Check origin in messages

apps/api/documents/api.js

@@ -213,6 +213,7 @@
         _config.editorConfig.canRequestCompareFile = _config.events && !!_config.events.onRequestCompareFile;
         _config.editorConfig.canRequestSharingSettings = _config.events && !!_config.events.onRequestSharingSettings;
         _config.frameEditorId = placeholderId;
+        _config.parentOrigin = window.location.origin;
 
         var onMouseUp = function (evt) {
             _processMouse(evt);
@@ -395,6 +396,10 @@
 
         if (target && _checkConfigParams()) {
             iframe = createIframe(_config);
+            if (iframe.src) {
+                var pathArray = iframe.src.split('/');
+                this.frameOrigin = pathArray[0] + '//' + pathArray[2];
+            }
             target.parentNode && target.parentNode.replaceChild(iframe, target);
             var _msgDispatcher = new MessageDispatcher(_onMessage, this);
         }
@@ -683,7 +688,7 @@
 
         var _onMessage = function(msg) {
             // TODO: check message origin
-            if (msg && window.JSON) {
+            if (msg && window.JSON && _scope.frameOrigin==msg.origin ) {
 
                 try {
                     var msg = window.JSON.parse(msg.data);
@@ -806,6 +811,9 @@
         if (config.editorConfig && config.editorConfig.customization && (config.editorConfig.customization.toolbar===false))
             params += "&toolbar=false";
 
+        if (config.parentOrigin)
+            params += "&parentOrigin=" + config.parentOrigin;
+
         return params;
     }
 

apps/common/Gateway.js

@@ -135,6 +135,8 @@ if (Common === undefined) {
 
         var _onMessage = function(msg) {
             // TODO: check message origin
+            if (msg.origin !== window.parentOrigin) return;
+
             var data = msg.data;
             if (Object.prototype.toString.apply(data) !== '[object String]' || !window.JSON) {
                 return;

apps/documenteditor/embed/index.html

@@ -162,6 +162,7 @@
                logo = params["headerlogo"] ? encodeUrlParam(params["headerlogo"]) : null;
 
            window.frameEditorId = params["frameEditorId"];
+           window.parentOrigin = params["parentOrigin"];
 
            var elem = document.querySelector('.loading-logo');
            if (elem && logo) {

apps/documenteditor/embed/index.html.deploy

@@ -155,6 +155,7 @@
                            logo = params["headerlogo"] ? encodeUrlParam(params["headerlogo"]) : null;
 
             window.frameEditorId = params["frameEditorId"];
+            window.parentOrigin = params["parentOrigin"];
             var elem = document.querySelector('.loading-logo');
             if (elem && logo) {
                 elem.style.backgroundImage= 'none';

apps/documenteditor/embed/index_loader.html

@@ -240,6 +240,7 @@
                 logo = params["logo"] ? ((params["logo"] !== 'none') ? ('<img src="' + encodeUrlParam(params["logo"]) + '" class="loader-logo" />') : '') : null;
 
             window.frameEditorId = params["frameEditorId"];
+           window.parentOrigin = params["parentOrigin"];
 
            if ( lang == 'de')      loading = 'Ladevorgang...';
            else if ( lang == 'es') loading = 'Cargando...';

apps/documenteditor/embed/index_loader.html.deploy

@@ -232,6 +232,7 @@
                 logo = params["logo"] ? ((params["logo"] !== 'none') ? ('<img src="' + encodeUrlParam(params["logo"]) + '" class="loader-logo" />') : '') : null;
 
             window.frameEditorId = params["frameEditorId"];
+            window.parentOrigin = params["parentOrigin"];
 
             if ( lang == 'de')      loading = 'Ladevorgang...';
             else if ( lang == 'es') loading = 'Cargando...';

apps/documenteditor/main/index.html

@@ -200,6 +200,7 @@
             logo = params["headerlogo"] ? encodeUrlParam(params["headerlogo"]) : null;
 
         window.frameEditorId = params["frameEditorId"];
+        window.parentOrigin = params["parentOrigin"];
     </script>
 
     <!-- debug begin -->

apps/documenteditor/main/index.html.deploy

@@ -199,6 +199,7 @@
             logo = params["headerlogo"] ? encodeUrlParam(params["headerlogo"]) : null;
 
         window.frameEditorId = params["frameEditorId"];
+        window.parentOrigin = params["parentOrigin"];
 
         if ( window.AscDesktopEditor ) {
             window.on_native_message = function (cmd, param) {

apps/documenteditor/main/index_loader.html

@@ -212,6 +212,7 @@
             loading = 'Loading...',
             logo = params["logo"] ? ((params["logo"] !== 'none') ? ('<img src="' + encodeUrlParam(params["logo"]) + '" class="loader-logo" />') : '') : null;
         window.frameEditorId = params["frameEditorId"];
+        window.parentOrigin = params["parentOrigin"];
         if ( lang == 'de')      loading = 'Ladevorgang...';
         else if ( lang == 'es') loading = 'Cargando...';
         else if ( lang == 'fr') loading = 'Chargement en cours...';

