core: escape iframe for logins

koush · May 9, 2023 · 05b9b49 · 05b9b49
1 parent 1857aca
commit 05b9b49
Show file tree

Hide file tree

Showing 4 changed files with 18 additions and 11 deletions.
diff --git a/plugins/core/.vscode/settings.json b/plugins/core/.vscode/settings.json
@@ -1,3 +1,3 @@
 {
-    "scrypted.debugHost": "127.0.0.1",
+    "scrypted.debugHost": "192.168.2.53",
 }
diff --git a/plugins/core/package-lock.json b/plugins/core/package-lock.json
diff --git a/plugins/core/package.json b/plugins/core/package.json
@@ -1,6 +1,6 @@
 {
    "name": "@scrypted/core",
-   "version": "0.1.126",
+   "version": "0.1.127",
    "description": "Scrypted Core plugin. Provides the UI, websocket, and engine.io APIs.",
    "author": "Scrypted",
    "license": "Apache-2.0",

diff --git a/plugins/core/ui/src/interfaces/OauthClient.vue b/plugins/core/ui/src/interfaces/OauthClient.vue
@@ -4,6 +4,7 @@
 <script>
 import qs from 'query-string';
 import RPCInterface from "./RPCInterface.vue";
+import { getCurrentBaseUrl } from '../../../../../packages/client/src';
 
 export default {
   mixins: [RPCInterface],
@@ -16,9 +17,18 @@ export default {
         return true;
       }
     },
-    onClick: function () {
-      // https://stackoverflow.com/a/39387533
-      const windowReference = this.isIFrame() ? window.open(undefined, '_blank') : undefined;
+    onClick: async function () {
+      // must escape iframe for login.
+      if (this.isIFrame()) {
+        const endpointManager = this.$scrypted.endpointManager;
+        const ep = await endpointManager.getPublicLocalEndpoint();
+        const u = new URL(ep);
+        u.hash = window.location.hash;
+        u.pathname = '/endpoint/@scrypted/core/public/';
+        window.open(u.toString(), '_blank');
+        return;
+      }
+
       this.rpc()
         .getOauthUrl()
         .then(data => {
@@ -51,10 +61,7 @@ export default {
             r: window.location.toString(),
           });
           url.search = qs.stringify(querystring);
-          if (windowReference)
-            windowReference.location = url.toString();
-          else
-            window.location = url.toString();
+          window.location = url.toString();
         });
     }
   }