yakuza0 2.22.30 → 2.22.31

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "yakuza0",
-  "version": "2.22.30",
+  "version": "2.22.31",
   "description": "yakuza0 with nuxt",
   "main": "index.js",
   "scripts": {

package/server/proxy/csrf.js

@@ -274,7 +274,7 @@ exports.default = function () {
                 // referrerPolicy: { policy: "strict-origin-when-cross-origin" },
                 // referrerPolicy: yConf.stupid.referrerPolicy.policy,
                 // referrerPolicy: { policy: "origin-when-crossorigin" },
-                // referrerPolicy: yConf.server.stupid.referrerPolicy,
+                referrerPolicy: _config2.default.server.stupid.referrerPolicy
                 // crossOriginResourcePolicy: yConf.server.hm.crossOriginEmbedderPolicy,
                 // crossOriginEmbedderPolicy: true,
                 // crossOriginResourcePolicy: { policy: "cross-origin" },
@@ -300,7 +300,6 @@ exports.default = function () {
               }
 
               if (_config2.default.security.isStupid) {
-                // helmetOptions.referrerPolicy = yConf.server.stupid.referrerPolicy;
                 // helmetOptions.crossOriginResourcePolicy = yConf.server.stupid.crossOriginResourcePolicy;
               }
 

package/template/storage.plugin.js

@@ -4,10 +4,12 @@ import {shtml} from 'yakuza1/lib/xss';
 import yConf from 'yakuza0/config';
 import {connect, req} from 'yakuza1/lib/ws';
 
-const oToStr = (obj) => {
+const shtmlFilterGet = (obj, options) => {
   if (obj && typeof obj !== "string") {
     try {
-      return JSON.stringify(obj);
+      const str = JSON.stringify(obj);
+      const filter = shtml(str, options);
+      return JSON.parse(filter)
     } catch (e) {
       return obj
     }
@@ -16,6 +18,18 @@ const oToStr = (obj) => {
   return obj
 }
 
+const shtmlFilterSet = (obj, options) => {
+  if (obj && typeof obj !== "string") {
+    try {
+      obj = JSON.stringify(obj);
+    } catch (e) {
+      return obj
+    }
+  }
+
+  return shtml(obj, options);
+}
+
 export default async (ctx, inject) => {
   const { $http, $utils, $yk } = ctx;
   const event = {
@@ -40,7 +54,7 @@ export default async (ctx, inject) => {
             [key, data] = args;
             break;
         }
-        data = shtml(data, options);
+        data = shtmlFilterSet(data, options);
 
         const result = await $http.post('$/feapiv1/storage/set', {
           key,
@@ -63,7 +77,7 @@ export default async (ctx, inject) => {
         })
 
         if ($yk.security.stupid) {
-          return shtml(oToStr(result && result.data));
+          return shtmlFilterGet(result && result.data, options);
         }
 
         return result && result.data
@@ -100,7 +114,7 @@ export default async (ctx, inject) => {
             break;
         }
 
-        data = shtml(data, options);
+        data = shtmlFilterSet(data, options);
 
         return await req('storage/set', {
           body: {
@@ -120,7 +134,7 @@ export default async (ctx, inject) => {
         })
 
         if ($yk.security.stupid) {
-          return shtml(oToStr(data));
+          return shtmlFilterGet(data, options);
         }
 
         return data;