mirror of
https://github.com/bulwarkmail/webmail.git
synced 2026-10-31 16:13:15 +00:00
Linus Rath
034ee27057
The startup banner printed `/setup?token=...`, so the one-hour bootstrap token that grants the setup wizard landed in reverse-proxy access logs, Referer headers and browser history. The link now carries the token in the fragment, which never leaves the browser, and the wizard removes it from the address bar as soon as it reads it. Old `?token=` links still work and are cleaned up the same way.
22 lines
948 B
TypeScript
22 lines
948 B
TypeScript
/**
|
|
* The setup link printed at startup carries the token in the fragment
|
|
* (`/setup#token=...`): a fragment never reaches the server, a reverse
|
|
* proxy's access log or a Referer. Older logs printed `?token=`, which is
|
|
* still accepted. Either way the token is removed from the address bar (and
|
|
* so from history) as soon as it is read.
|
|
*/
|
|
export function takeSetupTokenFromUrl(
|
|
location: Pick<Location, 'hash' | 'search' | 'pathname'>,
|
|
history: Pick<History, 'replaceState' | 'state'>,
|
|
): string {
|
|
const fromHash = new URLSearchParams(location.hash.replace(/^#/, '')).get('token');
|
|
const search = new URLSearchParams(location.search);
|
|
const fromQuery = search.get('token');
|
|
if (fromHash === null && fromQuery === null) return '';
|
|
|
|
search.delete('token');
|
|
const rest = search.toString();
|
|
history.replaceState(history.state, '', location.pathname + (rest ? `?${rest}` : ''));
|
|
return (fromHash ?? fromQuery ?? '').trim();
|
|
}
|