Fix paging bug

ORNL · Aug 16, 2023 · 2d3ef46 · 2d3ef46
1 parent e78ad1f
commit 2d3ef46
Show file tree

Hide file tree

Showing 6 changed files with 88 additions and 59 deletions.
diff --git a/web/datafed-ws.js b/web/datafed-ws.js
@@ -22,7 +22,7 @@ var session = require('express-session');
 var cookieParser = require('cookie-parser'); // cookies for user state
 var http = require('http');
 var https = require('https');
-const constants = require('crypto');
+const crypto = require('crypto');
 const helmet = require('helmet');
 const fs = require('fs');
 const ini = require('ini');
@@ -208,7 +208,7 @@ function startServer(){
                     key: privateKey,
                     cert: certificate,
                     ca: chain,
-                    secureOptions: constants.SSL_OP_NO_SSLv2 | constants.SSL_OP_NO_SSLv3
+                    secureOptions: crypto.SSL_OP_NO_SSLv2 | crypto.SSL_OP_NO_SSLv3
                 }, app );
             }else{
                 server = http.createServer({}, app);
@@ -271,6 +271,14 @@ app.use( function( req, res, next ){
     res.setHeader('Content-Language','en-US');
     next();
 });
+
+app.use((req, res, next) => {
+  const nonce = crypto.randomBytes(16).toString('base64');
+  res.locals.nonce = nonce;
+  res.setHeader('Content-Security-Policy', `script-src 'nonce-${nonce}'`);
+  next();
+});
+
 app.set( 'view engine', 'ect' );
 app.engine( 'ect', ectRenderer.render );
 
@@ -290,7 +298,7 @@ app.get('/ui/welcome', (a_req, a_resp) => {
         logger.debug('/ui/welcome', getCurrentLineNumber(), "Access welcome from: " + a_req.connection.remoteAddress );
 
         var theme = a_req.cookies['datafed-theme']|| "light";
-        a_resp.render('index',{theme:theme,version:g_version,test_mode:g_test});
+        a_resp.render('index',{nonce:a_resp.locals.nonce, theme:theme,version:g_version,test_mode:g_test});
     }
 });
 
@@ -299,7 +307,7 @@ app.get('/ui/main', (a_req, a_resp) => {
         logger.info('/ui/main', getCurrentLineNumber(), "Access main (", a_req.session.uid, ") from", a_req.connection.remoteAddress );
 
         var theme = a_req.cookies['datafed-theme'] || "light";
-        a_resp.render( 'main',{user_uid:a_req.session.uid,theme:theme,version:g_version,test_mode:g_test});
+        a_resp.render('main',{nonce:a_resp.locals.nonce,user_uid:a_req.session.uid,theme:theme,version:g_version,test_mode:g_test});
     }else{
         // datafed-user cookie not set, so clear datafed-id before redirect
         //a_resp.clearCookie( 'datafed-id' );
@@ -322,7 +330,7 @@ app.get('/ui/register', (a_req, a_resp) => {
         logger.info('/ui/register', getCurrentLineNumber(), " - registration access (", a_req.session.uid, ") from", a_req.connection.remoteAddress );
 
         var theme = a_req.cookies['datafed-theme'] || "light";
-        a_resp.render('register', { uid: a_req.session.uid, uname: a_req.session.name, theme: theme, version: g_version, test_mode: g_test });
+        a_resp.render('register', {nonce:a_resp.locals.nonce, uid: a_req.session.uid, uname: a_req.session.name, theme: theme, version: g_version, test_mode: g_test });
     }
 });
 
@@ -354,7 +362,7 @@ app.get('/ui/logout', (a_req, a_resp) => {
 });
 
 app.get('/ui/error', (a_req, a_resp) => {
-    a_resp.render('error',{theme:"light",version:g_version,test_mode:g_test});
+    a_resp.render('error',{nonce:a_resp.locals.nonce,theme:"light",version:g_version,test_mode:g_test});
 });
 
