Skip to content

Commit a573edb

Browse files
labkey-adamlabkey-adam
authored
Add nonces (#42)
1 parent 8fb3a70 commit a573edb

File tree

4 files changed

+98
-75
lines changed

4 files changed

+98
-75
lines changed

‎src/org/labkey/filetransfer/provider/Registry.java

Lines changed: 3 additions & 6 deletions
Original file line numberDiff line numberDiff line change
@@ -17,21 +17,18 @@
1717

1818
import org.apache.logging.log4j.LogManager;
1919
import org.apache.logging.log4j.Logger;
20+
import org.labkey.api.collections.CopyOnWriteHashMap;
2021
import org.labkey.api.data.Container;
2122
import org.labkey.api.security.User;
2223

2324
import java.lang.reflect.InvocationTargetException;
2425
import java.util.Map;
25-
import java.util.concurrent.ConcurrentHashMap;
2626

27-
/**
28-
* Created by susanh on 5/22/17.
29-
*/
3027
public class Registry
3128
{
3229
private static final Logger logger = LogManager.getLogger(Registry.class);
33-
private static Map<String, Class<? extends FileTransferProvider>> _providers = new ConcurrentHashMap<>();
34-
private static Registry _instance = new Registry();
30+
private static Map<String, Class<? extends FileTransferProvider>> _providers = new CopyOnWriteHashMap<>();
31+
private static final Registry _instance = new Registry();
3532

3633
private Registry()
3734
{

‎src/org/labkey/filetransfer/view/fileTransfer.jsp

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -60,7 +60,7 @@
6060
if (transferEnabled)
6161
{
6262
%>
63-
<script type="text/javascript">
63+
<script type="text/javascript" nonce="<%=getScriptNonce()%>">
6464
function makeTransferRequest()
6565
{
6666
Ext4.Ajax.request({

‎src/org/labkey/filetransfer/view/fileTransferConfig.jsp

Lines changed: 58 additions & 42 deletions
Original file line numberDiff line numberDiff line change
@@ -39,14 +39,12 @@
3939
<h2><%= h(bean.getName()) %> File Transfer</h2>
4040
<div id="transferForm"></div>
4141

