814271dc0b
A malicious user could modify a valid looking link (for example of the editor UI) to point to a malicous site, by using overlays and CSS. Since CSS should stay enabled, we need to make the user aware of possible risks when leaving the HedgeDoc instance, in order to protect them from credential-theft. This commit adds a new interstitial page for external links, that shows the target URL and asks the user, whether they really want to continue. Signed-off-by: Erik Michelson <github@erik.michelson.eu>
29 lines
657 B
JavaScript
29 lines
657 B
JavaScript
'use strict'
|
|
|
|
const Router = require('express').Router
|
|
|
|
const response = require('../response')
|
|
|
|
const baseRouter = module.exports = Router()
|
|
|
|
const errors = require('../errors')
|
|
|
|
const links = require('../links')
|
|
|
|
// get index
|
|
baseRouter.get('/', response.showIndex)
|
|
// get 403 forbidden
|
|
baseRouter.get('/403', function (req, res) {
|
|
errors.errorForbidden(res)
|
|
})
|
|
// get 404 not found
|
|
baseRouter.get('/404', function (req, res) {
|
|
errors.errorNotFound(res)
|
|
})
|
|
// get 500 internal error
|
|
baseRouter.get('/500', function (req, res) {
|
|
errors.errorInternalError(res)
|
|
})
|
|
// get external link warning page
|
|
baseRouter.get('/_link', links.serveLinkWarningPage)
|