 /* This is the OAuth redirect URL after a user authenticates with Globus

diff --git a/web/static/dlg_pick_user.js b/web/static/dlg_pick_user.js
@@ -135,15 +135,35 @@ export function show(  a_uid, a_excl, a_single_sel, cb ){
                 a_data.result = [];
                 if ( a_data.response.offset > 0 || a_data.response.total > (a_data.response.offset + a_data.response.count )){
                     var pages = Math.ceil(a_data.response.total/settings.opts.page_sz), page = 1+a_data.response.offset/settings.opts.page_sz;
-                    a_data.result.push({title:"<button class='btn btn-icon-tiny''"+(page==1?" disabled":"")+" onclick='userPageLoad(\"" +
-                        a_data.node.key+"\",0)'><span class='ui-icon ui-icon-triangle-1-w-stop'></span></button> <button class='btn btn-icon-tiny'"+(page==1?" disabled":"") +
-                        " onclick='userPageLoad(\""+a_data.node.key+"\","+(page-2)*settings.opts.page_sz+")'><span class='ui-icon ui-icon-triangle-1-w'></span></button> Page " +
-                        page + " of " + pages + " <button class='btn btn-icon-tiny'"+(page==pages?" disabled":"")+" onclick='userPageLoad(\"" +
-                        a_data.node.key+"\","+page*settings.opts.page_sz+")'><span class='ui-icon ui-icon-triangle-1-e'></span></button> <button class='btn btn-icon-tiny'" + 
-                        (page==pages?" disabled":"")+" onclick='userPageLoad(\""+a_data.node.key+"\","+(pages-1)*settings.opts.page_sz +
-                        ")'><span class='ui-icon ui-icon-triangle-1-e-stop'></span></button>", folder:false, icon:false, unselectable:true, hasBtn:true });
+                    a_data.result.push({title:
+                        "<button id='first_page' class='btn btn-icon-tiny' "+(page==1?" disabled":"")+"><span class='ui-icon ui-icon-triangle-1-w-stop'></span></button> " +
+                        "<button id='back_page' class='btn btn-icon-tiny' "+(page==1?" disabled":"")+"><span class='ui-icon ui-icon-triangle-1-w'></span></button> " +
+                        "Page " + page + " of " + pages + " " + 
+                        "<button id='forward_page' class='btn btn-icon-tiny' "+(page==pages?" disabled":"")+"><span class='ui-icon ui-icon-triangle-1-e'></span></button> " +
+                        "<button id='last_page' class='btn btn-icon-tiny' "+(page==pages?" disabled":"")+"><span class='ui-icon ui-icon-triangle-1-e-stop'></span></button>",
+                      folder:false,
+                      icon:false,
+                      unselectable:true,
+                      hasBtn:true });
+
+
+                  $(document).ready(function() {
+                    $('#first_page').click(function() {
+                      userPageLoad(a_data.node.key,0);
+                    });
+                    $('#back_page').click(function() {
+                      userPageLoad(a_data.node.key, (page-2)*settings.opts.page_sz);
+                    });
+                    $('#forward_page').click(function() {
+                      userPageLoad(a_data.node.key, page*settings.opts.page_sz);
+                    });
+                    $('#last_page').click(function() {
+                      userPageLoad(a_data.node.key, (pages-1)*settings.opts.page_sz);
+                    });
+                  });
                 }
 
+                console.log(a_data.result);
                 var user,unsel;
                 for ( i in a_data.response.user ) {
                     user = a_data.response.user[i];

diff --git a/web/views/error.ect b/web/views/error.ect
@@ -1,6 +1,7 @@
 <!DOCTYPE html>
 <html>
     <head>
+        <meta http-equiv="Content-Type" content="script-src 'nonce-<%= @nonce %> 'self'">
         <% include 'head.ect' %>
         <title>DataFed Error</title>
     </head>

diff --git a/web/views/head.ect b/web/views/head.ect
@@ -1,7 +1,7 @@
 <link rel="stylesheet" type="text/css" href="/style.css"/>
 <link rel="icon" type="image/png" href="/favicon.png">
-<script src="/js-cookie/js-cookie.js"></script>
-<script src="/jquery/jquery.js"></script>
+<script nonce="<%= @nonce %>" src="/js-cookie/js-cookie.js"></script>
+<script nonce="<%= @nonce %>" src="/jquery/jquery.js"></script>
 <link id="jq-theme-css" rel="stylesheet" href="/jquery-ui-<%- @theme %>/jquery-ui.css">
 <link rel="stylesheet" type="text/css" href="/jquery/jquery-ui-1.12.icon-font.min.css" />
-<script src="/jquery/jquery-ui.js"></script>
+<script nonce="<%= @nonce %>" src="/jquery/jquery-ui.js"></script>
diff --git a/web/views/index.ect b/web/views/index.ect
@@ -1,8 +1,9 @@
 <!DOCTYPE html>
 <html>
     <head>
+        <meta http-equiv="Content-Type" content="script-src 'nonce-<%= @nonce %> 'self'">
         <% include 'head.ect' %>
-        <script type="module" charset="utf-8" src="/index.js"></script>
+        <script nonce="<%= @nonce %>" type="module" charset="utf-8" src="/index.js"></script>
         <title>DataFed Login</title>
         <script type="application/json" id="template_data">
         {

