@ohif/app 3.12.0 → 3.12.1

package/dist/{9195.bundle.606ca286a0fed8a43f58.js → 2851.bundle.70227d013c1937e846be.js}

@@ -1,8 +1,8 @@
 "use strict";
-(globalThis["webpackChunk"] = globalThis["webpackChunk"] || []).push([[9195],{
+(globalThis["webpackChunk"] = globalThis["webpackChunk"] || []).push([[2851],{
 
-/***/ 52675:
-/***/ ((__unused_webpack_module, __webpack_exports__, __webpack_require__) => {
+/***/ 52675
+(__unused_webpack_module, __webpack_exports__, __webpack_require__) {
 
 /* harmony export */ __webpack_require__.d(__webpack_exports__, {
 /* harmony export */   A: () => (/* binding */ MoreDropdownMenu)
@@ -110,10 +110,10 @@ function MoreDropdownMenu(bindProps) {
   return BoundMoreDropdownMenu;
 }
 
-/***/ }),
+/***/ },
 
-/***/ 40565:
-/***/ ((__unused_webpack_module, __webpack_exports__, __webpack_require__) => {
+/***/ 40565
+(__unused_webpack_module, __webpack_exports__, __webpack_require__) {
 
 
 // EXPORTS
@@ -613,10 +613,10 @@ function _findTabAndStudyOfDisplaySet(displaySetInstanceUID, tabs, currentTabNam
   }
 }
 
-/***/ }),
+/***/ },
 
-/***/ 3329:
-/***/ ((__unused_webpack_module, __webpack_exports__, __webpack_require__) => {
+/***/ 3329
+(__unused_webpack_module, __webpack_exports__, __webpack_require__) {
 
 /* harmony export */ __webpack_require__.d(__webpack_exports__, {
 /* harmony export */   T: () => (/* binding */ PanelStudyBrowserHeader)
@@ -665,10 +665,10 @@ function PanelStudyBrowserHeader({
 }
 
 
-/***/ }),
+/***/ },
 
-/***/ 20528:
-/***/ ((__unused_webpack_module, __webpack_exports__, __webpack_require__) => {
+/***/ 20528
+(__unused_webpack_module, __webpack_exports__, __webpack_require__) {
 
 /* harmony export */ __webpack_require__.d(__webpack_exports__, {
 /* harmony export */   M: () => (/* binding */ Toolbar)
@@ -747,66 +747,41 @@ function Toolbar({
   }));
 }
 
-/***/ }),
+/***/ },
 
-/***/ 39195:
-/***/ ((__unused_webpack_module, __webpack_exports__, __webpack_require__) => {
+/***/ 62851
+(__unused_webpack_module, __webpack_exports__, __webpack_require__) {
 
-// ESM COMPAT FLAG
-__webpack_require__.r(__webpack_exports__);
 
