diff options
| author | Aleksander Machniak <alec@alec.pl> | 2014-12-16 13:28:48 +0100 |
|---|---|---|
| committer | Aleksander Machniak <alec@alec.pl> | 2014-12-16 13:28:48 +0100 |
| commit | 681ba6fc3c296cd6cd11050531b8f4e785141786 (patch) | |
| tree | 77cd99edc9536c1e85e5ee057d231aa3aa5e0aba /program/js/editor.js | |
| parent | 53b7421d4419ce12c62d47e5b1231240cefdc3d5 (diff) | |
Improve system security by using optional special URL with security token
Allows to define separate server/path for image/js/css files
Fix bugs where CSRF attacks were still possible on some requests
Diffstat (limited to 'program/js/editor.js')
| -rw-r--r-- | program/js/editor.js | 5 |
1 files changed, 3 insertions, 2 deletions
diff --git a/program/js/editor.js b/program/js/editor.js index 3dac5f371..2fc3429ab 100644 --- a/program/js/editor.js +++ b/program/js/editor.js @@ -36,12 +36,13 @@ function rcube_text_editor(config, id) { var ref = this, + abs_url = location.href.replace(/[?#].*$/, '').replace(/\/$/, ''), conf = { selector: '#' + ($('#' + id).is('.mce_editor') ? id : 'fake-editor-id'), cache_suffix: 's=4010700', theme: 'modern', language: config.lang, - content_css: 'program/js/tinymce/roundcube/content.css', + content_css: rcmail.assets_path('program/js/tinymce/roundcube/content.css'), menubar: false, statusbar: false, toolbar_items_size: 'small', @@ -83,7 +84,7 @@ function rcube_text_editor(config, id) toolbar: 'bold italic underline | alignleft aligncenter alignright alignjustify' + ' | bullist numlist outdent indent ltr rtl blockquote | forecolor backcolor | fontselect fontsizeselect' + ' | link unlink table | emoticons charmap image media | code searchreplace undo redo', - spellchecker_rpc_url: '../../../../../?_task=utils&_action=spell_html&_remote=1', + spellchecker_rpc_url: abs_url + '/?_task=utils&_action=spell_html&_remote=1', spellchecker_language: rcmail.env.spell_lang, accessibility_focus: false, file_browser_callback: function(name, url, type, win) { ref.file_browser_callback(name, url, type); }, |