apps/documenteditor/main/index_loader.html.deploy

@@ -233,6 +233,7 @@
             logo = params["logo"] ? ((params["logo"] !== 'none') ? ('<img src="' + encodeUrlParam(params["logo"]) + '" class="loader-logo" />') : '') : null;
 
         window.frameEditorId = params["frameEditorId"];
+        window.parentOrigin = params["parentOrigin"];
 
         if ( lang == 'de')      loading = 'Ladevorgang...';
         else if ( lang == 'es') loading = 'Cargando...';

apps/documenteditor/mobile/index.html

@@ -161,6 +161,7 @@
             }
 
                 window.frameEditorId = params["frameEditorId"];
+            window.parentOrigin = params["parentOrigin"];
 
             var brendpanel = document.getElementsByClassName('brendpanel')[0];
             if (brendpanel) {

apps/documenteditor/mobile/index.html.deploy

@@ -173,6 +173,7 @@
             }
 
             window.frameEditorId = params["frameEditorId"];
+            window.parentOrigin = params["parentOrigin"];
 
             var brendpanel = document.getElementsByClassName('brendpanel')[0];
             if (brendpanel) {

apps/documenteditor/mobile/index_loader.html

@@ -192,6 +192,7 @@
         loading = 'Loading...',
         logo = params["logo"] ? ((params["logo"] !== 'none') ? ('<img src="' + encodeUrlParam(params["logo"]) + '" class="loader-logo" />') : '') : null;
     window.frameEditorId = params["frameEditorId"];
+    window.parentOrigin = params["parentOrigin"];
     if ( lang == 'de')      loading = 'Ladevorgang...';
     else if ( lang == 'es') loading = 'Cargando...';
     else if ( lang == 'fr') loading = 'Chargement en cours...';

apps/documenteditor/mobile/index_loader.html.deploy

@@ -225,6 +225,7 @@
                 logo = params["logo"] ? ((params["logo"] !== 'none') ? ('<img src="' + encodeUrlParam(params["logo"]) + '" class="loader-logo" />') : '') : null;
 
                 window.frameEditorId = params["frameEditorId"];
+                window.parentOrigin = params["parentOrigin"];
 
             if ( lang == 'de')      loading = 'Ladevorgang...';
             else if ( lang == 'es') loading = 'Cargando...';

apps/presentationeditor/embed/index.html

@@ -213,6 +213,7 @@
               logo = params["headerlogo"] ? encodeUrlParam(params["headerlogo"]) : null;
 
           window.frameEditorId = params["frameEditorId"];
+          window.parentOrigin = params["parentOrigin"];
 
           var elem = document.querySelector('.loading-logo');
           if (elem && logo) {

apps/presentationeditor/embed/index.html.deploy

@@ -207,6 +207,7 @@
                logo = params["headerlogo"] ? encodeUrlParam(params["headerlogo"]) : null;
 
            window.frameEditorId = params["frameEditorId"];
+           window.parentOrigin = params["parentOrigin"];
 
            var elem = document.querySelector('.loading-logo');
            if (elem && logo) {

apps/presentationeditor/embed/index_loader.html

@@ -239,6 +239,7 @@
               logo = params["logo"] ? ((params["logo"] !== 'none') ? ('<img src="' + encodeUrlParam(params["logo"]) + '" class="loader-logo" />') : '') : null;
 
           window.frameEditorId = params["frameEditorId"];
+          window.parentOrigin = params["parentOrigin"];
 
           if ( lang == 'de')      loading = 'Ladevorgang...';
           else if ( lang == 'es') loading = 'Cargando...';

apps/presentationeditor/embed/index_loader.html.deploy

@@ -232,6 +232,7 @@
             logo = params["logo"] ? ((params["logo"] !== 'none') ? ('<img src="' + encodeUrlParam(params["logo"]) + '" class="loader-logo" />') : '') : null;
 
         window.frameEditorId = params["frameEditorId"];
+        window.parentOrigin = params["parentOrigin"];
 
         if ( lang == 'de')      loading = 'Ladevorgang...';
         else if ( lang == 'es') loading = 'Cargando...';

apps/presentationeditor/main/index.html

@@ -228,6 +228,7 @@
             logo = params["headerlogo"] ? encodeUrlParam(params["headerlogo"]) : null;
 
         window.frameEditorId = params["frameEditorId"];
+        window.parentOrigin = params["parentOrigin"];
     </script>
 
