mirrors/zotero
2
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions

Don't protect test endpoints

Browse source
This commit is contained in:
Dan Stillman 2019-07-15 08:11:56 -04:00
parent 2603373b86
commit 1cd4e50b59
1 changed files with 3 additions and 9 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

12
chrome/content/zotero/xpcom/server.js
View file

@ -422,15 +422,7 @@ Zotero.Server.DataListener.prototype._processEndpoint = Zotero.Promise.coroutine
// Reject browser-based requests that don't require a CORS preflight request [1] if they
// don't come from the connector or include Zotero-Allowed-Request
//
// Endpoints that can be triggered with a simple request can be whitelisted if they don't
// trigger any actions
//
// [1] https://developer.mozilla.org/en-US/docs/Web/HTTP/CORS#Simple_requests
var whitelistedEndpoints = [
'/test/translate/test.html',
'/test/translate/test.pdf',
'/test/translate/does_not_exist.html',
];
var simpleRequestContentTypes = [
'application/x-www-form-urlencoded',
'multipart/form-data',
@ -446,7 +438,9 @@ Zotero.Server.DataListener.prototype._processEndpoint = Zotero.Promise.coroutine
&& (!endpoint.supportedDataTypes
|| endpoint.supportedDataTypes == '*'
|| endpoint.supportedDataTypes.some(type => simpleRequestContentTypes.includes(type)))
&& !whitelistedEndpoints.includes(this.pathname)
// Ignore test endpoints
&& !this.pathname.startsWith('/test/')
// Ignore content types that trigger preflight requests
&& !(this.contentType && !simpleRequestContentTypes.includes(this.contentType))) {
this._requestFinished(this._generateResponse(403, "text/plain", "Request not allowed\n"));
return;