diff --git a/web/views/main.ect b/web/views/main.ect
@@ -1,8 +1,7 @@
 <!DOCTYPE html>
 <html>
     <head>
-        <meta http-equiv="Content-Type" content="text/html;charset=utf-8">
-
+        <meta http-equiv="Content-Type" content="text/html;charset=utf-8;script-src 'nonce-<%= @nonce %> 'self'">
         <% include 'head.ect' %>
         <script type="application/json" id="template_data">
         {
@@ -12,48 +11,48 @@
         }
         </script>
         <link href="https://cdnjs.cloudflare.com/ajax/libs/jquery.fancytree/2.37.0/skin-themeroller/ui.fancytree.min.css" rel="stylesheet">
-        <script src="https://cdnjs.cloudflare.com/ajax/libs/jquery.fancytree/2.37.0/jquery.fancytree-all.min.js"></script>
-        <script src="/jquery/jquery.ui-contextmenu.min.js"></script>
-        <script src="/ace/ace.js" type="text/javascript" charset="utf-8"></script>
-        <script src="/ace/theme-light.js" type="text/javascript" charset="utf-8"></script>
-        <script src="/ace/theme-dark.js" type="text/javascript" charset="utf-8"></script>
-        <script src="/ace/mode-json.js" type="text/javascript" charset="utf-8"></script>
-        <script src="/tag/tag-it.js" type="text/javascript" charset="utf-8"></script>
+        <script nonce="<%= @nonce %>" src="https://cdnjs.cloudflare.com/ajax/libs/jquery.fancytree/2.37.0/jquery.fancytree-all.min.js"></script>
+        <script nonce="<%= @nonce %>" src="/jquery/jquery.ui-contextmenu.min.js"></script>
+        <script nonce="<%= @nonce %>" src="/ace/ace.js" type="text/javascript" charset="utf-8"></script>
+        <script nonce="<%= @nonce %>" src="/ace/theme-light.js" type="text/javascript" charset="utf-8"></script>
+        <script nonce="<%= @nonce %>" src="/ace/theme-dark.js" type="text/javascript" charset="utf-8"></script>
+        <script nonce="<%= @nonce %>" src="/ace/mode-json.js" type="text/javascript" charset="utf-8"></script>
+        <script nonce="<%= @nonce %>" src="/tag/tag-it.js" type="text/javascript" charset="utf-8"></script>
         <link href="/tag/tag-it.css" rel="stylesheet" type="text/css">
-        <script src="https://d3js.org/d3.v5.min.js"></script>
-        <script src="https://cdn.jsdelivr.net/npm/[email protected]/marked.min.js"></script>
+        <script nonce="<%= @nonce %>" src="https://d3js.org/d3.v5.min.js"></script>
+        <script nonce="<%= @nonce %>" src="https://cdn.jsdelivr.net/npm/[email protected]/marked.min.js"></script>
         <link href="/query_builder.css" rel="stylesheet" type="text/css">
-        <script type="module" charset="utf-8" src="/model.js"></script>
-        <script type="module" charset="utf-8" src="/util.js"></script>
-        <script type="module" charset="utf-8" src="/settings.js"></script>
-        <script type="module" charset="utf-8" src="/api.js"></script>
-        <script type="module" charset="utf-8" src="/query_builder.js"></script>
-        <script type="module" charset="utf-8" src="/dialogs.js"></script>
-        <script type="module" charset="utf-8" src="/dlg_annotation.js"></script>
-        <script type="module" charset="utf-8" src="/dlg_pick_user.js"></script>
-        <script type="module" charset="utf-8" src="/dlg_pick_proj.js"></script>
-        <script type="module" charset="utf-8" src="/dlg_set_acls.js"></script>
-        <script type="module" charset="utf-8" src="/dlg_data_new_edit.js"></script>
-        <script type="module" charset="utf-8" src="/dlg_coll_new_edit.js"></script>
-        <script type="module" charset="utf-8" src="/dlg_query_save.js"></script>
-        <script type="module" charset="utf-8" src="/dlg_groups.js"></script>
-        <script type="module" charset="utf-8" src="/dlg_group_edit.js"></script>
-        <script type="module" charset="utf-8" src="/dlg_proj_new_edit.js"></script>
-        <script type="module" charset="utf-8" src="/dlg_alloc_new_edit.js"></script>
-        <script type="module" charset="utf-8" src="/dlg_start_xfer.js"></script>
-        <script type="module" charset="utf-8" src="/dlg_ep_browse.js"></script>
-        <script type="module" charset="utf-8" src="/dlg_settings.js"></script>
