All notification clicks are not created equal
-
-
-
@masonwheeler I'm done for now.
-
@loopback0 what did you do to my parser?
-
@TimeBandit said in All notification clicks are not created equal:
Pics or it didn't happen.
-
@loopback0 said in All notification clicks are not created equal:
@TimeBandit said in All notification clicks are not created equal:
Pics or it didn't happen.
@Canada isn't even a real sock puppet!
-
@ben_lubar said in All notification clicks are not created equal:
what did you do to my parser?
I think it enjoyed it.
-
@loopback0 said in All notification clicks are not created equal:
@ben_lubar said in All notification clicks are not created equal:
what did you do to my parser?
I think it enjoyed it.
Oh, at least it's good to know that notifications:upvoted_your_post_in can't be used as XSS.
-
@ben_lubar can you respond to this please?
@anotherusername said in All notification clicks are not created equal:
@anotherusername so basically, I'm getting a notification object like this...
{ alert_id: "new_notif", clickfn: i.prepareDOM/</n.clickfn(), title: "[[notifications:new_notification]]", timeout: 2000, message: "[[notifications:upvoted_your_post_in, Luhmann, The Official Likes Topic]]", type: "info" }
I can call,
templates.parse('alert', temp3, function (t) { console.log(t); });
...and that dumps this:
<div id="new_notif" class="alert alert-dismissable alert-info clearfix" component="toaster/toast"> <button type="button" class="close" data-dismiss="alert" aria-hidden="true">×</button> <strong>[[notifications:new_notification]]</strong> <p>[[notifications:upvoted_your_post_in, Luhmann, The Official Likes Topic]]</p> </div>
I've dug through the source, though, and I still have no freaking clue how it does the translation so that the notification actually reads, "Luhmann has upvoted your post in The Official Likes Topic.".
(wtf... it was even replacing inside my post!)
Is there a function that I can call to translate it?
-
@ben_lubar said in All notification clicks are not created equal:
can't be used as XSS.
Not with that attitude.
-
@anotherusername said in All notification clicks are not created equal:
Is there a function that I can call to translate it?
require(['translator'], function(translator) { translator.translate('INPUT GOES HERE', function(text) { console.log(text); }); });
-
@ben_lubar hmm, that works a lot better once I remember to delete the invisible character that I added to make it stop replacing inside my post.
-
@loopback0 said in All notification clicks are not created equal:
@mods has upvoted your post in All notification clicks are not created equal.
?
@loopback0 said in All notification clicks are not created equal:
[[notifications:upvoted_your_post_in, @index @mods @administrators @area_can, All notification clicks are not created equal]]
?
You have summoned the mods. You should not have done that.
-
OK, someone did something that broke something very badly...
-
@masonwheeler if you want the secret, quote one of the weirdo posts with the composer already open.
-
@ben_lubar Or just use view raw.
-
@ben_lubar alright... so here's what I built...
if (Notification) { Notification.requestPermission(); require(['translator'], function (translator) { var NodeBB_alert = app.alert.bind(app); app.alert = function alert(n) { //console.log(n); Notification.requestPermission().then(function (permission) { if (n['alert_id'] != "bookmark" && permission == "granted") { translator.translate(n.title, function (title) { translator.translate(n.message, function (message) { var div = document.createElement('div'); div.innerHTML = title.trim(); title = div.innerText; div.innerHTML = message.trim(); var options = {body: div.innerText, requireInteraction: true}; options.lang = ajaxify.data.config.userLang || ajaxify.data.config.defaultLang; var notification = new Notification(title ? "WTDWTF - " + title : "WTDWTF", options); if (n.timeout) setTimeout(notification.close.bind(notification), n.timeout * 2); if (n.clickfn) notification.addEventListener('click', n.clickfn.bind(n)); }); }); } else { NodeBB_alert(n); } }); }; }); }
I went ahead and left the toaster to scroll to the last unread post, and I doubled the timeout because now they're further away, and it's more of a context shift when you see one.
-
@anotherusername unfortunately, it appears that
navigatingsomething screws it up...The
app.alert
function is getting replaced with the builtin one...
-
@anotherusername what in the...
The
clickfn
is doing a full load instead of an AJAX load! (And since I just ran the shim to test it, it's not in my userscript, so it doesn't get re-initialized.)Like... even ordinarily, if that shim isn't running...
WHY!?
edit: the
toSource
on the click function is:(function () { if (t.path.startsWith("http") && t.path.startsWith("https")) { window.location.href = t.path; } else { window.location.href = window.location.protocol + "//" + window.location.host + config.relative_path + t.path; } })
...aside from the fact that the
&&
should be||
, it's not even trying to do an AJAX load.
-
@anotherusername I found where it's setting it:
socket.on('event:new_notification', function (t) { var n = { alert_id: 'new_notif', title: '[[notifications:new_notification]]', timeout: 2000 }; if (t.path) { n.message = t.bodyShort; n.type = 'info'; n.clickfn = function () { if (t.path.startsWith('http') && t.path.startsWith('https')) { window.location.href = t.path; } else { window.location.href = window.location.protocol + '//' + window.location.host + config.relative_path + t.path; } } } else { n.message = '[[notifications:you_have_unread_notifications]]'; n.type = 'warning'; } app.alert(n); app.refreshTitle(); if (ajaxify.currentPage === 'notifications') { ajaxify.refresh(); } socket.emit('notifications.getCount', function (e, t) { if (e) { return app.alertError(e.message); } i.updateNotifCount(t); }); if (!r[t.nid]) { e.play('notification', t.nid); r[t.nid] = true; } });
If the link is definitely local (I can't imagine why it wouldn't be), all it'd need is
ajaxify.go(t.path)
. If it's an absolute URL, it'd need to be converted to a local URL...ajaxify.go
doesn't seem to like absolute URLs.edit: after fixing
&&
so that it's||
, then I think the second block of the conditional should be changed:- window.location.href = window.location.protocol + '//' + window.location.host + config.relative_path + t.path; + ajaxify.go(config.relative_path + t.path);