Skip to content
Open
Changes from 1 commit
Commits
File filter

Filter by extension

Filter by extension

Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
Next Next commit
fix IE11
  • Loading branch information
wingleung committed Dec 19, 2018
commit 7c17e97d8b217c8f25750fb5d3e9946344b597a6
16 changes: 13 additions & 3 deletions src/delegate.html
Original file line number Diff line number Diff line change
Expand Up @@ -2,6 +2,8 @@
<html lang="en">
<head>
<meta charset="UTF-8">
<meta http-equiv="X-UA-Compatible" content="IE=edge" />

<title>Login</title>
<link rel="stylesheet"
href="https://stackpath.bootstrapcdn.com/bootstrap/4.1.3/css/bootstrap.min.css"
Expand Down Expand Up @@ -74,7 +76,7 @@ <h1>Request access</h1>

<div class="form-group">
<label for="subject">Reason for access (free text, mandatory)</label>
<input class="form-control" type="text" name="subject" id="subject" value=""/>
<input class="form-control" type="text" name="subject" id="subject" value="" required />
</div>

<fieldset class="form-group">
Expand Down Expand Up @@ -139,8 +141,10 @@ <h1>Request access</h1>

var dateTime = new Date();
var formSignIn = document.querySelector('.form-signin');
var subjectInput = formSignIn.querySelector('#subject');
var inputExp = formSignIn.querySelector('#exp');
var dateTimePicker = $('#datetimepicker1');
var domains = document.getElementById('domains')
var authorizerResponse = document.querySelector('.authorizer-response');
var authorizerToken = document.getElementById('token');

Expand All @@ -151,12 +155,18 @@ <h1>Request access</h1>
formSignIn.addEventListener('submit', function (e) {
e.preventDefault();

var formData = new URLSearchParams(new FormData(formSignIn));
var formDataUrlParams = 'exp=' + inputExp.value + '&subject=' + subjectInput.value;
domains.querySelectorAll('input').forEach(function(input) {
if (input.checked) {
formDataUrlParams = formDataUrlParams + '&' + input.name + '=' + input.value
Copy link
Copy Markdown
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Moet hier geen escaping gebeuren?

Copy link
Copy Markdown

@vStone vStone Dec 20, 2018

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Je zou knn opperen van wel, maar bogus input moet toch op de backend gechecked worden. frontend input is niet te vertrouwen :)

Copy link
Copy Markdown
Contributor

@nielslaukens nielslaukens Dec 20, 2018

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

De backend checkt de data die aangeleverd wordt; dat is het probleem niet.
Het probleem is dat de gebruiker rare foutmeldingen gaat krijgen als hij een "ongewoon" karakter in zijn Subject tikt. Met spatie ook als ongewoon...

Copy link
Copy Markdown
Member Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

@nielslaukens wordt automatisch gedaan op lijn 164 door new URLSearchParams(formDataUrlParams)

Copy link
Copy Markdown
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

I'm pretty sure dat een ingevulde subject van foo&dummy=bar de boel om zeep gaat helpen...

Copy link
Copy Markdown
Member Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

}
})
var formDataUrlSearchParams = new URLSearchParams(formDataUrlParams);

fetch('/delegate', {
credentials: 'include',
method: 'post',
body: formData
body: formDataUrlSearchParams.toString()
})
.then(function (response) {
if (response.status !== 200)
Expand Down