diff --git a/app/controllers/dashboard_controller.rb b/app/controllers/dashboard_controller.rb index 0be7bac6a..3e52cdb5a 100644 --- a/app/controllers/dashboard_controller.rb +++ b/app/controllers/dashboard_controller.rb @@ -30,7 +30,6 @@ class DashboardController < ActionController::Base before_action :set_application_pack before_action :set_global_config - before_action :set_dashboard_scripts around_action :switch_locale before_action :ensure_installation_onboarding, only: [:index] before_action :render_hc_if_custom_domain, only: [:index] @@ -49,10 +48,6 @@ class DashboardController < ActionController::Base @global_config = GlobalConfig.get(*GLOBAL_CONFIG_KEYS).slice(*GLOBAL_CONFIG_KEYS).merge(app_config) end - def set_dashboard_scripts - @dashboard_scripts = sensitive_path? ? nil : GlobalConfig.get_value('DASHBOARD_SCRIPTS') - end - def ensure_installation_onboarding redirect_to '/installation/onboarding' if ::Redis::Alfred.get(::Redis::Alfred::CHATWOOT_INSTALLATION_ONBOARDING) end @@ -109,14 +104,4 @@ class DashboardController < ActionController::Base 'dashboard' end end - - def sensitive_path? - # dont load dashboard scripts on sensitive paths like password reset - sensitive_paths = [edit_user_password_path].freeze - - # remove app prefix - current_path = request.path.gsub(%r{^/app}, '') - - sensitive_paths.include?(current_path) - end end diff --git a/app/views/layouts/vueapp.html.erb b/app/views/layouts/vueapp.html.erb index d21dbcf09..05ff32435 100644 --- a/app/views/layouts/vueapp.html.erb +++ b/app/views/layouts/vueapp.html.erb @@ -70,8 +70,5 @@
<%= yield %> - <% if @dashboard_scripts.present? %> - <%= @dashboard_scripts.html_safe %> - <% end %> diff --git a/config/installation_config.yml b/config/installation_config.yml index f382cedb8..bec77431b 100644 --- a/config/installation_config.yml +++ b/config/installation_config.yml @@ -294,11 +294,6 @@ display_title: 'Clearbit API Key' description: 'This API key is used for onboarding the users, to pre-fill account data.' type: secret -- name: DASHBOARD_SCRIPTS - value: - display_title: 'Dashboard Scripts' - description: 'Scripts are loaded as the last item in the tag' - type: code - name: BLOCKED_EMAIL_DOMAINS value: display_title: 'Blocked Email Domains' diff --git a/spec/controllers/dashboard_controller_spec.rb b/spec/controllers/dashboard_controller_spec.rb index 534dfc358..32a84bf12 100644 --- a/spec/controllers/dashboard_controller_spec.rb +++ b/spec/controllers/dashboard_controller_spec.rb @@ -19,6 +19,21 @@ describe '/app/login', type: :request do expect(response.body).not_to include('[REDACTED]') end + it 'does not render configured dashboard scripts' do + allow(GlobalConfig).to receive(:get_value).and_call_original + allow(GlobalConfig).to receive(:get_value).with('DASHBOARD_SCRIPTS').and_return( + '' + ) + + get '/app/login' + + expect(response).to have_http_status(:success) + expect(response.body).not_to include('tracker.invalid/x.js') + expect(response.body).not_to include('@dashboard_scripts') + expect(response.body).to include('
') + expect(GlobalConfig).not_to have_received(:get_value).with('DASHBOARD_SCRIPTS') + end + it 'does not serialize the frontend error reporting DSN' do with_modified_env SENTRY_FRONTEND_DSN: 'https://sentry.invalid/frontend', SENTRY_DSN: 'https://sentry.invalid/backend' do get '/app/login'