42-
<script type="text/javascript">
42+
<script type="text/javascript" nonce="<%=getScriptNonce()%>">
4343
4444
Ext4.onReady(function()
4545
{
46-
var getFieldHoverText = function(title, details) {
47-
return '<a href="#" onclick="return showHelpDiv(this, \'' + title + '\', \'' + details + '\');" '
48-
+ 'onmouseover="return showHelpDivDelay(this, \'' + title + '\', \'' + details + '\');" '
49-
+ 'onmouseout="return hideHelpDivDelay();"><span class="labkey-help-pop-up">?</span></a>';
46+
var getFieldHoverText = function(id) {
47+
return '<a id=\'' + id + '\' href=\'#\'><span class=\'labkey-help-pop-up\'>?</span></a>';
5048
};
5149
5250
var clientDataHeader = Ext4.create('Ext.form.Label', {
@@ -55,24 +53,24 @@
5553
});
5654
5755
var clientId = Ext4.create('Ext.form.field.Text', {
58-
name: "clientId",
56+
name: 'clientId',
5957
labelWidth: 200,
6058
width: 535,
6159
padding: '10px 0 0 25px',
6260
disabled: <%=!canEdit%>,
63-
fieldLabel: "Client Id" + getFieldHoverText('Client Id', 'The id assigned by the file transfer provider to identify this application as its client.'),
61+
fieldLabel: "Client Id" + getFieldHoverText('clientId_a'),
6462
initialValue : <%=q(bean.getClientId())%>,
6563
value: <%=q(bean.getClientId())%>,
6664
allowBlank: false
6765
});
6866
6967
var clientSecret = Ext4.create('Ext.form.field.Text', {
70-
name: "clientSecret",
68+
name: 'clientSecret',
7169
labelWidth: 200,
7270
width: 535,
7371
padding: '10px 0 0 25px',
7472
disabled: <%=!canEdit%>,
75-
fieldLabel: "Client Secret" + getFieldHoverText('Client Secret', 'The secret associated with the Client Id used for authenticating requests to the file transfer provider.'),
73+
fieldLabel: "Client Secret" + getFieldHoverText('clientSecret_a'),
7674
initialValue : <%=q(bean.getClientSecret())%>,
7775
value: <%=q(bean.getClientSecret())%>,
7876
allowBlank: false
@@ -85,48 +83,48 @@
8583
});
8684
8785
var authUrl = Ext4.create('Ext.form.field.Text', {
88-
name: "authUrlPrefix",
86+
name: 'authUrlPrefix',
8987
labelWidth: 200,
9088
width: 535,
9189
padding: '10px 0 0 25px',
9290
disabled: <%=!canEdit%>,
93-
fieldLabel: "Authorization URL Prefix" + getFieldHoverText('Authorization URL Prefix', 'The prefix to the authorization service used for obtaining authorization codes and for requesting tokens. (e.g., https://auth.globus.org/v2/oauth2)'),
91+
fieldLabel: "Authorization URL Prefix" + getFieldHoverText('authUrlPrefix_a'),
9492
initialValue : <%=q(bean.getAuthUrlPrefix() == null ? "https://auth.globus.org/v2/oauth2" : bean.getAuthUrlPrefix())%>,
9593
value: <%=q(bean.getAuthUrlPrefix() == null ? "https://auth.globus.org/v2/oauth2" : bean.getAuthUrlPrefix())%>,
9694
allowBlank: false
9795
});
9896
9997
var transferApiUrl = Ext4.create('Ext.form.field.Text', {
100-
name: "transferApiUrlPrefix",
98+
name: 'transferApiUrlPrefix',
10199
labelWidth: 200,
102100
width: 535,
103101
padding: '10px 0 0 25px',
104102
disabled: <%=!canEdit%>,
105-
fieldLabel: "Transfer API URL Prefix" + getFieldHoverText('Transfer API URL Prefix', 'The prefix to the transfer API used for making transfer requests. (e.g, https://transfer.api.globusonline.org/v0.10)'),
103+
fieldLabel: "Transfer API URL Prefix" + getFieldHoverText('transferApiUrlPrefix_a'),
106104
initialValue : <%=q(bean.getTransferApiUrlPrefix() == null ? "https://transfer.api.globusonline.org/v0.10" : bean.getTransferApiUrlPrefix())%>,
107105
value: <%=q(bean.getTransferApiUrlPrefix() == null ? "https://transfer.api.globusonline.org/v0.10" : bean.getTransferApiUrlPrefix())%>,
108106
allowBlank: false
109107
});
110108
111109
var transferUiUrl = Ext4.create('Ext.form.field.Text', {
112-
name: "transferUiUrlPrefix",
110+
name: 'transferUiUrlPrefix',
113111
labelWidth: 200,
114112
width: 535,
115113
padding: '10px 0 0 25px',
116114
disabled: <%=!canEdit%>,
117-
fieldLabel: "Transfer UI URL Prefix" + getFieldHoverText('Transfer UI URL Prefix', 'The prefix to the UI page where transfer requests can be made. (e.g., https://www.globus.org/app/transfer)'),
115+
fieldLabel: "Transfer UI URL Prefix" + getFieldHoverText('transferUiUrlPrefix_a'),
118116
initialValue : <%=q(bean.getTransferUiUrlPrefix() == null ? "https://www.globus.org/app/transfer" : bean.getTransferUiUrlPrefix())%>,
119117
value: <%=q(bean.getTransferUiUrlPrefix() == null ? "https://www.globus.org/app/transfer" : bean.getTransferUiUrlPrefix())%>,
120118
allowBlank: true
121119
});
122120
123121
var browseEndpointUrl = Ext4.create('Ext.form.field.Text', {
124-
name: "browseEndpointUrlPrefix",
122+
name: 'browseEndpointUrlPrefix',
125123
labelWidth: 200,
126124
width: 535,
127125
padding: '10px 0 0 25px',
128126
disabled: <%=!canEdit%>,
129-
fieldLabel: "Browse Endpoint URL Prefix" + getFieldHoverText('Browse Endpoint URL Prefix', 'The prefix to the helper page where users can select endpoints (e.g., https://www.globus.org/app/browse-endpoint)'),
127+
fieldLabel: "Browse Endpoint URL Prefix" + getFieldHoverText('browseEndpointUrlPrefix_a'),
130128
initialValue : <%=q(bean.getBrowseEndpointUrlPrefix() == null ? "https://www.globus.org/app/browse-endpoint" : bean.getBrowseEndpointUrlPrefix())%>,
131129
value: <%=q(bean.getBrowseEndpointUrlPrefix())%>,
132130
allowBlank: false
@@ -139,42 +137,40 @@
139137
140138
141139
var endpointId = Ext4.create('Ext.form.field.Text', {
142-
name: "sourceEndpointId",
143-
labelWidth: 200,
144-
width: 535,
145-
padding: '10px 0 0 25px',
146-
disabled: <%=!canEdit%>,
147-
fieldLabel: "Endpoint Id" + getFieldHoverText('Source Endpoint Id', 'The unique id assigned by the file transfer provider to the source endpoint for transfer requests.'),
148-
initialValue: <%=q(bean.getSourceEndpointId())%>,
149-
value: <%=q(bean.getSourceEndpointId())%>,
150-
allowBlank: true
151-
});
140+
name: 'sourceEndpointId',
141+
labelWidth: 200,
142+
width: 535,
143+
padding: '10px 0 0 25px',
144+
disabled: <%=!canEdit%>,
145+
fieldLabel: "Endpoint Id" + getFieldHoverText('sourceEndpointId_a'),
146+
initialValue: <%=q(bean.getSourceEndpointId())%>,
147+
value: <%=q(bean.getSourceEndpointId())%>,
148+
allowBlank: true
149+
});
152150
153151
var endpointName = Ext4.create('Ext.form.field.Text', {
154-
name: 'sourceEndpointDisplayName',
155-
labelWidth: 200,
156-
width: 535,
157-
padding: '10px 0 0 25px',
158-
disabled: <%=!canEdit%>,
159-
fieldLabel: "Endpoint Name" + getFieldHoverText('Source Endpoint Name', 'The display name for the source endpoint.'),
160-
initialValue: <%=q(bean.getSourceEndpointDisplayName())%>,
161-
value: <%=q(bean.getSourceEndpointDisplayName())%>,
162-
allowBlank: true
163-
});
152+
name: 'sourceEndpointDisplayName',
153+
labelWidth: 200,
154+
width: 535,
155+
padding: '10px 0 0 25px',
156+
disabled: <%=!canEdit%>,
157+
fieldLabel: "Endpoint Name" + getFieldHoverText('sourceEndpointDisplayName_a'),
158+
initialValue: <%=q(bean.getSourceEndpointDisplayName())%>,
159+
value: <%=q(bean.getSourceEndpointDisplayName())%>,
160+
allowBlank: true
161+
});
164162
165163
var endpointLocalFileRoot = Ext4.create("Ext.form.field.Text", {
166-
name: "sourceEndpointLocalDir",
164+
name: 'sourceEndpointLocalDir',
167165
labelWidth: 200,
168166
width: 535,
169167
padding: '10px 0 0 25px',
170168
disabled: <%=!canEdit%>,
171-
fieldLabel: "File Transfer Root Directory" + getFieldHoverText('Source Endpoint File Transfer Root Directory', 'Specify the root directory on the '
172-
+ 'local file system where the files to be transferred from this endpoint are available.'),
169+
fieldLabel: "File Transfer Root Directory" + getFieldHoverText('sourceEndpointLocalDir_a'),
173170
value: <%=qh(bean.getSourceEndpointLocalDir())%>,
174171
allowBlank: true
175172
});
176173
177-
178174
var cancelButton = Ext4.create('Ext.button.Button', {
179175
text: <%= q(canEdit ? "Cancel": "OK") %>,
180176
scope: this,
@@ -219,6 +215,13 @@
219215
}
220216
%>
221217
218+
const attachEvents = function (id, title, details) {
219+
const element = document.getElementById(id);
220+
element['onclick'] = function(){ return showHelpDiv(this, title, details); };
221+
element['onmouseover'] = function(){ return showHelpDiv(this, title, details); };
222+
element['onmouseout'] = function(){ return hideHelpDivDelay(); };
223+
}
224+
222225
Ext4.create('Ext.form.Panel', {
223226
border : false,
224227
renderTo : 'transferForm',
@@ -239,7 +242,20 @@
239242
endpointLocalFileRoot,
240243
{ xtype: 'hidden', name: 'X-LABKEY-CSRF', value: LABKEY.CSRF }
241244
],
242-
buttons: buttons
245+
buttons: buttons,
246+
listeners: {
247+
render: function () {
248+
attachEvents('clientId_a', 'Client Id', 'The id assigned by the file transfer provider to identify this application as its client.');
249+
attachEvents('clientSecret_a', 'Client Secret', 'The secret associated with the Client Id used for authenticating requests to the file transfer provider.');
250+
attachEvents('authUrlPrefix_a', 'Authorization URL Prefix', 'The prefix to the authorization service used for obtaining authorization codes and for requesting tokens. (e.g., https://auth.globus.org/v2/oauth2)');
251+
attachEvents('transferApiUrlPrefix_a', 'Transfer API URL Prefix', 'The prefix to the transfer API used for making transfer requests. (e.g, https://transfer.api.globusonline.org/v0.10)');
252+
attachEvents('transferUiUrlPrefix_a', 'Transfer UI URL Prefix', 'The prefix to the UI page where transfer requests can be made. (e.g., https://www.globus.org/app/transfer)');
253+
attachEvents('browseEndpointUrlPrefix_a', 'Browse Endpoint URL Prefix', 'The prefix to the helper page where users can select endpoints (e.g., https://www.globus.org/app/browse-endpoint)');
254+
attachEvents('sourceEndpointId_a', 'Source Endpoint Id', 'The unique id assigned by the file transfer provider to the source endpoint for transfer requests.');
255+
attachEvents('sourceEndpointDisplayName_a', 'Source Endpoint Name', 'The display name for the source endpoint.');
256+
attachEvents('sourceEndpointLocalDir_a', 'Source Endpoint File Transfer Root Directory', 'Specify the root directory on the local file system where the files to be transferred from this endpoint are available.');
257+
}
258+
}
243259
});
244260
});
245261
</script>

‎src/org/labkey/filetransfer/view/fileTransferWebPartConfig.jsp

Lines changed: 36 additions & 26 deletions
Original file line numberDiff line numberDiff line change
@@ -44,22 +44,20 @@
4444
<labkey:errors/>
4545
<div id="SQVPicker"></div>
4646

47-
<script type="text/javascript">
47+
<script type="text/javascript" nonce="<%=getScriptNonce()%>">
4848
4949
Ext4.onReady(function()
5050
{
51-
var getFieldHoverText = function(title, details) {
52-
return '<a href="#" onclick="return showHelpDiv(this, \'' + title + '\', \'' + details + '\');" '
53-
+ 'onmouseover="return showHelpDivDelay(this, \'' + title + '\', \'' + details + '\');" '
54-
+ 'onmouseout="return hideHelpDivDelay();"><span class="labkey-help-pop-up">?</span></a>';
51+
var getFieldHoverText = function(id) {
52+
return '<a id=\'' + id + '\' href=\'#\'><span class=\'labkey-help-pop-up\'>?</span></a>';
5553
};
5654
57-
var webPartTitle = Ext4.create("Ext.form.field.Text", {
58-
name: "webpart.title",
55+
var webPartTitle = Ext4.create('Ext.form.field.Text', {
56+
name: 'webpart.title',
5957
labelWidth: 150,
6058
width: 510,
6159
padding: '10px 0 25px 0',
62-
fieldLabel: "Web Part Title",
60+
fieldLabel: 'Web Part Title',
6361
initialValue : <%=qh(title)%>,
6462
value: <%=qh(title)%>,
6563
allowBlank: false
@@ -70,23 +68,23 @@
7068
'Specify where the files to be transferred in this webpart are available on your local file system. Provide a path relative to the file transfer root directory (set via the admin console).';
7169
7270
var localFilesDirectoryHeader = Ext4.create('Ext.form.Label', {
73-
html: '<span style="font-weight: bold">Files Directory</span></br>' + localDirMsg
74-
});
71+
html: '<span style="font-weight: bold">Files Directory</span></br>' + localDirMsg
72+
});
7573
7674
var localFilesDirectoryField = Ext4.create('Ext.form.field.Text', {
77-
name: "localFilesDirectory",
75+
name: 'localFilesDirectory',
7876
labelWidth: 150,
7977
width: 510,
8078
padding: '10px 0 25px 0',
8179
disabled: <%=StringUtils.isEmpty(provider.getSettings().getFileTransferRoot())%>,
82-
fieldLabel: "Local Directory" + getFieldHoverText('Local Directory', localDirMsg),
80+
fieldLabel: 'Local Directory' + getFieldHoverText('localFilesDirectory_a'),
8381
initialValue : <%=q(properties.get("localFilesDirectory"))%>,
8482
value: <%=q(properties.get("localFilesDirectory"))%>,
8583
allowBlank: false
8684
});
8785
8886
var referenceListHeader = Ext4.create('Ext.form.Label', {
89-
text: "Reference List" ,
87+
text: 'Reference List',
9088
style: 'font-weight: bold;'
9189
});
9290
@@ -106,8 +104,7 @@
106104
var containerComboField = Ext4.create('Ext.form.field.ComboBox', sqvModel.makeContainerComboConfig({
107105
name: 'listFolder',
108106
labelWidth: 150,
109-
fieldLabel: 'Folder' + getFieldHoverText('Reference List Folder', 'Specify the location of the '
110-
+ 'list that contains the metadata for the files referenced in this webpart.'),
107+
fieldLabel: 'Folder' + getFieldHoverText('listFolder_a'),
111108
editable: false,
112109
width: 510,
113110
padding: '10px 0 0 0',
@@ -137,8 +134,7 @@
137134
name: 'listTable',
138135
forceSelection: true,
139136
defaultSchema: 'lists',
140-
fieldLabel: 'List'+ getFieldHoverText('Reference List', 'Specify the name of the '
141-
+ 'list that contains the metadata for the files referenced in this webpart.'),
137+
fieldLabel: 'List'+ getFieldHoverText('listTable_a'),
142138
labelWidth: 150,
143139
allowBlank: false,
144140
initialValue : <%=q(properties.get("listTable"))%>,
@@ -149,8 +145,7 @@
149145
150146
var columnComboField = Ext4.create('Ext.form.field.ComboBox', sqvModel.makeColumnComboConfig({
151147
name: 'fileNameColumn',
152-
fieldLabel: 'File Name Field' + getFieldHoverText('Reference List Filed', 'Specify the name of the field in the reference list '
153-
+ 'that contains the names of the files that could be transferred.'),
148+
fieldLabel: 'File Name Field' + getFieldHoverText('fileNameColumn_a'),
154149
forceSelection: true,
155150
labelWidth: 150,
156151
allowBlank: false,
@@ -162,17 +157,16 @@
162157
}));
163158
164159
var transferSourceHeader = Ext4.create('Ext.form.Label', {
165-
text: '<%=h(provider.getName())%> File Transfer Source',
160+
text: <%=q(provider.getName())%> + ' File Transfer Source',
166161
style: 'font-weight: bold;'
167162
});
168163
169164
var sourceEndpointDirField = Ext4.create('Ext.form.field.Text', {
170-
name: "sourceEndpointDir",
165+
name: 'sourceEndpointDir',
171166
labelWidth: 150,
172167
width: 510,
173168
padding: '10px 0 25px 0',
174-
fieldLabel: "Endpoint Directory" + getFieldHoverText('Endpoint Directory', 'Specify the directory on the '
175-
+ 'transfer service provider endpoint that contains the files for this webpart.'),
169+
fieldLabel: 'Endpoint Directory' + getFieldHoverText('sourceEndpointDir_a'),
176170
initialValue : <%=q(properties.get("sourceEndpointDir"))%>,
177171
value: <%=q(properties.get("sourceEndpointDir"))%>
178172
});
@@ -182,9 +176,9 @@
182176
scope: this,
183177
handler: function ()
184178
{
185-
var url = LABKEY.ActionURL.getParameter("returnUrl");
179+
var url = LABKEY.ActionURL.getParameter('returnUrl');
186180
if (!url)
187-
url = LABKEY.ActionURL.buildURL("project", "begin.view");
181+
url = LABKEY.ActionURL.buildURL('project', 'begin.view');
188182
189183
window.location = url;
190184
}
@@ -207,6 +201,13 @@
207201
}
208202
});
209203
204+
const attachEvents = function (id, title, details) {
205+
const element = document.getElementById(id);
206+
element['onclick'] = function(){ return showHelpDiv(this, title, details); };
207+
element['onmouseover'] = function(){ return showHelpDiv(this, title, details); };
208+
element['onmouseout'] = function(){ return hideHelpDivDelay(); };
209+
}
210+
210211
Ext4.create('Ext.form.Panel', {
211212
border : false,
212213
renderTo : 'SQVPicker',
@@ -230,7 +231,16 @@
230231
buttons: [
231232
cancelButton,
232233
saveButton
233-
]
234+
],
235+
listeners: {
236+
render: function () {
237+
attachEvents('localFilesDirectory_a', 'Local Directory', localDirMsg);
238+
attachEvents('listFolder_a', 'Reference List Folder', 'Specify the location of the list that contains the metadata for the files referenced in this webpart.');
239+
attachEvents('listTable_a', 'Reference List', 'Specify the name of the list that contains the metadata for the files referenced in this webpart.');
240+
attachEvents('fileNameColumn_a', 'Reference List Filed', 'Specify the name of the field in the reference list that contains the names of the files that could be transferred.');
241+
attachEvents('sourceEndpointDir_a', 'Endpoint Directory', 'Specify the directory on the transfer service provider endpoint that contains the files for this webpart.');
242+
}
243+
}
234244
});
235245
});
236246
</script>

0 commit comments

Comments
 (0)