save XSS on/off

lib/form/admin/markdownXSS.js

@@ -0,0 +1,9 @@
+'use strict';
+
+var form = require('express-form')
+  , field = form.field;
+
+module.exports = form(
+  field('markdownSetting[markdown:isEnabledPreventXSS]').trim().toBooleanStrict()
+);
+

lib/form/index.js

@@ -20,6 +20,7 @@ module.exports = {
     securityMechanism: require('./admin/securityMechanism'),
     securityPassportLdap: require('./admin/securityPassportLdap'),
     markdown: require('./admin/markdown'),
+    markdownXSS: require('./admin/markdownXSS'),
     customcss: require('./admin/customcss'),
     customscript: require('./admin/customscript'),
     customheader: require('./admin/customheader'),

lib/locales/ja/translation.json

@@ -398,7 +398,7 @@
     "Enable Line Break for comment": "コメント欄で Line Break を有効にする",
     "Enable Line Break for comment desc": "コメント中の改行を、HTML内で<code>&lt;br&gt;</code>として扱います",
     "XSS_setting": "XSS防止設定",
-    "XSS_setting_desc": "クロスサイトスクリプティング(XSS)防止設定を変更できます。",
+    "XSS_setting_desc": "マークダウンテキスト内のHTMLタグへの対処を変更できます。",
     "TBD": "(TBD: コメント欄の Markdown 化は未だ実装されていません)",
     "Prevent XSS(Cross Site Scripting)": "マークダウンテキスト内のHTMLタグを有効にする",
     "Prevent XSS(Cross Site Scripting)desc": "悪意のあるプログラムからの攻撃を防ぎます",

lib/models/config.js

@@ -100,6 +100,7 @@ module.exports = function(crowi) {
   function getDefaultMarkdownConfigs() {
     return {
       'markdown:isEnabledLinebreaks': true,
+      'markdown:isEnabledPreventXSS': false,
       'markdown:isEnabledLinebreaksInComments': true,
     };
   }
@@ -322,6 +323,17 @@ module.exports = function(crowi) {
     return config.markdown[key];
   };
 
+  configSchema.statics.isEnabledPreventXSS = function(config) {
+    const key = 'markdown:isEnabledPreventXSS';
+
+    // return default value if undefined
+    if (undefined === config.markdown || undefined === config.markdown[key]) {
+      return getDefaultMarkdownConfigs[key];
+    }
+
+    return config.markdown[key];
+  };
+
   /**
    * initialize custom css strings
    */

lib/routes/admin.js

@@ -130,6 +130,25 @@ module.exports = function(crowi, app) {
     }
   };
 
+  // app.post('/admin/markdown/XSSSetting' , admin.markdown.XSSSetting);
+  actions.markdown.XSSSetting = function(req, res) {
+    var XSSSetting = req.form.markdownSetting;
+
+    req.session.markdownSetting = XSSSetting;
+    if (req.form.isValid) {
+      Config.updateNamespaceByArray('markdown', XSSSetting, function(err, config) {
+        Config.updateConfigCache('markdown', config);
+        req.session.XSSSetting = null;
+        req.flash('successMessage', ['Successfully updated!']);
+        return res.redirect('/admin/markdown');
+      });
+    }
+    else {
+      req.flash('errorMessage', req.form.errors);
+      return res.redirect('/admin/markdown');
+    }
+  };
+
   // app.get('/admin/customize' , admin.customize.index);
   actions.customize = {};
   actions.customize.index = function(req, res) {

lib/routes/index.js

@@ -69,7 +69,8 @@ module.exports = function(crowi, app) {
 
   // markdown admin
   app.get('/admin/markdown'                   , loginRequired(crowi, app) , middleware.adminRequired() , admin.markdown.index);
-  app.post('/admin/markdown/lineBreaksSetting', loginRequired(crowi, app) , middleware.adminRequired() , csrf, form.admin.markdown, admin.markdown.lineBreaksSetting);
+  app.post('/admin/markdown/lineBreaksSetting', loginRequired(crowi, app) , middleware.adminRequired() , csrf, form.admin.markdown, admin.markdown.lineBreaksSetting); //change form name
+  app.post('/admin/markdown/XSSSetting'       , loginRequired(crowi, app) , middleware.adminRequired() , csrf, form.admin.markdownXSS, admin.markdown.XSSSetting);
 
   // markdown admin
   app.get('/admin/customize'                , loginRequired(crowi, app) , middleware.adminRequired() , admin.customize.index);

lib/views/admin/markdown.html

@@ -95,28 +95,28 @@
         <legend>{{ t('markdown_setting.XSS_setting') }}</legend>
         <p class="well">{{ t("markdown_setting.XSS_setting_desc") }}</p>
         <div class="form-group">
-          <label for="markdownSetting[markdown:isPreventXss]" class="col-xs-4 control-label">
+          <label for="markdownSetting[markdown:isPreventXSS]" class="col-xs-4 control-label">
             {{ t('markdown_setting.Prevent XSS(Cross Site Scripting)') }}
           </label>
           <div class="col-xs-5">
             <div class="btn-group btn-toggle" data-toggle="buttons">
-              <label class="btn btn-default btn-rounded btn-outline {% if markdownSetting['markdown:isEnabledPreventXss'] %}active{% endif %}" data-active-class="primary">
-                <input name="markdownSetting[markdown:isEnabledPreventXss]" value="true" type="radio"
-                    {% if true === markdownSetting['markdown:isEnabledPreventXss'] %}checked{% endif %}> ON
+              <label class="btn btn-default btn-rounded btn-outline {% if markdownSetting['markdown:isEnabledPreventXSS'] %}active{% endif %}" data-active-class="primary">
+                <input name="markdownSetting[markdown:isEnabledPreventXSS]" value="true" type="radio"
+                    {% if true === markdownSetting['markdown:isEnabledPreventXSS'] %}checked{% endif %}> ON
               </label>
-              <label class="btn btn-default btn-rounded btn-outline {% if !markdownSetting['markdown:isEnabledPreventXss'] %}active{% endif %}" data-active-class="default">
-                <input name="markdownSetting[markdown:isEnabledPreventXss]" value="false" type="radio"
-                    {% if !markdownSetting['markdown:isEnabledPreventXss'] %}checked{% endif %}> OFF
+              <label class="btn btn-default btn-rounded btn-outline {% if !markdownSetting['markdown:isEnabledPreventXSS'] %}active{% endif %}" data-active-class="default">
+                <input name="markdownSetting[markdown:isEnabledPreventXSS]" value="false" type="radio"
+                    {% if !markdownSetting['markdown:isEnabledPreventXSS'] %}checked{% endif %}> OFF
               </label>
             </div>
-            <div class="input">
+            <!-- <div class="input">
               <input type="radio" name="preventXSS" value="stripignoretag" checked>
                 {{ t('markdown_setting.Strip ignore tag') }}<br>
               <input type="radio" name="preventXSS" value="WLtagnames">
                 {{ t('markdown_setting.White list tag names') }}<br>
               <input type="radio" name="preventXSS" value="WLtagattribute">
                 {{ t('markdown_setting.White list tag attributes') }}
-            </div>
+            </div> -->
             <p class="help-block">{{ t("markdown_setting.Prevent XSS(Cross Site Scripting)desc") }}<br>{{ t("markdown_setting.Prevent XSS(Cross Site Scripting)desc2") }}</p>
           </div>
         </div>