nodebb-plugin-pdf-secure 1.2.28 → 1.2.30

package/static/viewer.html

@@ -1749,6 +1749,56 @@
                 font-size: 12px;
             }
         }
+
+        /* ── Unicourse Page Watermark ── */
+        .unicourse-page-wm {
+            position: absolute;
+            bottom: calc(10px * var(--wm-scale, 1));
+            right: calc(12px * var(--wm-scale, 1));
+            z-index: 10;
+            display: flex;
+            align-items: center;
+            gap: calc(5px * var(--wm-scale, 1));
+            background: none;
+            border: none;
+            padding: 0;
+            text-decoration: none;
+            opacity: 0.7;
+            transition: opacity 0.2s ease;
+            cursor: pointer;
+            transform-origin: bottom right;
+        }
+
+        .unicourse-page-wm:hover {
+            opacity: 1;
+        }
+
+        .unicourse-page-wm img {
+            height: calc(26px * var(--wm-scale, 1));
+            width: auto;
+            display: block;
+            pointer-events: none;
+            flex-shrink: 0;
+        }
+
+        .unicourse-page-wm-text {
+            display: flex;
+            flex-direction: column;
+            align-items: flex-start;
+            gap: calc(1px * var(--wm-scale, 1));
+        }
+
+        .unicourse-page-wm-text span {
+            font-size: calc(7.5px * var(--wm-scale, 1));
+            color: #888;
+            white-space: nowrap;
+            line-height: 1.2;
+            font-weight: 600;
+        }
+
+        @media print {
+            .unicourse-page-wm { display: none !important; }
+        }
     </style>
 </head>
 
@@ -2279,24 +2329,30 @@
                 // Thumbnails will be generated on-demand when sidebar opens
             }
 
-            // Partial XOR decoder - must match backend encoding
-            function partialXorDecode(encodedData, keyBase64) {
-                const key = Uint8Array.from(atob(keyBase64), c => c.charCodeAt(0));
-                const data = new Uint8Array(encodedData);
-                const keyLen = key.length;
+            // AES-256-GCM decoder using Web Crypto API
+            async function aesGcmDecode(encodedData, keyBase64, ivBase64) {
+                const keyBytes = Uint8Array.from(atob(keyBase64), c => c.charCodeAt(0));
+                const iv = Uint8Array.from(atob(ivBase64), c => c.charCodeAt(0));
+                const encData = new Uint8Array(encodedData);
 
-                // Decrypt first 10KB fully
-                const fullDecryptLen = Math.min(10240, data.length);
-                for (let i = 0; i < fullDecryptLen; i++) {
-                    data[i] = data[i] ^ key[i % keyLen];
-                }
+                // Format: [authTag (16 bytes)] [ciphertext]
+                const authTag = encData.slice(0, 16);
+                const ciphertext = encData.slice(16);
 
-                // Decrypt every 50th byte after that
-                for (let i = fullDecryptLen; i < data.length; i += 50) {
-                    data[i] = data[i] ^ key[i % keyLen];
-                }
+                // Web Crypto expects ciphertext + authTag concatenated
+                const combined = new Uint8Array(ciphertext.length + authTag.length);
+                combined.set(ciphertext);
+                combined.set(authTag, ciphertext.length);
 
-                return data.buffer;
+                const cryptoKey = await crypto.subtle.importKey(
+                    'raw', keyBytes, { name: 'AES-GCM' }, false, ['decrypt']
+                );
+
+                return crypto.subtle.decrypt(
+                    { name: 'AES-GCM', iv: iv },
+                    cryptoKey,
+                    combined
+                );
             }
 