     <!-- debug begin -->

apps/presentationeditor/main/index.html.deploy

@@ -236,6 +236,7 @@
             logo = params["headerlogo"] ? encodeUrlParam(params["headerlogo"]) : null;
 
         window.frameEditorId = params["frameEditorId"];
+        window.parentOrigin = params["parentOrigin"];
 
         if ( window.AscDesktopEditor ) {
             window.on_native_message = function (cmd, param) {

apps/presentationeditor/main/index.reporter.html

@@ -180,6 +180,7 @@
             presenter = 'Presenter View';
 
         window.frameEditorId = params["frameEditorId"];
+        window.parentOrigin = params["parentOrigin"];
 
         if ( lang == 'bg') { presenter = 'Изглед на презентатора';}
         else if ( lang == 'cs') { presenter = 'Zobrazení přednášejícího';}

apps/presentationeditor/main/index.reporter.html.deploy

@@ -176,6 +176,7 @@
             presenter = 'Presenter View';
 
         window.frameEditorId = params["frameEditorId"];
+        window.parentOrigin = params["parentOrigin"];
 
         if ( lang == 'bg') { presenter = 'Изглед на презентатора';}
         else if ( lang == 'cs') { presenter = 'Zobrazení přednášejícího';}

apps/presentationeditor/main/index_loader.html

@@ -203,6 +203,7 @@
             loading = 'Loading...',
             logo = params["logo"] ? ((params["logo"] !== 'none') ? ('<img src="' + encodeUrlParam(params["logo"]) + '" class="loader-logo" />') : '') : null;
         window.frameEditorId = params["frameEditorId"];
+        window.parentOrigin = params["parentOrigin"];
         if ( lang == 'de')      loading = 'Ladevorgang...';
         else if ( lang == 'es') loading = 'Cargando...';
         else if ( lang == 'fr') loading = 'Chargement en cours...';

apps/presentationeditor/main/index_loader.html.deploy

@@ -233,6 +233,7 @@
             logo = params["logo"] ? ((params["logo"] !== 'none') ? ('<img src="' + encodeUrlParam(params["logo"]) + '" class="loader-logo" />') : '') : null;
 
         window.frameEditorId = params["frameEditorId"];
+        window.parentOrigin = params["parentOrigin"];
 
         if ( lang == 'de')      loading = 'Ladevorgang...';
         else if ( lang == 'es') loading = 'Cargando...';

apps/presentationeditor/mobile/index.html

@@ -212,6 +212,7 @@
             }
 
                 window.frameEditorId = params["frameEditorId"];
+            window.parentOrigin = params["parentOrigin"];
 
             var brendpanel = document.getElementsByClassName('brendpanel')[0];
             if (brendpanel) {

apps/presentationeditor/mobile/index.html.deploy

@@ -224,6 +224,7 @@
             }
 
                 window.frameEditorId = params["frameEditorId"];
+                window.parentOrigin = params["parentOrigin"];
 
             var brendpanel = document.getElementsByClassName('brendpanel')[0];
             if (brendpanel) {

apps/presentationeditor/mobile/index_loader.html

@@ -192,6 +192,7 @@
         loading = 'Loading...',
         logo = params["logo"] ? ((params["logo"] !== 'none') ? ('<img src="' + encodeUrlParam(params["logo"]) + '" class="loader-logo" />') : '') : null;
     window.frameEditorId = params["frameEditorId"];
+    window.parentOrigin = params["parentOrigin"];
     if ( lang == 'de')      loading = 'Ladevorgang...';
     else if ( lang == 'es') loading = 'Cargando...';
     else if ( lang == 'fr') loading = 'Chargement en cours...';

apps/presentationeditor/mobile/index_loader.html.deploy

@@ -225,6 +225,7 @@
                 logo = params["logo"] ? ((params["logo"] !== 'none') ? ('<img src="' + encodeUrlParam(params["logo"]) + '" class="loader-logo" />') : '') : null;
 
                 window.frameEditorId = params["frameEditorId"];
+                window.parentOrigin = params["parentOrigin"];
 
             if ( lang == 'de')      loading = 'Ladevorgang...';
             else if ( lang == 'es') loading = 'Cargando...';

apps/spreadsheeteditor/embed/index.html

@@ -188,6 +188,7 @@
               logo = params["headerlogo"] ? encodeUrlParam(params["headerlogo"]) : null;
 
           window.frameEditorId = params["frameEditorId"];
+          window.parentOrigin = params["parentOrigin"];
 
           var elem = document.querySelector('.loading-logo');
           if (elem && logo) {

apps/spreadsheeteditor/embed/index.html.deploy

@@ -180,6 +180,7 @@
                       logo = params["headerlogo"] ? encodeUrlParam(params["headerlogo"]) : null;
 
           window.frameEditorId = params["frameEditorId"];
+          window.parentOrigin = params["parentOrigin"];
 
           var elem = document.querySelector('.loading-logo');
           if (elem && logo) {