 // EXPORTS
 __webpack_require__.d(__webpack_exports__, {
-  ContextMenuController: () => (/* reexport */ ContextMenuController),
-  CustomizableContextMenuTypes: () => (/* reexport */ types_namespaceObject),
-  MoreDropdownMenu: () => (/* reexport */ MoreDropdownMenu/* default */.A),
-  PanelStudyBrowserHeader: () => (/* reexport */ PanelStudyBrowserHeader/* PanelStudyBrowserHeader */.T),
-  StaticWadoClient: () => (/* reexport */ StaticWadoClient),
-  Toolbar: () => (/* reexport */ Toolbar/* Toolbar */.M),
-  Toolbox: () => (/* reexport */ Toolbox),
-  callInputDialog: () => (/* reexport */ callInputDialog),
-  callInputDialogAutoComplete: () => (/* reexport */ callInputDialogAutoComplete),
-  cleanDenaturalizedDataset: () => (/* reexport */ cleanDenaturalizedDataset),
-  colorPickerDialog: () => (/* reexport */ colorPickerDialog),
-  createReportAsync: () => (/* reexport */ Actions_createReportAsync),
-  createReportDialogPrompt: () => (/* reexport */ CreateReportDialogPrompt),
+  tm: () => (/* reexport */ StaticWadoClient),
+  M7: () => (/* reexport */ Toolbar/* Toolbar */.M),
+  OO: () => (/* reexport */ Toolbox),
+  l5: () => (/* reexport */ callInputDialog),
+  fq: () => (/* reexport */ callInputDialogAutoComplete),
+  wZ: () => (/* reexport */ cleanDenaturalizedDataset),
+  wS: () => (/* reexport */ colorPickerDialog),
+  Vy: () => (/* reexport */ Actions_createReportAsync),
+  tc: () => (/* reexport */ CreateReportDialogPrompt),
   "default": () => (/* binding */ default_src),
-  dicomWebUtils: () => (/* reexport */ utils_namespaceObject),
-  getStudiesForPatientByMRN: () => (/* reexport */ Panels_getStudiesForPatientByMRN),
-  promptLabelAnnotation: () => (/* reexport */ utils_promptLabelAnnotation),
-  promptSaveReport: () => (/* reexport */ utils_promptSaveReport),
-  requestDisplaySetCreationForStudy: () => (/* reexport */ Panels_requestDisplaySetCreationForStudy),
-  useDisplaySetSelectorStore: () => (/* reexport */ useDisplaySetSelectorStore),
-  useHangingProtocolStageIndexStore: () => (/* reexport */ useHangingProtocolStageIndexStore),
-  usePatientInfo: () => (/* reexport */ hooks_usePatientInfo),
-  useToggleHangingProtocolStore: () => (/* reexport */ useToggleHangingProtocolStore),
-  useToggleOneUpViewportGridStore: () => (/* reexport */ useToggleOneUpViewportGridStore),
-  useUIStateStore: () => (/* reexport */ useUIStateStore),
-  useViewportGridStore: () => (/* reexport */ useViewportGridStore),
-  useViewportsByPositionStore: () => (/* reexport */ useViewportsByPositionStore),
-  utils: () => (/* reexport */ src_utils_namespaceObject)
+  CA: () => (/* reexport */ utils_namespaceObject),
+  uR: () => (/* reexport */ utils_promptLabelAnnotation),
+  MP: () => (/* reexport */ utils_promptSaveReport),
+  Z: () => (/* reexport */ Panels_requestDisplaySetCreationForStudy),
+  Yd: () => (/* reexport */ useToggleOneUpViewportGridStore),
+  FS: () => (/* reexport */ useUIStateStore)
 });
 
-// NAMESPACE OBJECT: ../../../extensions/default/src/CustomizableContextMenu/types.ts
-var types_namespaceObject = {};
-__webpack_require__.r(types_namespaceObject);
+// UNUSED EXPORTS: ContextMenuController, CustomizableContextMenuTypes, MoreDropdownMenu, PanelStudyBrowserHeader, getStudiesForPatientByMRN, useDisplaySetSelectorStore, useHangingProtocolStageIndexStore, usePatientInfo, useToggleHangingProtocolStore, useViewportGridStore, useViewportsByPositionStore, utils
 
 // NAMESPACE OBJECT: ../../../extensions/default/src/DicomWebDataSource/utils/index.ts
 var utils_namespaceObject = {};
 __webpack_require__.r(utils_namespaceObject);
 __webpack_require__.d(utils_namespaceObject, {
-  cleanDenaturalizedDataset: () => (cleanDenaturalizedDataset),
-  fixBulkDataURI: () => (fixBulkDataURI),
-  fixMultiValueKeys: () => (fixMultiValueKeys),
-  transferDenaturalizedDataset: () => (transferDenaturalizedDataset)
-});
-
-// NAMESPACE OBJECT: ../../../extensions/default/src/utils/index.ts
-var src_utils_namespaceObject = {};
-__webpack_require__.r(src_utils_namespaceObject);
-__webpack_require__.d(src_utils_namespaceObject, {
-  Toolbox: () => (Toolbox),
-  addIcon: () => (addIcon)
+  wZ: () => (cleanDenaturalizedDataset),
+  Uk: () => (fixMultiValueKeys),
+  If: () => (transferDenaturalizedDataset)
 });
 
 // EXTERNAL MODULE: ../../../node_modules/dicomweb-client/build/dicomweb-client.es.js
@@ -2739,12 +2714,97 @@ function retrieveBulkData(value, options = {}) {
 