-        <script type="module" charset="utf-8" src="/dlg_repo_edit.js"></script>
-        <script type="module" charset="utf-8" src="/dlg_repo_manage.js"></script>
-        <script type="module" charset="utf-8" src="/dlg_owner_chg_confirm.js"></script>
-        <script type="module" charset="utf-8" src="/dlg_schema.js"></script>
-        <script type="module" charset="utf-8" src="/dlg_schema_list.js"></script>
-        <script type="module" charset="utf-8" src="/dlg_query_builder.js"></script>
-        <script type="module" charset="utf-8" src="/panel_catalog.js"></script>
-        <script type="module" charset="utf-8" src="/panel_graph.js"></script>
-        <script type="module" charset="utf-8" src="/panel_item_info.js"></script>
-        <script type="module" charset="utf-8" src="/main_browse_tab.js"></script>
-        <script type="module" charset="utf-8" src="/main.js"></script>
+        <script nonce="<%= @nonce %>" type="module" charset="utf-8" src="/model.js"></script>
+        <script nonce="<%= @nonce %>" type="module" charset="utf-8" src="/util.js"></script>
+        <script nonce="<%= @nonce %>" type="module" charset="utf-8" src="/settings.js"></script>
+        <script nonce="<%= @nonce %>" type="module" charset="utf-8" src="/api.js"></script>
+        <script nonce="<%= @nonce %>" type="module" charset="utf-8" src="/query_builder.js"></script>
+        <script nonce="<%= @nonce %>" type="module" charset="utf-8" src="/dialogs.js"></script>
+        <script nonce="<%= @nonce %>" type="module" charset="utf-8" src="/dlg_annotation.js"></script>
+        <script nonce="<%= @nonce %>" type="module" charset="utf-8" src="/dlg_pick_user.js"></script>
+        <script nonce="<%= @nonce %>" type="module" charset="utf-8" src="/dlg_pick_proj.js"></script>
+        <script nonce="<%= @nonce %>" type="module" charset="utf-8" src="/dlg_set_acls.js"></script>
+        <script nonce="<%= @nonce %>" type="module" charset="utf-8" src="/dlg_data_new_edit.js"></script>
+        <script nonce="<%= @nonce %>" type="module" charset="utf-8" src="/dlg_coll_new_edit.js"></script>
+        <script nonce="<%= @nonce %>" type="module" charset="utf-8" src="/dlg_query_save.js"></script>
+        <script nonce="<%= @nonce %>" type="module" charset="utf-8" src="/dlg_groups.js"></script>
+        <script nonce="<%= @nonce %>" type="module" charset="utf-8" src="/dlg_group_edit.js"></script>
+        <script nonce="<%= @nonce %>" type="module" charset="utf-8" src="/dlg_proj_new_edit.js"></script>
+        <script nonce="<%= @nonce %>" type="module" charset="utf-8" src="/dlg_alloc_new_edit.js"></script>
+        <script nonce="<%= @nonce %>" type="module" charset="utf-8" src="/dlg_start_xfer.js"></script>
+        <script nonce="<%= @nonce %>" type="module" charset="utf-8" src="/dlg_ep_browse.js"></script>
+        <script nonce="<%= @nonce %>" type="module" charset="utf-8" src="/dlg_settings.js"></script>
+        <script nonce="<%= @nonce %>" type="module" charset="utf-8" src="/dlg_repo_edit.js"></script>
+        <script nonce="<%= @nonce %>" type="module" charset="utf-8" src="/dlg_repo_manage.js"></script>
+        <script nonce="<%= @nonce %>" type="module" charset="utf-8" src="/dlg_owner_chg_confirm.js"></script>
+        <script nonce="<%= @nonce %>" type="module" charset="utf-8" src="/dlg_schema.js"></script>
+        <script nonce="<%= @nonce %>" type="module" charset="utf-8" src="/dlg_schema_list.js"></script>
+        <script nonce="<%= @nonce %>" type="module" charset="utf-8" src="/dlg_query_builder.js"></script>
+        <script nonce="<%= @nonce %>" type="module" charset="utf-8" src="/panel_catalog.js"></script>
+        <script nonce="<%= @nonce %>" type="module" charset="utf-8" src="/panel_graph.js"></script>
+        <script nonce="<%= @nonce %>" type="module" charset="utf-8" src="/panel_item_info.js"></script>
+        <script nonce="<%= @nonce %>" type="module" charset="utf-8" src="/main_browse_tab.js"></script>
+        <script nonce="<%= @nonce %>" type="module" charset="utf-8" src="/main.js"></script>
         <title>DataFed Main</title>
     </head>
     <body>