 @@ belongs.
**Note:** Do not use `removeAllListeners` on [`BrowserWindow`](browser-window.md).
Use of this can remove all [`blur`](https://developer.mozilla.org/en-US/docs/Web/Events/blur)
listeners, disable click events on touch bar buttons, and other unintended
consequences.
consequences.
### `remote.getCurrentWebContents()`

View file

@ -7,6 +7,9 @@ Process: [Main](../glossary.md#main-process), [Renderer](../glossary.md#renderer
You cannot require or use this module until the `ready` event of the `app`
module is emitted.
In the renderer process context it depends on the [`remote`](remote.md) module,
it is therefore not available when this module is disabled.
`screen` is an [EventEmitter](https://nodejs.org/api/events.html#events_class_eventemitter).
**Note:** In the renderer / DevTools, `window.screen` is a reserved DOM

View file

@ -126,6 +126,15 @@ integration and can use node APIs like `require` and `process` to access low
level system resources. Node integration is disabled by default in the guest
page.
### `enableremotemodule`
```html
<webview src="http://www.google.com/" enableremotemodule="false"></webview>
```
When this attribute is `false` the guest page in `webview` will not have access
to the [`remote`](remote.md) module. The remote module is avaiable by default.
### `plugins`
```html
@ -613,6 +622,9 @@ Shows pop-up dictionary that searches the selected word on the page.
Returns [`WebContents`](web-contents.md) - The web contents associated with
this `webview`.
It depends on the [`remote`](remote.md) module,
it is therefore not available when this module is disabled.
## DOM events
The following DOM events are available to the `webview` tag: