Merge pull request #890 from nextcloud/backport/887/stable26

[stable26] disable scripting in pdfviewer
nextcloud · Jan 18, 2024 · 5dd5092 · 5dd5092
2 parents dc74588 + 36c7b6b
commit 5dd5092
Show file tree

Hide file tree

Showing 5 changed files with 20 additions and 3 deletions.
diff --git a/README.md b/README.md
@@ -6,6 +6,15 @@ You can view PDF files as well as Adobe Illustrator files (.ai)
 
 ![PDF Logo](https://user-images.githubusercontent.com/59488153/189176433-2f6d97a1-b151-4099-84f4-d1446a007b8a.png)
 
+### Enable Javascript execution in PDF files
+
+To allow Javascript embedded in PDF-files to be executed inside the PDF-viewer inside your browser, enable it with:
+
+`php occ config:app:set files_pdfviewer enable_scripting --value=yes`
+
+Disable:
+
+`php occ config:app:delete files_pdfviewer enable_scripting`
 
 ## 🏗 Development setup
 

diff --git a/js/files_pdfviewer-workersrc.js b/js/files_pdfviewer-workersrc.js
diff --git a/js/files_pdfviewer-workersrc.js.map b/js/files_pdfviewer-workersrc.js.map
diff --git a/src/workersrc.js b/src/workersrc.js
@@ -44,8 +44,10 @@ function initializeCustomPDFViewerApplication() {
 	PDFViewerApplicationOptions.set('isEvalSupported', false)
 	PDFViewerApplicationOptions.set('workerSrc', head.getAttribute('data-workersrc'))
 	PDFViewerApplicationOptions.set('cMapUrl', head.getAttribute('data-cmapurl'))
+	PDFViewerApplicationOptions.set('sandboxBundleSrc', head.getAttribute('data-sandbox'))
 	PDFViewerApplicationOptions.set('enablePermissions', true)
 	PDFViewerApplicationOptions.set('imageResourcesPath', './js/pdfjs/web/images/')
+	PDFViewerApplicationOptions.set('enableScripting', head.getAttribute('data-enableScripting') === true)
 
 	if (canDownload === '0') {
 		const pdfViewer = window.document.querySelector('.pdfViewer')

diff --git a/templates/viewer.php b/templates/viewer.php
@@ -3,6 +3,10 @@
   /** @var OCP\IURLGenerator $urlGenerator */
   $urlGenerator = $_['urlGenerator'];
   $version = \OC::$server->getAppManager()->getAppVersion('files_pdfviewer');
+  $enableScripting = false;
+  if (\OC::$server->getConfig()->getAppValue('files_pdfviewer', 'enable_scripting', 'no') === 'yes') {
+  	$enableScripting = true;
+  }
 ?>
 
 <!DOCTYPE html>
@@ -29,6 +33,8 @@
 -->
 <html dir="ltr" mozdisallowselectionprint>
   <head data-workersrc="<?php p($urlGenerator->linkTo('files_pdfviewer', 'js/pdfjs/build/pdf.worker.js')) ?>?v=<?php p($version) ?>"
+        data-enableScripting="<?php p($enableScripting ? true : false) ?>"
+        data-sandbox="<?php p($urlGenerator->linkTo('files_pdfviewer', 'js/pdfjs/build/pdf.sandbox.js'))?>"
         data-cmapurl="<?php p($urlGenerator->linkTo('files_pdfviewer', 'js/pdfjs/web/cmaps/')) ?>">
     <meta charset="utf-8">
     <meta name="viewport" content="width=device-width, initial-scale=1, maximum-scale=1">