             function injectPageLock(pageEl) {
@@ -2307,7 +2363,7 @@
                 }
                 // Don't duplicate overlay
                 if (pageEl.querySelector('.page-lock-overlay')) return;
-                var uid = (window.PDF_SECURE_CONFIG && window.PDF_SECURE_CONFIG.uid) || 0;
+                var uid = (_cfg && _cfg.uid) || 0;
                 var checkoutUrl = 'https://forum.ieu.app/pay/checkout?uid=' + uid;
                 var overlay = document.createElement('div');
                 overlay.className = 'page-lock-overlay';
@@ -2321,8 +2377,8 @@
                     <div class="page-lock-message">Tum sayfalara erisim icin Premium satin alabilir veya materyal yukleyerek erisim kazanabilirsiniz.</div>\
                     <div class="page-lock-actions">\
                         <a href="' + checkoutUrl + '" target="_blank" class="page-lock-button">\
-                            <svg viewBox="0 0 24 24" width="18" height="18" fill="#1a1a1a"><path d="M20 4H4c-1.1 0-2 .9-2 2v12c0 1.1.9 2 2 2h16c1.1 0 2-.9 2-2V6c0-1.1-.9-2-2-2zm0 14H4V6h16v12zm-8-1h2v-4h4v-2h-4V7h-2v4H8v2h4v4z"/></svg>\
-                            Premium Satin Al\
+                            <svg viewBox="0 0 24 24" width="18" height="18" fill="#1a1a1a"><path d="M16 18v2H8v-2h8zM11 7.99V16h2V7.99h3L12 4l-4 3.99h3z"/></svg>\
+                            Hesabini Yukselt\
                         </a>\
                         <div class="page-lock-divider">ya da</div>\
                         <a href="https://forum.ieu.app/material-info" target="_blank" class="page-lock-button-secondary">\
@@ -2517,7 +2573,8 @@
                     if (!pdfBuffer) {
                         // Nonce and key are embedded in HTML config (not fetched from API)
                         const nonce = config.nonce;
-                        const xorKey = config.dk;
+                        const decryptKey = config.dk;
+                        const decryptIv = config.iv;
 
                         // Fetch encrypted PDF binary
                         const pdfUrl = config.relativePath + '/api/v3/plugins/pdf-secure/pdf-data?nonce=' + encodeURIComponent(nonce);
@@ -2530,10 +2587,10 @@
                         const encodedBuffer = await pdfRes.arrayBuffer();
                         console.log('[PDF-Secure] Encrypted data received:', encodedBuffer.byteLength, 'bytes');
 
-                        // Decode XOR encrypted data
-                        if (xorKey) {
-                            console.log('[PDF-Secure] Decoding XOR encrypted data...');
-                            pdfBuffer = partialXorDecode(encodedBuffer, xorKey);
+                        // Decrypt AES-256-GCM encrypted data
+                        if (decryptKey && decryptIv) {
+                            console.log('[PDF-Secure] Decrypting AES-256-GCM data...');
+                            pdfBuffer = await aesGcmDecode(encodedBuffer, decryptKey, decryptIv);
                         } else {
                             pdfBuffer = encodedBuffer;
                         }
@@ -2611,7 +2668,7 @@
                             <path d="M12 2C6.48 2 2 6.48 2 12s4.48 10 10 10 10-4.48 10-10S17.52 2 12 2zm1 15h-2v-2h2v2zm0-4h-2V7h2v6z"/>
                         </svg>
                         <h2>Hata</h2>
-                        <p>${err.message}</p>
+                        <p>${err.message.replace(/[<>&"']/g, c => ({'<':'&lt;','>':'&gt;','&':'&amp;','"':'&quot;',"'":'&#39;'}[c]))}</p>
                     `;
                     }
                 }
@@ -2688,9 +2745,45 @@
                 currentDrawingPage = null;
             });
 
+            // ── Unicourse page watermark injection ──
+            function injectPageWatermark(pageEl) {
+                if (!pageEl) return;
+                var scale = pdfViewer ? pdfViewer.currentScale : 1;
+                var existing = pageEl.querySelector('.unicourse-page-wm');
+                if (existing) {
+                    existing.style.setProperty('--wm-scale', scale);
+                    return;
+                }
+                pageEl.style.position = 'relative';
+                var a = document.createElement('a');
+                a.href = 'https://unicourse.co/dersler/izmir-ekonomi-universitesi';
+                a.target = '_blank';
+                a.rel = 'noopener';
+                a.className = 'unicourse-page-wm';
+                a.style.setProperty('--wm-scale', scale);
+                a.innerHTML = '<img src="https://cdn.prod.website-files.com/66c986ba4ac79c4fbbd5f45e/66c9958f0188acfb12a2d2fb_64a464c6b3b7df67c22a255b_logo_full.png" alt="unicourse">' +
+                    '<div class="unicourse-page-wm-text">' +
+                    '<span>Çıkmış sorular ve</span>' +
+                    '<span>ders notları için tıkla</span>' +
+                    '</div>';
+                pageEl.appendChild(a);
+            }
+
+            // Update all watermarks when zoom changes
+            function updateAllWatermarkScales() {
+                var scale = pdfViewer ? pdfViewer.currentScale : 1;
+                document.querySelectorAll('.unicourse-page-wm').forEach(function(wm) {
+                    wm.style.setProperty('--wm-scale', scale);
+                });
+            }
+
             eventBus.on('pagerendered', (evt) => {
                 injectAnnotationLayer(evt.pageNumber);
 