 // EXTERNAL MODULE: ../../../node_modules/query-string/index.js
 var query_string = __webpack_require__(98985);
+;// ../../../extensions/default/src/utils/secureConfigFetch.js
+// @ts-nocheck
+
+function normalizeAllowedOrigins(allowedOrigins = []) {
+  if (!Array.isArray(allowedOrigins)) {
+    return [];
+  }
+  const configuredOrigins = allowedOrigins.filter(origin => typeof origin === 'string').map(origin => origin.trim()).filter(Boolean);
+  return configuredOrigins.map(origin => {
+    try {
+      const parsedOrigin = new URL(origin);
+      if (!['http:', 'https:'].includes(parsedOrigin.protocol)) {
+        console.error(`[secureConfigFetch] Ignoring misconfigured allowed origin "${origin}". ` + 'Entries must use http:// or https://.');
+        return null;
+      }
+      if (parsedOrigin.username || parsedOrigin.password || parsedOrigin.pathname !== '/' || parsedOrigin.search || parsedOrigin.hash) {
+        console.error(`[secureConfigFetch] Ignoring misconfigured allowed origin "${origin}". ` + 'Entries must be bare origins only (scheme + host + optional port), with no username/password, path, query, or hash.');
+        return null;
+      }
+      return parsedOrigin.origin;
+    } catch {
+      console.error(`[secureConfigFetch] Ignoring misconfigured allowed origin "${origin}". Entry is not a valid URL.`);
+      return null;
+    }
+  }).filter(Boolean);
+}
+function resolveConfigUrl(rawUrl) {
+  if (!rawUrl || typeof rawUrl !== 'string') {
+    throw new Error('Missing required "url" query parameter');
+  }
+  try {
+    return new URL(rawUrl, window.location.href);
+  } catch {
+    throw new Error('Invalid URL in "url" query parameter');
+  }
+}
+function resolveConfigFetchPolicy(rawUrl, policy = {}) {
+  const {
+    allowedOrigins = [],
+    userAuthenticationService
+  } = policy;
+  const parsedUrl = resolveConfigUrl(rawUrl);
+  const protocol = parsedUrl.protocol.toLowerCase();
+  const isSameOrigin = parsedUrl.origin === window.location.origin;
+  if (!['http:', 'https:'].includes(protocol)) {
+    throw new Error('Only HTTP(S) URLs are allowed for dynamic datasource configuration');
+  }
+  if (parsedUrl.hash) {
+    throw new Error('URL fragments are not allowed for dynamic datasource configuration');
+  }
+  if (parsedUrl.username || parsedUrl.password) {
+    throw new Error('URL userinfo is not allowed for dynamic datasource configuration');
+  }
+  const isAuthenticated = Boolean(userAuthenticationService?.getAuthorizationHeader?.()?.Authorization);
+  if (isAuthenticated && !isSameOrigin) {
+    const normalizedAllowedOrigins = normalizeAllowedOrigins(allowedOrigins);
+    if (!normalizedAllowedOrigins.length || !normalizedAllowedOrigins.includes(parsedUrl.origin)) {
+      throw new Error(`Blocked remote configuration origin "${parsedUrl.origin}" in authenticated environment`);
+    }
+  }
+  return {
+    parsedUrl,
+    normalizedUrl: parsedUrl.toString(),
+    isAuthenticated,
+    isSameOrigin
+  };
+}
+async function fetchConfigJson(normalizedPolicy) {
+  const {
+    normalizedUrl
+  } = normalizedPolicy;
+  const response = await fetch(normalizedUrl, {
+    method: 'GET',
+    mode: 'cors',
+    credentials: 'same-origin',
+    redirect: 'error',
+    referrerPolicy: 'no-referrer'
+  });
+  if (!response.ok) {
+    throw new Error(`Failed to fetch dynamic datasource configuration (${response.status})`);
+  }
+  return response.json();
+}
+
 ;// ../../../extensions/default/src/DicomJSONDataSource/index.js
 
 
 
 
 
