dsh-unlag 1.9.20 → 1.9.21
This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
- package/index.js +6 -0
- package/package.json +1 -1
package/index.js
CHANGED
|
@@ -1521,6 +1521,12 @@ function serveButton(ctx, controller, config) {
|
|
|
1521
1521
|
try {
|
|
1522
1522
|
const method = String(req?.method ?? 'GET').toUpperCase()
|
|
1523
1523
|
if (method !== 'POST') return sendJson(res, 405, { status: 'method' })
|
|
1524
|
+
/**
|
|
1525
|
+
* A page on any site can post to a local address without asking first, and a log is
|
|
1526
|
+
* evidence: a made-up outcome must not get in. The header the page's own script sends
|
|
1527
|
+
* makes the request one a browser has to ask about first, and this app never agrees.
|
|
1528
|
+
*/
|
|
1529
|
+
if (typeof req?.headers?.[BUTTON_HEADER] !== 'string') return sendJson(res, 403, { status: 'forbidden' })
|
|
1524
1530
|
let query = ''
|
|
1525
1531
|
try {
|
|
1526
1532
|
query = new URL(String(req?.url ?? ''), 'http://x').searchParams.toString()
|
package/package.json
CHANGED
|
@@ -1,6 +1,6 @@
|
|
|
1
1
|
{
|
|
2
2
|
"name": "dsh-unlag",
|
|
3
|
-
"version": "1.9.
|
|
3
|
+
"version": "1.9.21",
|
|
4
4
|
"type": "module",
|
|
5
5
|
"description": "A press applies plugin edits right away and brings a laggy interface back; automatic reloading stays off unless you turn it on, so the press is the only trigger, and nothing restarts.",
|
|
6
6
|
"license": "MIT",
|