+                // Inject unicourse watermark on every page
+                var wmPageEl = document.querySelector('#viewer .page[data-page-number="' + evt.pageNumber + '"]');
+                if (wmPageEl) injectPageWatermark(wmPageEl);
+
                 // Re-inject lock overlay if this is a locked page (PDF.js re-render removes it)
                 if (premiumInfo && !premiumInfo.isPremium && evt.pageNumber > 1) {
                     var pageEl = document.querySelector('#viewer .page[data-page-number="' + evt.pageNumber + '"]');
@@ -2709,8 +2802,8 @@
             };
 
             // Zoom
-            document.getElementById('zoomIn').onclick = () => pdfViewer.currentScale += 0.25;
-            document.getElementById('zoomOut').onclick = () => pdfViewer.currentScale -= 0.25;
+            document.getElementById('zoomIn').onclick = () => { pdfViewer.currentScale += 0.25; updateAllWatermarkScales(); };
+            document.getElementById('zoomOut').onclick = () => { pdfViewer.currentScale -= 0.25; updateAllWatermarkScales(); };
 
             // Sidebar toggle (deferred thumbnail generation)
             const sidebarEl = document.getElementById('sidebar');
@@ -4794,18 +4887,21 @@
                     e.preventDefault();
                     e.stopPropagation();
                     pdfViewer.currentScale += 0.25;
+                    updateAllWatermarkScales();
                     return;
                 }
                 if ((e.ctrlKey || e.metaKey) && (key === '-' || e.code === 'Minus')) {
                     e.preventDefault();
                     e.stopPropagation();
                     pdfViewer.currentScale -= 0.25;
+                    updateAllWatermarkScales();
                     return;
                 }
                 if ((e.ctrlKey || e.metaKey) && (key === '0' || e.code === 'Digit0')) {
                     e.preventDefault();
                     e.stopPropagation();
                     pdfViewer.currentScaleValue = 'page-width';
+                    updateAllWatermarkScales();
                     return;
                 }
 
@@ -4889,8 +4985,8 @@
                     case 'highlight': setTool('highlight'); break;
                     case 'pen': setTool('pen'); break;
                     case 'text': setTool('text'); break;
-                    case 'zoomIn': pdfViewer.currentScale += 0.25; break;
-                    case 'zoomOut': pdfViewer.currentScale -= 0.25; break;
+                    case 'zoomIn': pdfViewer.currentScale += 0.25; updateAllWatermarkScales(); break;
+                    case 'zoomOut': pdfViewer.currentScale -= 0.25; updateAllWatermarkScales(); break;
                     case 'sepia': document.getElementById('sepiaBtn').click(); break;
                 }
                 contextMenu.classList.remove('visible');
@@ -4908,7 +5004,7 @@
                 if (inIframe) {
                     // In iframe: ask parent to fullscreen the iframe element
                     // Parent manages fullscreen → more stable on tablets
-                    window.parent.postMessage({ type: 'pdf-secure-fullscreen-toggle' }, '*');
+                    window.parent.postMessage({ type: 'pdf-secure-fullscreen-toggle' }, window.location.origin);
                 } else {
                     // Standalone: use local fullscreen
                     const fsEl = document.fullscreenElement || document.webkitFullscreenElement;
@@ -4995,6 +5091,7 @@
                     } else {
                         pdfViewer.currentScale -= 0.1;
                     }
+                    updateAllWatermarkScales();
                 }
             }, { passive: false });
 
@@ -5181,6 +5278,7 @@
                         const oldScrollTop = container.scrollTop;
 
                         pdfViewer.currentScale = finalScale;
+                        updateAllWatermarkScales();
 
                         // Adjust scroll after PDF.js re-render to keep view centered
                         requestAnimationFrame(() => {
@@ -5459,6 +5557,7 @@
             // End of main IIFE - pdfDoc, pdfViewer not accessible from console
         })();
     </script>
+
 </body>
 
