diff --git a/elements/routing.js b/elements/routing.js
index f28c1e5003..1c3037cce8 100644
--- a/elements/routing.js
+++ b/elements/routing.js
@@ -27,22 +27,34 @@ function scrollToTop(ctx, next) {
next();
}
-function getTrustedDomains(path) {
+function createUrlFromString(str) {
+ const httpRegex = /^https?:\/\//;
+ const wwwRegex = /www\./;
+ str = httpRegex.test(str) ? str : `http://${str}`;
+ str = wwwRegex.test(str) ? str : str.replace(/^(https?:\/\/)?/, '$1www.');
+ return str;
+}
+
+function isTrustedDomain(path) {
const trustedDomains = Nuxeo && Nuxeo.UI && Nuxeo.UI.config && Nuxeo.UI.config.trustedDomains;
- const pathUrl = new URL(path);
- const { hostname } = pathUrl;
- const queryParams = pathUrl.search.split('?')[1];
- const encodepath = queryParams ? `${pathUrl.origin}?${encodeURIComponent(queryParams)}` : path;
- if (!trustedDomains) return { encodepath, isvalidUrl: true };
+ if (!trustedDomains) return true;
+ const modifiedPathUrl = createUrlFromString(path);
+ const pathUrl = new URL(modifiedPathUrl);
+ const { hostname: userHostName } = pathUrl;
const trustedDomainList = trustedDomains.split(',');
- const isvalidUrl = trustedDomainList.some((url) => {
- const isFullpath = /^http(s)?:\/\//.test(url);
- const parsedURL = isFullpath ? url : `https://${url}`;
- const { hostname: currentUrlhost } = new URL(parsedURL);
- return currentUrlhost.toLowerCase() === hostname.toLowerCase();
+ const isValidUrl = trustedDomainList.some((url) => {
+ const updatedUrl = createUrlFromString(url);
+ const { hostname: currentUrlHostName } = new URL(updatedUrl);
+ return currentUrlHostName?.toLowerCase() === userHostName?.toLowerCase();
});
+ return isValidUrl;
+}
- return { encodepath, isvalidUrl };
+function encodeQueryParams(path) {
+ const pathUrl = new URL(path);
+ const queryParams = pathUrl.search.split('?')[1];
+ const encodepath = queryParams ? `${pathUrl.origin}?${encodeURIComponent(queryParams)}` : path;
+ return encodepath;
}
function _routeAdmin(selectedAdminTab, errorPath, routeData) {
@@ -214,8 +226,9 @@ app.router = {
}
const isFullpath = /^http(s)?:\/\//.test(path);
if (isFullpath) {
- const { encodepath, isvalidUrl } = getTrustedDomains(path);
- if (isvalidUrl) {
+ const isValidUrl = isTrustedDomain(path);
+ if (isValidUrl) {
+ const encodepath = encodeQueryParams(path);
const link = document.createElement('a');
link.setAttribute('href', encodepath);
link.click();
diff --git a/plugin/web-ui/addon/src/main/resources/OSGI-INF/web-ui-properties.xml b/plugin/web-ui/addon/src/main/resources/OSGI-INF/web-ui-properties.xml
index b7dfd741f3..4d3d20fdfe 100644
--- a/plugin/web-ui/addon/src/main/resources/OSGI-INF/web-ui-properties.xml
+++ b/plugin/web-ui/addon/src/main/resources/OSGI-INF/web-ui-properties.xml
@@ -52,7 +52,7 @@
- ${nuxeo.trustedDomains}
-
+ ${org.nuxeo.web.ui.trustedDomains:=''}
+
-
+
\ No newline at end of file