+
 const DicomJSONDataSource_metadataProvider = src/* default.classes */.Ay.classes.MetadataProvider;
 const mappings = {
   studyInstanceUid: 'StudyInstanceUID',
@@ -2791,7 +2851,10 @@ const findStudies = (key, value) => {
   });
   return studies;
 };
-function createDicomJSONApi(dicomJsonConfig) {
+function createDicomJSONApi(dicomJsonConfig, servicesManager) {
+  const {
+    userAuthenticationService
+  } = servicesManager.services;
   const implementation = {
     initialize: async ({
       query,
@@ -2800,7 +2863,11 @@ function createDicomJSONApi(dicomJsonConfig) {
       if (!url) {
         url = query.get('url');
       }
-      let metaData = getMetaDataByURL(url);
+      const evaluatedUrl = resolveConfigFetchPolicy(url, {
+        allowedOrigins: dicomJsonConfig.dangerouslyAllowedOriginsForAuthenticatedEnvironments,
+        userAuthenticationService
+      });
+      let metaData = getMetaDataByURL(evaluatedUrl.normalizedUrl);
 
       // if we have already cached the data from this specific url
       // We are only handling one StudyInstanceUID to run; however,
@@ -2810,8 +2877,7 @@ function createDicomJSONApi(dicomJsonConfig) {
           return aStudy.StudyInstanceUID;
         });
       }
-      const response = await fetch(url);
-      const data = await response.json();
+      const data = await fetchConfigJson(evaluatedUrl);
       let StudyInstanceUID;
       let SeriesInstanceUID;
       data.studies.forEach(study => {
@@ -2841,10 +2907,10 @@ function createDicomJSONApi(dicomJsonConfig) {
         });
       });
       _store.urls.push({
-        url,
+        url: evaluatedUrl.normalizedUrl,
         studies: [...data.studies]
       });
-      _store.studyInstanceUIDMap.set(url, data.studies.map(study => study.StudyInstanceUID));
+      _store.studyInstanceUIDMap.set(evaluatedUrl.normalizedUrl, data.studies.map(study => study.StudyInstanceUID));
     },
     query: {
       studies: {
@@ -2979,6 +3045,8 @@ function createDicomJSONApi(dicomJsonConfig) {
         console.warn(' DICOMJson store dicom not implemented');
       }
     },
+    reject: {},
+    deleteStudyMetadataPromise: () => {},
     getImageIdsForDisplaySet(displaySet) {
       const images = displaySet.images;
       const imageIds = [];
@@ -3037,8 +3105,20 @@ function createDicomJSONApi(dicomJsonConfig) {
       query
     }) => {
       const url = query.get('url');
-      return _store.studyInstanceUIDMap.get(url);
-    }
+      if (!url) {
+        return;
+      }
+      try {
+        const evaluatedUrl = resolveConfigFetchPolicy(url, {
+          allowedOrigins: dicomJsonConfig.dangerouslyAllowedOriginsForAuthenticatedEnvironments,
+          userAuthenticationService
+        });
+        return _store.studyInstanceUIDMap.get(evaluatedUrl.normalizedUrl);
+      } catch {
+        return;
+      }
+    },
+    getConfig: () => dicomJsonConfig
   };
   return src/* IWebApiDataSource */.pt.create(implementation);
 }
@@ -3307,6 +3387,7 @@ function createDicomLocalApi(dicomLocalConfig) {
 
 
 