 </html>

package/static/lib/viewer.js

@@ -1,184 +0,0 @@
-import { getDocument, GlobalWorkerOptions } from './pdf.min.mjs';
-
-GlobalWorkerOptions.workerSrc = new URL('./pdf.worker.min.mjs', import.meta.url).href;
-console.log('[PDF-Secure][Viewer] ES module loaded, worker:', GlobalWorkerOptions.workerSrc);
-
-// Listen for NodeBB SPA navigations (jQuery event)
-$(window).on('action:ajaxify.end', function () {
-	console.log('[PDF-Secure][Viewer] action:ajaxify.end fired');
-	interceptPdfLinks();
-});
-
-// Also run immediately for the current page
-console.log('[PDF-Secure][Viewer] Running initial interceptPdfLinks...');
-interceptPdfLinks();
-
-function interceptPdfLinks() {
-	var postContents = document.querySelectorAll('[component="post/content"]');
-	console.log('[PDF-Secure][Viewer] Found ' + postContents.length + ' post areas');
-
-	postContents.forEach(function (content, idx) {
-		var pdfLinks = content.querySelectorAll('a[href$=".pdf"], a[href$=".PDF"]');
-		console.log('[PDF-Secure][Viewer] Post #' + idx + ': ' + pdfLinks.length + ' PDF links');
-
-		pdfLinks.forEach(function (link) {
-			if (link.dataset.pdfSecure) return;
-			link.dataset.pdfSecure = 'true';
-
-			var href = link.getAttribute('href');
-			var parts = href.split('/');
-			var filename = parts[parts.length - 1];
-			console.log('[PDF-Secure][Viewer] Processing:', filename);
-
-			var container = document.createElement('div');
-			container.className = 'pdf-secure-inline';
-			container.innerHTML =
-				'<div class="pdf-secure-inline-header">' +
-					'<i class="fa fa-file-pdf-o"></i> ' +
-					'<span class="pdf-secure-filename">' + escapeHtml(link.textContent || filename) + '</span>' +
-				'</div>' +
-				'<div class="pdf-secure-inline-body">' +
-					'<div class="pdf-secure-loading">Loading PDF...</div>' +
-					'<div class="pdf-secure-error"></div>' +
-					'<canvas class="pdf-secure-canvas"></canvas>' +
-				'</div>' +
-				'<div class="pdf-secure-inline-footer">' +
-					'<button class="pdf-secure-prev" disabled>&#8249; Prev</button>' +
-					'<span class="pdf-secure-page-info"></span>' +
-					'<button class="pdf-secure-next" disabled>Next &#8250;</button>' +
-				'</div>';
-
-			link.replaceWith(container);
-			console.log('[PDF-Secure][Viewer] Container created for:', filename);
-
-			loadPdf(container, filename);
-		});
-	});
-}
-
-async function loadPdf(container, filename) {
-	var loadingEl = container.querySelector('.pdf-secure-loading');
-	var errorEl = container.querySelector('.pdf-secure-error');
-	var canvas = container.querySelector('.pdf-secure-canvas');
-	var footer = container.querySelector('.pdf-secure-inline-footer');
-	var prevBtn = container.querySelector('.pdf-secure-prev');
-	var nextBtn = container.querySelector('.pdf-secure-next');
-	var pageInfo = container.querySelector('.pdf-secure-page-info');
-	var bodyEl = container.querySelector('.pdf-secure-inline-body');
-
-	function showError(msg) {
-		console.error('[PDF-Secure][Viewer] ERROR ' + filename + ':', msg);
-		loadingEl.style.display = 'none';
-		canvas.style.display = 'none';
-		errorEl.style.display = 'flex';
-		errorEl.textContent = msg;
-	}
-
-	try {
-		// Step 1: Fetch nonce
-		var nonceUrl = config.relative_path + '/api/v3/plugins/pdf-secure/nonce?file=' + encodeURIComponent(filename);
-		console.log('[PDF-Secure][Viewer] Step 1 - Nonce request:', nonceUrl);
-
-		var nonceRes = await fetch(nonceUrl, {
-			credentials: 'same-origin',
-			headers: { 'x-csrf-token': config.csrf_token },
-		});
