5 Commits

Author SHA1 Message Date
Solly Ross 5b78c230f9 Merge pull request #804 from nbibler/backport-619
Backport #619 into stable/v0.6
2017-04-12 11:43:12 -04:00
Nathaniel Bibler 4389e1fa07 Backport #619 into stable/v0.6 2017-03-31 15:16:40 -04:00
Solly Ross e8986fa069 Release v0.6.2
Fixes a XSS vulnerability in the noVNC status display which could allow
remote VNC servers to inject arbitrary HTML into the noVNC display page.
2017-01-12 14:36:42 -05:00
Solly Ross 15ce2f71eb Use textContent instead of innerHTML
Previously, setting `innerHTML` was used to display the statuses.  These
could include content communicated from the remote VNC server, allowing
the remove VNC server to inject HTML into the noVNC page.

This commit switches all uses of `innerHTML` to use `textContent`, which
is not vulnerable to the HTML injection.
2017-01-12 11:58:22 -05:00
Solly Ross da82b3426c Release 0.6.1
Fixes version number mismatch (also adds more detailed instructions
for releasing).

Fixes #628
2016-07-04 15:29:00 -04:00
14 changed files with 62 additions and 39 deletions
+1 -1
View File
@@ -1 +1 @@
0.6
0.6.2
+34 -9
View File
@@ -1,9 +1,34 @@
- Update and commit docs/VERSION
- Create version tag and tarball from tag
WVER=0.3
git tag v${WVER}
git push origin master
git push origin v${WVER}
git archive --format=tar --prefix=novnc-${WVER}/ v${WVER} > novnc-${WVER}.tar
gzip novnc-${WVER}.tar
- Upload tarball to repo
- Decide a new version number X.Y.Z (follow SemVer)
- Update version in package.json
- Update version in docs/VERSION
- Commit the change with a commit like "Release X.Y.Z"
- Add a new release on GitHub called "vX.Y.Z", and populate it with
release notes of the following form (where A.B.C is the last release):
Major Changes Since A.B.C
=========================
*Insert warnings here about incompatibilities*
*Thanks to all the contributors who filed bugs, added features, and fixed bugs
during this release :tada:*
App-visible Changes
-------------------
- *feature* a feature which improves the app usage (#PRNUM)
- *bugfix* a bug fix which fixes the app usage (#PRNUM)
- *refactor* a refactor which changes the app usage (#PRNUM)
Library-visible Changes
-----------------------
- *feature* a feature which improves the noVNC APIs (#PRNUM)
- *bugfix* a bug fix which fixes the noVNC APIs (#PRNUM)
- *refactor* a refactor which changes the noVNC APIs (#PRNUM)
App-internals Changes
---------------------
- *bugfix* a bug fix with affects the internals of noVNC only (#PRNUM)
- *refactor* a refactor which affects the internals of noVNC only (#PRNUM)
+12 -14
View File
@@ -338,14 +338,13 @@ var Keyboard, Mouse;
Util.addEvent(window, 'touchend', this._eventHandlers.mouseup);
Util.addEvent(c, 'touchend', this._eventHandlers.mouseup);
Util.addEvent(c, 'touchmove', this._eventHandlers.mousemove);
} else {
Util.addEvent(c, 'mousedown', this._eventHandlers.mousedown);
Util.addEvent(window, 'mouseup', this._eventHandlers.mouseup);
Util.addEvent(c, 'mouseup', this._eventHandlers.mouseup);
Util.addEvent(c, 'mousemove', this._eventHandlers.mousemove);
Util.addEvent(c, (Util.Engine.gecko) ? 'DOMMouseScroll' : 'mousewheel',
this._eventHandlers.mousewheel);
}
Util.addEvent(c, 'mousedown', this._eventHandlers.mousedown);
Util.addEvent(window, 'mouseup', this._eventHandlers.mouseup);
Util.addEvent(c, 'mouseup', this._eventHandlers.mouseup);
Util.addEvent(c, 'mousemove', this._eventHandlers.mousemove);
Util.addEvent(c, (Util.Engine.gecko) ? 'DOMMouseScroll' : 'mousewheel',
this._eventHandlers.mousewheel);
/* Work around right and middle click browser behaviors */
Util.addEvent(document, 'click', this._eventHandlers.mousedisable);
@@ -360,14 +359,13 @@ var Keyboard, Mouse;
Util.removeEvent(window, 'touchend', this._eventHandlers.mouseup);
Util.removeEvent(c, 'touchend', this._eventHandlers.mouseup);
