yakuza0 2.22.30-beta.6 → 2.22.30-beta.8

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "yakuza0",
-  "version": "2.22.30-beta.6",
+  "version": "2.22.30-beta.8",
   "description": "yakuza0 with nuxt",
   "main": "index.js",
   "scripts": {

package/server/proxy/csrf.js

@@ -274,7 +274,7 @@ exports.default = function () {
                 // referrerPolicy: { policy: "strict-origin-when-cross-origin" },
                 // referrerPolicy: yConf.stupid.referrerPolicy.policy,
                 // referrerPolicy: { policy: "origin-when-crossorigin" },
-                // referrerPolicy: yConf.server.stupid.referrerPolicy,
+                referrerPolicy: _config2.default.server.stupid.referrerPolicy
                 // crossOriginResourcePolicy: yConf.server.hm.crossOriginEmbedderPolicy,
                 // crossOriginEmbedderPolicy: true,
                 // crossOriginResourcePolicy: { policy: "cross-origin" },
@@ -300,7 +300,6 @@ exports.default = function () {
               }
 
               if (_config2.default.security.isStupid) {
-                helmetOptions.referrerPolicy = _config2.default.server.stupid.referrerPolicy;
                 // helmetOptions.crossOriginResourcePolicy = yConf.server.stupid.crossOriginResourcePolicy;
               }
 

package/template/storage.plugin.js

@@ -4,10 +4,12 @@ import {shtml} from 'yakuza1/lib/xss';
 import yConf from 'yakuza0/config';
 import {connect, req} from 'yakuza1/lib/ws';
 
-const oToStr = (obj) => {
+const shtmlFilter = (obj) => {
   if (obj && typeof obj !== "string") {
     try {
-      return JSON.stringify(obj);
+      const str = JSON.stringify(obj);
+      const filter = shtml(str);
+      return JSON.parse(filter)
     } catch (e) {
       return obj
     }
@@ -63,7 +65,7 @@ export default async (ctx, inject) => {
         })
 
         if ($yk.security.stupid) {
-          return shtml(oToStr(result && result.data));
+          return shtmlFilter(result && result.data);
         }
 
         return result && result.data
@@ -120,7 +122,7 @@ export default async (ctx, inject) => {
         })
 
         if ($yk.security.stupid) {
-          return shtml(oToStr(data));
+          return shtmlFilter(data);
         }
 
         return data;