dsh-unlag 1.9.20 → 1.9.22

package/client.js

@@ -606,7 +606,15 @@ window.__ModuleLoader__.load({
           : BUTTON_STYLE;
 
       const onClick = async () => {
-        if (pending || pressInFlight) return;
+        // A press already running is joined, and the press that joined says so instead of nothing.
+        if (pressInFlight) {
+          setNotice(COPY.applying);
+          return;
+        }
+        if (pending) {
+          setNotice(COPY.applying);
+          return;
+        }
         // A press the page already answered is not answered twice. Saying so beats a dead button.
         if (Date.now() - stampRead() < 3000) { // ui-copy-ignore
           setNotice(COPY.applying);

package/index.js

@@ -1521,6 +1521,12 @@ function serveButton(ctx, controller, config) {
         try {
           const method = String(req?.method ?? 'GET').toUpperCase()
           if (method !== 'POST') return sendJson(res, 405, { status: 'method' })
+          /**
+           * A page on any site can post to a local address without asking first, and a log is
+           * evidence: a made-up outcome must not get in. The header the page's own script sends
+           * makes the request one a browser has to ask about first, and this app never agrees.
+           */
+          if (typeof req?.headers?.[BUTTON_HEADER] !== 'string') return sendJson(res, 403, { status: 'forbidden' })
           let query = ''
           try {
             query = new URL(String(req?.url ?? ''), 'http://x').searchParams.toString()

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "dsh-unlag",
-  "version": "1.9.20",
+  "version": "1.9.22",
   "type": "module",
   "description": "A press applies plugin edits right away and brings a laggy interface back; automatic reloading stays off unless you turn it on, so the press is the only trigger, and nothing restarts.",
   "license": "MIT",