diff --git a/copyparty/web/browser.js b/copyparty/web/browser.js
index 587362b7..5bf68bd8 100644
--- a/copyparty/web/browser.js
+++ b/copyparty/web/browser.js
@@ -6605,7 +6605,7 @@ function show_md(md, name, div, url, depth) {
md_plug = {}
md = load_md_plug(md, 'pre');
- md = load_md_plug(md, 'post');
+ md = load_md_plug(md, 'post', sb_md);
var marked_opts = {
headerPrefix: 'md-',
@@ -6618,7 +6618,8 @@ function show_md(md, name, div, url, depth) {
try {
clmod(div, 'mdo', 1);
- sandbox(div, sb_md, 'mdo', marked.parse(md, marked_opts));
+ if (sandbox(div, sb_md, 'mdo', marked.parse(md, marked_opts)))
+ return;
ext = md_plug.post;
ext = ext ? [ext[0].render, ext[0].render2] : [];
@@ -6687,13 +6688,20 @@ function sandbox(tgt, rules, cls, html) {
want = hash.slice(1);
html = '' + html +
- '' +
+ '';
var fr = mknod('iframe');
diff --git a/copyparty/web/util.js b/copyparty/web/util.js
index 661e1cea..ef87a1d9 100644
--- a/copyparty/web/util.js
+++ b/copyparty/web/util.js
@@ -1532,25 +1532,33 @@ var md_plug_err = function (ex, js) {
if (ex)
console.log(ex, js);
};
-function load_md_plug(md_text, plug_type) {
+function load_md_plug(md_text, plug_type, defer) {
+ if (defer)
+ md_plug[plug_type] = null;
+
if (!have_emp)
return md_text;
- var find = '\n```copyparty_' + plug_type + '\n';
- var ofs = md_text.indexOf(find);
- if (ofs === -1)
+ var find = '\n```copyparty_' + plug_type + '\n',
+ md = md_text.replace(/\r/g, ''),
+ ofs = md.indexOf(find),
+ ofs2 = md.indexOf('\n```', ofs + 1);
+
+ if (ofs < 0 || ofs2 < 0)
return md_text;
- var ofs2 = md_text.indexOf('\n```', ofs + 1);
- if (ofs2 == -1)
- return md_text;
+ var js = md.slice(ofs + find.length, ofs2 + 1);
+ md = md.slice(0, ofs + 1) + md.slice(ofs2 + 4);
+ md = md.replace(/$/g, '\r');
- var js = md_text.slice(ofs + find.length, ofs2 + 1);
- var md = md_text.slice(0, ofs + 1) + md_text.slice(ofs2 + 4);
+ if (defer) { // insert into sandbox
+ md_plug[plug_type] = js;
+ return md;
+ }
var old_plug = md_plug[plug_type];
if (!old_plug || old_plug[1] != js) {
- js = 'const x = { ' + js + ' }; x;';
+ js = 'const loc = new URL("' + location.href + '"), x = { ' + js + ' }; x;';
try {
var x = eval(js);
if (x['ctor']) {
diff --git a/srv/extend.md b/srv/extend.md
index ab8c2f6f..bc9911b9 100644
--- a/srv/extend.md
+++ b/srv/extend.md
@@ -54,6 +54,8 @@ the values in the `ex:` columns are linkified to `example.com/$value`
and the table can be sorted by clicking the headers
+the sandbox also makes `location` unavailable but there is `loc` instead; this website's url is foo
+
the difference is that with `copyparty_pre` you'll probably break various copyparty features but if you use `copyparty_post` then future copyparty versions will probably break you
@@ -136,6 +138,10 @@ render(dom) {
}
},
render2(dom) {
+ // loc == window.location except available inside sandbox
+ ebi('whereami').innerHTML = loc.href;
+
+ // this one also works because util.js gets pulled into the sandbox
window.makeSortable(dom.getElementsByTagName('table')[0]);
}
```