2e5c7557a9
- Breaking change: Treat callbacks to `editor.ready` as Promises, only resolving after all resolve - Breaking change: Make `editor.runCallbacks` return a `Promise` which resolves upon all callbacks resolving - Breaking change: Require `npx` (used with `babel-node`) to allow Node files for HTML building and JSDoc type checking to be expressed as ESM. - Breaking change: `addExtension` now throws upon a repeated attempt to add an already-added extension - Breaking change (storage preference cookies): Namespace the cookie as "svgeditstore" instead of just "store" - Breaking change (API): Remove `svgCanvas.rasterExport` fourth (callback) argument, collapsing fifth (options) to fourth - Breaking change (API): Remove `svgCanvas.exportPDF` third (callback) argument - Breaking change (API): `editor/contextmenu.js` `add` now throws instead of giving a console error only upon detecting a bad menuitem or preexisting context menu - Breaking change (API): Remove `svgCanvas.embedImage` second (callback) argument - Breaking change (API): Make `getHelpXML` a class instead of instance method of `RGBColor` - Breaking change (internal API): Refactor `dbox` (and `alert`/`confirm`/`process`/`prompt`/`select`) to avoid a callback argument in favor of return a Promise - Fix: Avoid running in extension `langReady` multiple times or serially - Enhancement (API): Add svgCanvas.runExtension to run just one extension and add `nameFilter` callback to `runExtensions` - Enhancement (API): Supply `$` (our wrapped jQuery) to extensions so can use its plugins, e.g., dbox with its `alert` - Enhancement: Use alert dialog in place of `alert` in webappfind - Enhancement: `editor.ready` now returns a Promise resolving when all callbacks have resolved - Enhancement: Allow `noAlert` option as part of second argument to `loadSvgString` (and `loadFromURL` and `loadFromDataURI`) to avoid UI alert (and trigger promise rejection) - Enhancement: Make `dbox` as a separate module for alert, prompt, etc. dialogs - Refactoring: Internal `PaintBox` as class; other misc. tweaks; no bitwise in canvg - Linting (ESLint): Further linting changes (for editor); rename `.eslintrc` -> `.eslintrc.json` per recommendation - Optimization: Recompress images (imageoptim-cli updated) - npm: Update devDeps - npm: Bump to 4.0.0
49 lines
1.9 KiB
JavaScript
49 lines
1.9 KiB
JavaScript
/**
|
|
* Should not be needed for same domain control (just call via child frame),
|
|
* but an API common for cross-domain and same domain use can be found
|
|
* in embedapi.js with a demo at embedapi.html
|
|
*/
|
|
export default {
|
|
name: 'xdomain-messaging',
|
|
init () {
|
|
const svgEditor = this;
|
|
const svgCanvas = svgEditor.canvas;
|
|
try {
|
|
window.addEventListener('message', function (e) {
|
|
// We accept and post strings for the sake of IE9 support
|
|
if (!e.data || !['string', 'object'].includes(typeof e.data) || e.data.charAt() === '|') {
|
|
return;
|
|
}
|
|
const data = typeof e.data === 'object' ? e.data : JSON.parse(e.data);
|
|
if (!data || typeof data !== 'object' || data.namespace !== 'svgCanvas') {
|
|
return;
|
|
}
|
|
// The default is not to allow any origins, including even the same domain or
|
|
// if run on a `file:///` URL. See `svgedit-config-es.js` for an example of how
|
|
// to configure
|
|
const {allowedOrigins} = svgEditor.curConfig;
|
|
if (!allowedOrigins.includes('*') && !allowedOrigins.includes(e.origin)) {
|
|
console.log(`Origin ${e.origin} not whitelisted for posting to ${window.origin}`); // eslint-disable-line no-console
|
|
return;
|
|
}
|
|
const cbid = data.id;
|
|
const {name, args} = data;
|
|
const message = {
|
|
namespace: 'svg-edit',
|
|
id: cbid
|
|
};
|
|
try {
|
|
// Now that we know the origin is trusted, we perform otherwise
|
|
// unsafe arbitrary canvas method execution
|
|
message.result = svgCanvas[name](...args); // lgtm [js/remote-property-injection]
|
|
} catch (err) {
|
|
message.error = err.message;
|
|
}
|
|
e.source.postMessage(JSON.stringify(message), '*');
|
|
});
|
|
} catch (err) {
|
|
console.log('Error with xdomain message listener: ' + err); // eslint-disable-line no-console
|
|
}
|
|
}
|
|
};
|