+
 /**
  * This datasource is initialized with a url that returns a JSON object with a
  * dicomWeb datasource configuration array present in a "servers" object.
@@ -3319,6 +3400,9 @@ function createDicomWebProxyApi(dicomWebProxyConfig, servicesManager) {
   const {
     name
   } = dicomWebProxyConfig;
+  const {
+    userAuthenticationService
+  } = servicesManager.services;
   let dicomWebDelegate = undefined;
   const implementation = {
     initialize: async ({
@@ -3329,8 +3413,11 @@ function createDicomWebProxyApi(dicomWebProxyConfig, servicesManager) {
       if (!url) {
         throw new Error(`No url for '${name}'`);
       } else {
-        const response = await fetch(url);
-        const data = await response.json();
+        const evaluatedUrl = resolveConfigFetchPolicy(url, {
+          allowedOrigins: dicomWebProxyConfig.dangerouslyAllowedOriginsForAuthenticatedEnvironments,
+          userAuthenticationService
+        });
+        const data = await fetchConfigJson(evaluatedUrl);
         if (!data.servers?.dicomWeb?.[0]) {
           throw new Error('Invalid configuration returned by url');
         }
@@ -3361,9 +3448,15 @@ function createDicomWebProxyApi(dicomWebProxyConfig, servicesManager) {
     store: {
       dicom: (...args) => dicomWebDelegate.store.dicom(...args)
     },
-    deleteStudyMetadataPromise: (...args) => dicomWebDelegate.deleteStudyMetadataPromise(...args),
-    getImageIdsForDisplaySet: (...args) => dicomWebDelegate.getImageIdsForDisplaySet(...args),
-    getImageIdsForInstance: (...args) => dicomWebDelegate.getImageIdsForInstance(...args),
+    reject: {
+      series: (...args) => dicomWebDelegate?.reject?.series?.(...args)
+    },
+    deleteStudyMetadataPromise: (...args) => dicomWebDelegate?.deleteStudyMetadataPromise?.(...args),
+    getImageIdsForDisplaySet: (...args) => dicomWebDelegate?.getImageIdsForDisplaySet?.(...args),
+    getImageIdsForInstance: (...args) => dicomWebDelegate?.getImageIdsForInstance?.(...args),
+    getConfig: (...args) => dicomWebDelegate?.getConfig?.(...args) ?? {
+      dicomUploadEnabled: false
+    },
     getStudyInstanceUIDs({
       params,
       query
@@ -5847,6 +5940,7 @@ function ToolButtonWrapper(props) {
 }
 
 ;// ../../../extensions/default/src/Toolbar/ToolbarDivider.tsx
+/* unused harmony import specifier */ var React;
 
 function ToolbarDivider() {
   return /*#__PURE__*/React.createElement("span", {
@@ -10422,8 +10516,8 @@ function AboutModalDefault() {
     name
   } = (0,browser_detect_es5/* default */.A)();
   const browser = `${name[0].toUpperCase()}${name.substr(1)} ${version}`;
-  const versionNumber = "3.12.0";
-  const commitHash = "27b1afe040061c6afc15bf131e28cdff3a5f0ec7";
+  const versionNumber = "3.12.1";
+  const commitHash = "647fd025cf7212acc03b66807974f5d0f8ba0708";
   const [main, beta] = versionNumber.split('-');
   return /*#__PURE__*/react.createElement(ui_next_src/* AboutModal */.VTU, {
     className: "w-[400px]"
@@ -11615,11 +11709,12 @@ function promptLabelAnnotation({
 // EXTERNAL MODULE: ../../../extensions/default/src/Panels/StudyBrowser/PanelStudyBrowserHeader.tsx
 var PanelStudyBrowserHeader = __webpack_require__(3329);
 ;// ../../../extensions/default/src/utils/addIcon.ts
+/* unused harmony import specifier */ var Icons;
 
 
 /** Adds the icon to both ui and ui-next */
 function addIcon(name, icon) {
-  ui_next_src/* Icons */.FI1.addIcon(name, icon);
+  Icons.addIcon(name, icon);
 }
 ;// ../../../extensions/default/src/utils/Toolbox.tsx
 function Toolbox_extends() { return Toolbox_extends = Object.assign ? Object.assign.bind() : function (n) { for (var e = 1; e < arguments.length; e++) { var t = arguments[e]; for (var r in t) ({}).hasOwnProperty.call(t, r) && (n[r] = t[r]); } return n; }, Toolbox_extends.apply(null, arguments); }
@@ -11811,10 +11906,10 @@ const defaultExtension = {
 /* harmony default export */ const default_src = (defaultExtension);
 
 
-/***/ }),
+/***/ },
 
-/***/ 96357:
-/***/ ((__unused_webpack_module, __webpack_exports__, __webpack_require__) => {
+/***/ 96357
+(__unused_webpack_module, __webpack_exports__, __webpack_require__) {
 
 /* harmony export */ __webpack_require__.d(__webpack_exports__, {
 /* harmony export */   A: () => (__WEBPACK_DEFAULT_EXPORT__)
@@ -11829,6 +11924,6 @@ const RESPONSE = {
 };
 /* harmony default export */ const __WEBPACK_DEFAULT_EXPORT__ = (RESPONSE);
 
-/***/ })
+/***/ }
 
 }]);