kunthawat/moreminimore-chat
1
0
Fork 0
Code Issues Pull Requests Actions 4 Packages Projects Releases Wiki Activity

[privacy] remove arbitrary dashboard scripts

Browse Source
This commit is contained in:
Kunthawat Greethong
2026-08-16 02:35:17 +07:00
parent 19dc44969a
commit 364e72f3dd
4 changed files with 15 additions and 23 deletions
Download Patch File Download Diff File Expand all files Collapse all files

15
app/controllers/dashboard_controller.rb
View File

@@ -30,7 +30,6 @@ class DashboardController < ActionController::Base
before_action :set_application_pack
before_action :set_global_config
before_action :set_dashboard_scripts
around_action :switch_locale
before_action :ensure_installation_onboarding, only: [:index]
before_action :render_hc_if_custom_domain, only: [:index]
@@ -49,10 +48,6 @@ class DashboardController < ActionController::Base
@global_config = GlobalConfig.get(*GLOBAL_CONFIG_KEYS).slice(*GLOBAL_CONFIG_KEYS).merge(app_config)
end
def set_dashboard_scripts
@dashboard_scripts = sensitive_path? ? nil : GlobalConfig.get_value('DASHBOARD_SCRIPTS')
end
def ensure_installation_onboarding
redirect_to '/installation/onboarding' if ::Redis::Alfred.get(::Redis::Alfred::CHATWOOT_INSTALLATION_ONBOARDING)
end
@@ -109,14 +104,4 @@ class DashboardController < ActionController::Base
'dashboard'
end
end
def sensitive_path?
# dont load dashboard scripts on sensitive paths like password reset
sensitive_paths = [edit_user_password_path].freeze
# remove app prefix
current_path = request.path.gsub(%r{^/app}, '')
sensitive_paths.include?(current_path)
end
end

3
app/views/layouts/vueapp.html.erb
View File

@@ -70,8 +70,5 @@
<div id="app"></div>
<noscript id="noscript">This app works best with JavaScript enabled.</noscript>
<%= yield %>
<% if @dashboard_scripts.present? %>
<%= @dashboard_scripts.html_safe %>
<% end %>
</body>
</html>

5
config/installation_config.yml
View File

@@ -294,11 +294,6 @@
display_title: 'Clearbit API Key'
description: 'This API key is used for onboarding the users, to pre-fill account data.'
type: secret
- name: DASHBOARD_SCRIPTS
value:
display_title: 'Dashboard Scripts'
description: 'Scripts are loaded as the last item in the <body> tag'
type: code
- name: BLOCKED_EMAIL_DOMAINS
value:
display_title: 'Blocked Email Domains'

15
spec/controllers/dashboard_controller_spec.rb
View File

@@ -19,6 +19,21 @@ describe '/app/login', type: :request do
expect(response.body).not_to include('[REDACTED]')
end
it 'does not render configured dashboard scripts' do
allow(GlobalConfig).to receive(:get_value).and_call_original
allow(GlobalConfig).to receive(:get_value).with('DASHBOARD_SCRIPTS').and_return(
'<script src="https://tracker.invalid/x.js"></script>'
)
get '/app/login'
expect(response).to have_http_status(:success)
expect(response.body).not_to include('tracker.invalid/x.js')
expect(response.body).not_to include('@dashboard_scripts')
expect(response.body).to include('<div id="app"></div>')
expect(GlobalConfig).not_to have_received(:get_value).with('DASHBOARD_SCRIPTS')
end
it 'does not serialize the frontend error reporting DSN' do
with_modified_env SENTRY_FRONTEND_DSN: 'https://sentry.invalid/frontend', SENTRY_DSN: 'https://sentry.invalid/backend' do
get '/app/login'