web-manager 3.0.4 → 3.0.7

package/index.js

@@ -287,10 +287,12 @@ function Manager() {
     }
   }
 
+
+
   function _authHandle_in_normal(This, user) {
     var domLib = This.dom();
     var returnUrl = This.properties.page.queryString.get('auth_redirect');
-    if (returnUrl) {
+    if (returnUrl && This.isValidRedirectUrl(returnUrl)) {
       window.location.href = decodeURIComponent(returnUrl);
       return;
     }
@@ -624,11 +626,13 @@ function Manager() {
           This.properties.page.queryString = new URLSearchParams(window.location.search);
           var pageQueryString = This.properties.page.queryString
           var pagePathname = window.location.pathname;
-          if (pageQueryString.get('aff')) {
-            This.storage().set('auth.affiliateCode', pageQueryString.get('aff'));
+          var qsAff = pageQueryString.get('aff');
+          if (qsAff) {
+            This.storage().set('auth.affiliateCode', qsAff);
           }
-          if (pageQueryString.get('redirect')) {
-            window.location.href = decodeURIComponent(pageQueryString.get('redirect'));
+          var qsRedirect = pageQueryString.get('redirect');
+          if (qsRedirect && This.isValidRedirectUrl(qsRedirect)) {
+            window.location.href = decodeURIComponent(qsRedirect);
             return;
           }
           var authRegex = /\/(signin|signup|forgot)\//;
@@ -990,14 +994,19 @@ function Manager() {
       signOut: function() {
         // This.log('signOut()');
         // var This = this;
-        firebase.auth().signOut()
-        .then(function() {
-          // This.log('signOut success.');
-        })
+        return firebase.auth().signOut()
         .catch(function(e) {
           console.error(e);
           // This.log('signOut failed: ', error);
         });
+        // return firebase.auth().signOut()
+        // .then(function() {
+        //   // This.log('signOut success.');
+        // })
+        // .catch(function(e) {
+        //   // console.error(e);
+        //   // This.log('signOut failed: ', error);
+        // });
       },
       forgot: function(email) {
         // This.log('forgot()');
@@ -1609,7 +1618,7 @@ function Manager() {
   //     }
   //   }
   // }
-  Manager.prototype.performance = function() {
+  Manager.prototype.performance = function () {
     return {
       mark: function(mark) {
         try {
@@ -1620,6 +1629,13 @@ function Manager() {
     }
   }
 
+  Manager.prototype.isValidRedirectUrl = function (url) {
+    var returnUrlObject = new URL(decodeURIComponent(url));
+    var currentUrlObject = new URL(window.location.href);
+    return returnUrlObject.host === currentUrlObject.host
+      || returnUrlObject.protocol === this.properties.global.app + ':'
+  }
+
   // Manager.prototype.performance = function() {
   //   var This = this;
   //

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "web-manager",
-  "version": "3.0.4",
+  "version": "3.0.7",
   "description": "Easily access important variables such as the query string, current domain, and current page in a single object.",
   "main": "index.js",
   "scripts": {