-		console.log('[PDF-Secure][Viewer] Step 1 - Status:', nonceRes.status);
-
-		if (!nonceRes.ok) {
-			showError(nonceRes.status === 401 ? 'Log in to view this PDF.' : 'Failed to load PDF (' + nonceRes.status + ')');
-			return;
-		}
-
-		var result = await nonceRes.json();
-		var nonce = result.response.nonce;
-		console.log('[PDF-Secure][Viewer] Step 1 - Nonce:', nonce);
-
-		// Step 2: Fetch PDF binary
-		var pdfUrl = config.relative_path + '/api/v3/plugins/pdf-secure/pdf-data?nonce=' + encodeURIComponent(nonce);
-		console.log('[PDF-Secure][Viewer] Step 2 - PDF request:', pdfUrl);
-
-		var pdfRes = await fetch(pdfUrl, { credentials: 'same-origin' });
-		console.log('[PDF-Secure][Viewer] Step 2 - Status:', pdfRes.status);
-
-		if (!pdfRes.ok) {
-			showError('Failed to load PDF data (' + pdfRes.status + ')');
-			return;
-		}
-
-		var pdfArrayBuffer = await pdfRes.arrayBuffer();
-		console.log('[PDF-Secure][Viewer] Step 2 - PDF loaded:', pdfArrayBuffer.byteLength, 'bytes');
-
-		// Step 3: Render PDF
-		console.log('[PDF-Secure][Viewer] Step 3 - Rendering...');
-		var pdfDoc = await getDocument({ data: new Uint8Array(pdfArrayBuffer) }).promise;
-		var totalPages = pdfDoc.numPages;
-		console.log('[PDF-Secure][Viewer] Step 3 - Pages:', totalPages);
-
-		loadingEl.style.display = 'none';
-		canvas.style.display = 'block';
-
-		// Security: scoped to container
-		container.addEventListener('contextmenu', function (e) { e.preventDefault(); });
-		container.addEventListener('dragstart', function (e) { e.preventDefault(); });
-		container.addEventListener('selectstart', function (e) { e.preventDefault(); });
-
-		var ctx = canvas.getContext('2d');
-		var currentPage = 1;
-		var rendering = false;
-
-		async function renderPage(pageNum) {
-			if (rendering) return;
-			rendering = true;
-			console.log('[PDF-Secure][Viewer] renderPage(' + pageNum + ')');
-
-			try {
-				var page = await pdfDoc.getPage(pageNum);
-				var containerWidth = bodyEl.clientWidth - 20;
-				var vp = page.getViewport({ scale: 1 });
-				var scale = Math.min(containerWidth / vp.width, 2.0);
-				var scaled = page.getViewport({ scale: scale });
-
-				canvas.width = scaled.width;
-				canvas.height = scaled.height;
-
-				await page.render({ canvasContext: ctx, viewport: scaled }).promise;
-
-				currentPage = pageNum;
-				pageInfo.textContent = currentPage + ' / ' + totalPages;
-				prevBtn.disabled = currentPage <= 1;
-				nextBtn.disabled = currentPage >= totalPages;
-				console.log('[PDF-Secure][Viewer] renderPage(' + pageNum + ') done, canvas:', scaled.width + 'x' + scaled.height);
-			} catch (err) {
-				console.error('[PDF-Secure][Viewer] Render error:', err);
-				showError('Error rendering page.');
-			}
-			rendering = false;
-		}
-
-		await renderPage(1);
-
-		if (totalPages > 1) {
-			footer.style.display = 'flex';
-			prevBtn.addEventListener('click', function () {
-				if (currentPage > 1) renderPage(currentPage - 1);
-			});
-			nextBtn.addEventListener('click', function () {
-				if (currentPage < totalPages) renderPage(currentPage + 1);
-			});
-			console.log('[PDF-Secure][Viewer] Navigation enabled (' + totalPages + ' pages)');
-		}
-
-		console.log('[PDF-Secure][Viewer] DONE for:', filename);
-	} catch (err) {
-		console.error('[PDF-Secure][Viewer] CATCH:', err);
-		console.error('[PDF-Secure][Viewer] Stack:', err.stack);
-		showError('Failed to load PDF.');
-	}
-}
-
-function escapeHtml(str) {
-	var d = document.createElement('div');
-	d.textContent = str;
-	return d.innerHTML;
-}