Util.removeEvent(c, 'touchmove', this._eventHandlers.mousemove);
} else {
Util.removeEvent(c, 'mousedown', this._eventHandlers.mousedown);
Util.removeEvent(window, 'mouseup', this._eventHandlers.mouseup);
Util.removeEvent(c, 'mouseup', this._eventHandlers.mouseup);
Util.removeEvent(c, 'mousemove', this._eventHandlers.mousemove);
Util.removeEvent(c, (Util.Engine.gecko) ? 'DOMMouseScroll' : 'mousewheel',
this._eventHandlers.mousewheel);
}
Util.removeEvent(c, 'mousedown', this._eventHandlers.mousedown);
Util.removeEvent(window, 'mouseup', this._eventHandlers.mouseup);
Util.removeEvent(c, 'mouseup', this._eventHandlers.mouseup);
Util.removeEvent(c, 'mousemove', this._eventHandlers.mousemove);
Util.removeEvent(c, (Util.Engine.gecko) ? 'DOMMouseScroll' : 'mousewheel',
this._eventHandlers.mousewheel);
/* Work around right and middle click browser behaviors */
Util.removeEvent(document, 'click', this._eventHandlers.mousedisable);
+3 -3
View File
@@ -285,7 +285,7 @@ var UI;
if (typeof(msg) !== 'undefined') {
$D('noVNC_control_bar').setAttribute("class", klass);
$D('noVNC_status').innerHTML = msg;
$D('noVNC_status').textContent = msg;
}
UI.updateVisualState();
@@ -360,9 +360,9 @@ var UI;
clearTimeout(UI.popupStatusTimeout);
if (typeof text === 'string') {
psp.innerHTML = text;
psp.textContent = text;
} else {
psp.innerHTML = $D('noVNC_status').innerHTML;
psp.textContent = $D('noVNC_status').textContent;
}
psp.style.display = "block";
psp.style.left = window.innerWidth/2 -
+1 -1
View File
@@ -1,6 +1,6 @@
{
"name": "noVNC",
"version": "0.5.1",
"version": "0.6.2",
"description": "An HTML5 VNC client",
"main": "karma.conf.js",
"directories": {
+1 -1
View File
@@ -36,7 +36,7 @@ if (Util.Engine.trident) {
function message(str) {
//console.log(str);
cell = $D('messages');
cell.innerHTML += str + newline;
cell.textContent += str + newline;
cell.scrollTop = cell.scrollHeight;
}
+1 -1
View File
@@ -20,7 +20,7 @@
function debug(str) {
console.log(str);
cell = $D('debug');
cell.innerHTML += str + "\n";
cell.textContent += str + "\n";
cell.scrollTop = cell.scrollHeight;
}
+1 -1
View File
@@ -42,7 +42,7 @@
function message(str) {
console.log(str);
cell = $D('messages');
cell.innerHTML += msg_cnt + ": " + str + "\n";
cell.textContent += msg_cnt + ": " + str + "\n";
cell.scrollTop = cell.scrollHeight;
msg_cnt += 1;
}
+1 -1
View File
@@ -35,7 +35,7 @@
function debug(str) {
console.log(str);
cell = $D('debug');
cell.innerHTML += str + "\n";
cell.textContent += str + "\n";
cell.scrollTop = cell.scrollHeight;
}
+1 -1
View File
@@ -44,7 +44,7 @@
function message(str) {
console.log(str);
cell = $D('messages');
cell.innerHTML += msg_cnt + ": " + str + newline;
cell.textContent += msg_cnt + ": " + str + newline;
cell.scrollTop = cell.scrollHeight;
msg_cnt++;
}
+1 -1
View File
@@ -56,7 +56,7 @@
function message(str) {
console.log(str);
cell = $D('messages');
cell.innerHTML += msg_cnt + ": " + str + newline;
cell.textContent += msg_cnt + ": " + str + newline;
cell.scrollTop = cell.scrollHeight;
msg_cnt++;
}
+2 -2
View File
@@ -64,7 +64,7 @@
function msg(str) {
console.log(str);
var cell = $D('messages');
cell.innerHTML += str + "\n";
cell.textContent += str + "\n";
cell.scrollTop = cell.scrollHeight;
}
function dbgmsg(str) {
@@ -88,7 +88,7 @@
break;
}
if (typeof mesg !== 'undefined') {
$D('VNC_status').innerHTML = mesg;
$D('VNC_status').textContent = mesg;
}
}
+2 -2
View File
@@ -51,7 +51,7 @@
function message(str) {
console.log(str);
var cell = $D('messages');
cell.innerHTML += str + "\n";
cell.textContent += str + "\n";
cell.scrollTop = cell.scrollHeight;
}
@@ -78,7 +78,7 @@
break;
}
if (typeof msg !== 'undefined') {
$D('VNC_status').innerHTML = msg;
$D('VNC_status').textContent = msg;
}
}
+1 -1
View File
@@ -152,7 +152,7 @@
if (typeof(msg) !== 'undefined') {
sb.setAttribute("class", "noVNC_status_" + level);
s.innerHTML = msg;
s.textContent = msg;
}
}