From c4f8fb78eeef1c9536caae4c8cced4f0f50f1932 Mon Sep 17 00:00:00 2001
From: Stefan Bühler
Date: Wed, 13 Sep 2017 14:48:39 +0200
Subject: don't require referer to find note id in socket.io connections (fixes
 #623)

Signed-off-by: Stefan Bühler <buehler@cert.uni-stuttgart.de>
---
 lib/realtime.js    | 20 ++++++++++++++------
 public/js/index.js |  3 +++
 2 files changed, 17 insertions(+), 6 deletions(-)

diff --git a/lib/realtime.js b/lib/realtime.js
index c731e5b0..d6ba62b2 100644
--- a/lib/realtime.js
+++ b/lib/realtime.js
@@ -272,16 +272,24 @@ function isReady () {
 }
 
 function extractNoteIdFromSocket (socket) {
-  if (!socket || !socket.handshake || !socket.handshake.headers) {
+  if (!socket || !socket.handshake) {
     return false
   }
-  var referer = socket.handshake.headers.referer
-  if (!referer) {
+  if (socket.handshake.query && socket.handshake.query.noteId) {
+    return socket.handshake.query.noteId
+  } else if (socket.handshake.headers) {
+    // this part is only for backward compatibility only; current code
+    // should be using noteId query parameter instead.
+    var referer = socket.handshake.headers.referer
+    if (!referer) {
+      return false
+    }
+    var hostUrl = url.parse(referer)
+    var noteId = config.urlpath ? hostUrl.pathname.slice(config.urlpath.length + 1, hostUrl.pathname.length).split('/')[1] : hostUrl.pathname.split('/')[1]
+    return noteId
+  } else {
     return false
   }
-  var hostUrl = url.parse(referer)
-  var noteId = config.urlpath ? hostUrl.pathname.slice(config.urlpath.length + 1, hostUrl.pathname.length).split('/')[1] : hostUrl.pathname.split('/')[1]
-  return noteId
 }
 
 function parseNoteIdFromSocket (socket, callback) {
diff --git a/public/js/index.js b/public/js/index.js
index 5ff716fd..096f7fde 100644
--- a/public/js/index.js
+++ b/public/js/index.js
@@ -1762,6 +1762,9 @@ window.havePermission = havePermission
 var io = require('socket.io-client')
 var socket = io.connect({
   path: urlpath ? '/' + urlpath + '/socket.io/' : '',
+  query: {
+    noteId: noteid
+  },
   timeout: 5000, // 5 secs to timeout,
   reconnectionAttempts: 20 // retry 20 times on connect failed
 })
-- 
cgit v1.2.3