apps/spreadsheeteditor/embed/index_loader.html

@@ -240,6 +240,7 @@
               logo = params["logo"] ? ((params["logo"] !== 'none') ? ('<img src="' + encodeUrlParam(params["logo"]) + '" class="loader-logo" />') : '') : null;
 
           window.frameEditorId = params["frameEditorId"];
+          window.parentOrigin = params["parentOrigin"];
 
           if ( lang == 'de')      loading = 'Ladevorgang...';
           else if ( lang == 'es') loading = 'Cargando...';

apps/spreadsheeteditor/embed/index_loader.html.deploy

@@ -232,6 +232,7 @@
             logo = params["logo"] ? ((params["logo"] !== 'none') ? ('<img src="' + encodeUrlParam(params["logo"]) + '" class="loader-logo" />') : '') : null;
 
         window.frameEditorId = params["frameEditorId"];
+        window.parentOrigin = params["parentOrigin"];
 
         if ( lang == 'de')      loading = 'Ladevorgang...';
         else if ( lang == 'es') loading = 'Cargando...';

apps/spreadsheeteditor/main/index.html

@@ -228,6 +228,7 @@
             logo = params["headerlogo"] ? encodeUrlParam(params["headerlogo"]) : null;
 
         window.frameEditorId = params["frameEditorId"];
+        window.parentOrigin = params["parentOrigin"];
     </script>
 
     <link rel="stylesheet" type="text/css" href="../../../../sdkjs/cell/css/main.css"/>

apps/spreadsheeteditor/main/index.html.deploy

@@ -236,6 +236,7 @@
             logo = params["headerlogo"] ? encodeUrlParam(params["headerlogo"]) : null;
 
         window.frameEditorId = params["frameEditorId"];
+        window.parentOrigin = params["parentOrigin"];
 
         if ( window.AscDesktopEditor ) {
             window.on_native_message = function (cmd, param) {

apps/spreadsheeteditor/main/index_loader.html

@@ -202,6 +202,7 @@
             loading = 'Loading...',
             logo = params["logo"] ? ((params["logo"] !== 'none') ? ('<img src="' + encodeUrlParam(params["logo"]) + '" class="loader-logo" />') : '') : null;
         window.frameEditorId = params["frameEditorId"];
+        window.parentOrigin = params["parentOrigin"];
         if ( lang == 'de')      loading = 'Ladevorgang...';
         else if ( lang == 'es') loading = 'Cargando...';
         else if ( lang == 'fr') loading = 'Chargement en cours...';

apps/spreadsheeteditor/main/index_loader.html.deploy

@@ -232,6 +232,7 @@
             logo = params["logo"] ? ((params["logo"] !== 'none') ? ('<img src="' + encodeUrlParam(params["logo"]) + '" class="loader-logo" />') : '') : null;
 
         window.frameEditorId = params["frameEditorId"];
+        window.parentOrigin = params["parentOrigin"];
 
         if ( lang == 'de')      loading = 'Ladevorgang...';
         else if ( lang == 'es') loading = 'Cargando...';

apps/spreadsheeteditor/mobile/index.html

@@ -187,6 +187,7 @@
             }
 
                 window.frameEditorId = params["frameEditorId"];
+            window.parentOrigin = params["parentOrigin"];
 
             var brendpanel = document.getElementsByClassName('brendpanel')[0];
             if (brendpanel) {

apps/spreadsheeteditor/mobile/index.html.deploy

@@ -195,6 +195,7 @@
             }
 
                 window.frameEditorId = params["frameEditorId"];
+                window.parentOrigin = params["parentOrigin"];
 
             var brendpanel = document.getElementsByClassName('brendpanel')[0];
             if (brendpanel) {

apps/spreadsheeteditor/mobile/index_loader.html

@@ -193,6 +193,7 @@
         loading = 'Loading...',
         logo = params["logo"] ? ((params["logo"] !== 'none') ? ('<img src="' + encodeUrlParam(params["logo"]) + '" class="loader-logo" />') : '') : null;
     window.frameEditorId = params["frameEditorId"];
+    window.parentOrigin = params["parentOrigin"];
     if ( lang == 'de')      loading = 'Ladevorgang...';
     else if ( lang == 'es') loading = 'Cargando...';
     else if ( lang == 'fr') loading = 'Chargement en cours...';

apps/spreadsheeteditor/mobile/index_loader.html.deploy

@@ -224,6 +224,7 @@
                 logo = params["logo"] ? ((params["logo"] !== 'none') ? ('<img src="' + encodeUrlParam(params["logo"]) + '" class="loader-logo" />') : '') : null;
 
                 window.frameEditorId = params["frameEditorId"];
+                window.parentOrigin = params["parentOrigin"];
 
             if ( lang == 'de')      loading = 'Ladevorgang...';
             else if ( lang == 'es') loading = 'Cargando...';