yakuza0 2.22.30-beta.2 → 2.22.30-beta.4

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "yakuza0",
-  "version": "2.22.30-beta.2",
+  "version": "2.22.30-beta.4",
   "description": "yakuza0 with nuxt",
   "main": "index.js",
   "scripts": {

package/server/proxy/csrf.js

@@ -279,9 +279,18 @@ exports.default = function () {
                 // crossOriginEmbedderPolicy: true,
                 // crossOriginResourcePolicy: { policy: "cross-origin" },
                 // crossOriginResourcePolicy: { policy: "same-origin" }
+                // contentSecurityPolicy: yConf.server.csp.decoration,
               };
 
 
+              if (_config2.default.server.csp.decoration === true) {
+                helmetOptions.contentSecurityPolicy = {
+                  directives: _config2.default.server.csp.directives
+                };
+              } else {
+                helmetOptions.contentSecurityPolicy = false;
+              }
+
               if (!_config2.default.server.hm.crossOriginEmbedderPolicy) {
                 // helmetOptions.crossOriginEmbedderPolicy = { policy: "credentialless" };
                 helmetOptions.crossOriginEmbedderPolicy = false;
@@ -444,12 +453,6 @@ exports.default = function () {
                     return _ref5.apply(this, arguments);
                   };
                 }());
-              } else {
-                if (_config2.default.server.csp.decoration === true) {
-                  app.use(_koaHelmet2.default.contentSecurityPolicy({
-                    directives: _config2.default.server.csp.directives
-                  }));
-                }
               }
             }
 

package/template/storage.plugin.js

@@ -4,6 +4,18 @@ import {shtml} from 'yakuza1/lib/xss';
 import yConf from 'yakuza0/config';
 import {connect, req} from 'yakuza1/lib/ws';
 
+const oToStr = (obj) => {
+  if (obj && typeof obj !== "string") {
+    try {
+      return JSON.stringify(obj);
+    } catch (e) {
+      return obj
+    }
+  }
+
+  return obj
+}
+
 export default async (ctx, inject) => {
   const { $http, $utils, $yk } = ctx;
   const event = {
@@ -51,7 +63,7 @@ export default async (ctx, inject) => {
         })
 
         if ($yk.security.stupid) {
-          return shtml(result && result.data);
+          return shtml(oToStr(result && result.data));
         }
 
         return result && result.data
@@ -108,7 +120,7 @@ export default async (ctx, inject) => {
         })
 
         if ($yk.security.stupid) {
-          return shtml(data);
+          return shtml(oToStr(data));
         }
 
         return data;