@spirobel/monero-wallet-api 0.6.9 → 0.6.11
This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
- package/dist/tools/content.d.ts +2 -1
- package/dist/tools/content.js +13 -2
- package/package.json +1 -1
package/dist/tools/content.d.ts
CHANGED
|
@@ -17,5 +17,6 @@ declare global {
|
|
|
17
17
|
}
|
|
18
18
|
export declare function interceptToolLinkCallback(e: Event): void;
|
|
19
19
|
export declare function deliverToolUrl(url: string): boolean;
|
|
20
|
-
export declare function
|
|
20
|
+
export declare function DefaultConfirmationCallback(loc_href: string): boolean;
|
|
21
|
+
export declare function installToolLinkEventInterception(confirmationcallback?: (loc_href: string) => boolean): void;
|
|
21
22
|
export {};
|
package/dist/tools/content.js
CHANGED
|
@@ -41,6 +41,10 @@ function deliver(monerotoolLink) {
|
|
|
41
41
|
});
|
|
42
42
|
}
|
|
43
43
|
export function interceptToolLinkCallback(e) {
|
|
44
|
+
// page script can call a.click(). the browser sets isTrusted false on such events.
|
|
45
|
+
// only real user input passes here.
|
|
46
|
+
if (!e.isTrusted)
|
|
47
|
+
return;
|
|
44
48
|
const link = anchorFromEvent(e);
|
|
45
49
|
const monerotoolLink = processTargetLink(link);
|
|
46
50
|
if (!link || !monerotoolLink)
|
|
@@ -67,9 +71,16 @@ export function deliverToolUrl(url) {
|
|
|
67
71
|
deliver(invo);
|
|
68
72
|
return true;
|
|
69
73
|
}
|
|
70
|
-
export function
|
|
74
|
+
export function DefaultConfirmationCallback(loc_href) {
|
|
75
|
+
return window.confirm("Did you just follow a monerochan tool link?");
|
|
76
|
+
}
|
|
77
|
+
export function installToolLinkEventInterception(confirmationcallback = DefaultConfirmationCallback) {
|
|
71
78
|
document.addEventListener("click", interceptToolLinkCallback, true);
|
|
72
79
|
document.addEventListener("touchend", interceptToolLinkCallback, true);
|
|
73
80
|
document.addEventListener("keydown", interceptToolLinkCallback, true);
|
|
74
|
-
|
|
81
|
+
// direct tool open is the page url itself. that is always the top frame.
|
|
82
|
+
// an iframe src with a tool link is a page embedding a payment the user never opened.
|
|
83
|
+
if (window.top === window && confirmationcallback(location.href)) {
|
|
84
|
+
deliverToolUrl(location.href);
|
|
85
|
+
}
|
|
75
86
|
}
|