Fabio/tileserver-gl
1
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions

fix: update data viewer against XSS

Browse source 
Signed-off-by: Michael Nutt <michael@nuttnet.net>
This commit is contained in:
Michael Nutt 2023-01-17 23:22:02 -05:00 committed by Andrew Calcutt
parent ce36be810e
commit 072b1d2fad
2 changed files with 13 additions and 6 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

10
public/templates/data.tmpl
View file

@ -35,6 +35,9 @@
<div id="layerList"></div> <div id="layerList"></div>
<pre id="propertyList"></pre> <pre id="propertyList"></pre>
<script> <script>
var keyMatch = location.search.match(/[\?\&]key=([^&]+)/i);
var keyParam = keyMatch ? '?key=' + keyMatch[1] : '';
var map = new maplibregl.Map({ var map = new maplibregl.Map({
container: 'map', container: 'map',
hash: true, hash: true,
@ -44,7 +47,7 @@
sources: { sources: {
'vector_layer_': { 'vector_layer_': {
type: 'vector', type: 'vector',
url: '{{public_url}}data/{{id}}.json{{&key_query}}' url: '{{public_url}}data/{{id}}.json' + keyParam
} }
}, },
layers: [] layers: []
@ -76,11 +79,14 @@
<h1 style="display:none;">{{name}}</h1> <h1 style="display:none;">{{name}}</h1>
<div id='map'></div> <div id='map'></div>
<script> <script>
var keyMatch = location.search.match(/[\?\&]key=([^&]+)/i);
var keyParam = keyMatch ? '?key=' + keyMatch[1] : '';
var map = L.map('map', { zoomControl: false }); var map = L.map('map', { zoomControl: false });
new L.Control.Zoom({ position: 'topright' }).addTo(map); new L.Control.Zoom({ position: 'topright' }).addTo(map);
var tile_urls = [], tile_attribution, tile_minzoom, tile_maxzoom; var tile_urls = [], tile_attribution, tile_minzoom, tile_maxzoom;
var url = '{{public_url}}data/{{id}}.json{{&key_query}}'; var url = '{{public_url}}data/{{id}}.json' + keyParam;
var req = new XMLHttpRequest(); var req = new XMLHttpRequest();
req.overrideMimeType("application/json"); req.overrideMimeType("application/json");
req.open('GET', url, true); req.open('GET', url, true);

9
public/templates/viewer.tmpl
View file

@ -26,14 +26,15 @@
q.indexOf('vector') >= 0 ? 'vector' : q.indexOf('vector') >= 0 ? 'vector' :
(q.indexOf('raster') >= 0 ? 'raster' : (q.indexOf('raster') >= 0 ? 'raster' :
(maplibregl.supported() ? 'vector' : 'raster')); (maplibregl.supported() ? 'vector' : 'raster'));
var keyMatch = location.search.match(/[\?\&]key=([^&]+)/i); var keyMatch = location.search.match(/[\?\&]key=([^&]+)/i);
var key = keyMatch ? '?key=' + keyMatch[1] : ''; var keyParam = keyMatch ? '?key=' + keyMatch[1] : '';
if (preference == 'vector') { if (preference == 'vector') {
maplibregl.setRTLTextPlugin('{{public_url}}mapbox-gl-rtl-text.js' + key); maplibregl.setRTLTextPlugin('{{public_url}}mapbox-gl-rtl-text.js' + keyParam);
var map = new maplibregl.Map({ var map = new maplibregl.Map({
container: 'map', container: 'map',
style: '{{public_url}}styles/{{id}}/style.json' + key, style: '{{public_url}}styles/{{id}}/style.json' + keyParam,
hash: true, hash: true,
maplibreLogo: true maplibreLogo: true
}); });
@ -52,7 +53,7 @@
new L.Control.Zoom({ position: 'topright' }).addTo(map); new L.Control.Zoom({ position: 'topright' }).addTo(map);
var tile_urls = [], tile_attribution, tile_minzoom, tile_maxzoom; var tile_urls = [], tile_attribution, tile_minzoom, tile_maxzoom;
var url = '{{public_url}}styles/{{id}}.json' + key; var url = '{{public_url}}styles/{{id}}.json' + keyParam;
var req = new XMLHttpRequest(); var req = new XMLHttpRequest();
req.overrideMimeType("application/json"); req.overrideMimeType("application/json");
req.open('GET', url, true); req.open('GET', url, true);