From 9c990ab08a51b921af8973dff8e7eddefa252b98 Mon Sep 17 00:00:00 2001
From: muxator <a.mux@inwind.it>
Date: Sun, 26 Aug 2018 03:43:53 +0200
Subject: [PATCH] skins: finalize support for multiple skins

The old "static/custom" directory is replaced by "static/skins/<skinName>",
where <skinName> is taken from settings.json.
When no value is found, a default of "no-skin" is assumed, so that backward
compatibility is maintained.

The most evident security concerns have been addressed.

Closes #3471.
---
 src/node/hooks/express/specialpages.js |  4 ++--
 src/static/js/ace.js                   |  4 ++--
 src/templates/index.html               |  4 ++--
 src/templates/javascript.html          | 12 ++++++------
 src/templates/pad.html                 |  4 ++--
 5 files changed, 14 insertions(+), 14 deletions(-)

diff --git a/src/node/hooks/express/specialpages.js b/src/node/hooks/express/specialpages.js
index ec149649..69d23ff6 100644
--- a/src/node/hooks/express/specialpages.js
+++ b/src/node/hooks/express/specialpages.js
@@ -26,7 +26,7 @@ exports.expressCreateServer = function (hook_name, args, cb) {
   //serve robots.txt
   args.app.get('/robots.txt', function(req, res)
   {
-    var filePath = path.join(settings.root, "src", "static", "custom", "robots.txt");
+    var filePath = path.join(settings.root, "src", "static", "skins", settings.skinName, "robots.txt");
     res.sendFile(filePath, function(err)
     {
       //there is no custom favicon, send the default robots.txt which dissallows all
@@ -79,7 +79,7 @@ exports.expressCreateServer = function (hook_name, args, cb) {
   //serve favicon.ico from all path levels except as a pad name
   args.app.get( /\/favicon.ico$/, function(req, res)
   {
-    var filePath = path.join(settings.root, "src", "static", "custom", "favicon.ico");
+    var filePath = path.join(settings.root, "src", "static", "skins", settings.skinName, "favicon.ico");
 
     res.sendFile(filePath, function(err)
     {
diff --git a/src/static/js/ace.js b/src/static/js/ace.js
index 3b8679b4..2f9c1e6d 100644
--- a/src/static/js/ace.js
+++ b/src/static/js/ace.js
@@ -230,7 +230,7 @@ function Ace2Editor()
       // disableCustomScriptsAndStyles can be used to disable loading of custom scripts
       if(!clientVars.disableCustomScriptsAndStyles){
         $$INCLUDE_CSS("../static/css/pad.css");
-        $$INCLUDE_CSS("../static/custom/pad.css");
+        $$INCLUDE_CSS(`../static/skins/${clientVars.skinName}/pad.css`);
       }
 
       var additionalCSS = _(hooks.callAll("aceEditorCSS")).map(function(path){
@@ -314,7 +314,7 @@ window.onload = function () {\n\
       var $$INCLUDE_CSS = function(filename) {includedCSS.push(filename)};
       $$INCLUDE_CSS("../static/css/iframe_editor.css");
       $$INCLUDE_CSS("../static/css/pad.css");
-      $$INCLUDE_CSS("../static/custom/pad.css");
+      $$INCLUDE_CSS(`../static/skins/${clientVars.skinName}/pad.css`);
 
 
       var additionalCSS = _(hooks.callAll("aceEditorCSS")).map(function(path){
diff --git a/src/templates/index.html b/src/templates/index.html
index 92bea582..87fe0ee7 100644
--- a/src/templates/index.html
+++ b/src/templates/index.html
@@ -156,7 +156,7 @@
               }
             }
         </style>
-        <link href="static/custom/index.css" rel="stylesheet">
+        <link href="static/skins/<%=encodeURI(settings.skinName)%>/index.css" rel="stylesheet">
 
         <div id="wrapper">
         <% e.begin_block("indexWrapper"); %>
@@ -171,7 +171,7 @@
         <% e.end_block(); %>
         </div>
 
-        <script src="static/custom/index.js"></script>
+        <script src="static/skins/<%=encodeURI(settings.skinName)%>/index.js"></script>
         <script>
             // @license magnet:?xt=urn:btih:8e4f440f4c65981c5bf93c76d35135ba5064d8b7&dn=apache-2.0.txt
             function go2Name()
diff --git a/src/templates/javascript.html b/src/templates/javascript.html
index 29031c4b..a9038381 100644
--- a/src/templates/javascript.html
+++ b/src/templates/javascript.html
@@ -34,19 +34,19 @@
                 <td><a href="/static/js/require-kernel.js">require-kernel.js</a></td>
             </tr>
             <tr>
-                <td><a href="/static/custom/index.js">index.js</a></td>
+                <td><a href="/static/skins/<%=encodeURI(settings.skinName)%>/index.js">index.js</a></td>
                 <td><a href="http://www.apache.org/licenses/LICENSE-2.0">Apache-2.0-only</a></td>
-                <td><a href="/static/custom/index.js">index.js</a></td>
+                <td><a href="/static/skins/<%=encodeURI(settings.skinName)%>/index.js">index.js</a></td>
             </tr>
             <tr>
-                <td><a href="/static/custom/timeslider.js">timeslider.js</a></td>
+                <td><a href="/static/skins/<%=encodeURI(settings.skinName)%>/timeslider.js">timeslider.js</a></td>
                 <td><a href="http://www.apache.org/licenses/LICENSE-2.0">Apache-2.0-only</a></td>
-                <td><a href="/static/custom/timeslider.js">timeslider.js</a></td>
+                <td><a href="/static/skins/<%=encodeURI(settings.skinName)%>/timeslider.js">timeslider.js</a></td>
             </tr>
             <tr>
-                <td><a href="/static/custom/pad.js">pad.js</a></td>
+                <td><a href="/static/skins/<%=encodeURI(settings.skinName)%>/pad.js">pad.js</a></td>
                 <td><a href="http://www.apache.org/licenses/LICENSE-2.0">Apache-2.0-only</a></td>
-                <td><a href="/static/custom/pad.js">pad.js</a></td>
+                <td><a href="/static/skins/<%=encodeURI(settings.skinName)%>/pad.js">pad.js</a></td>
             </tr>
             <tr>
                 <td><a href="/static/js/admin/plugins.js">plugins.js</a></td>
diff --git a/src/templates/pad.html b/src/templates/pad.html
index 9a9c6f07..e2dc8978 100644
--- a/src/templates/pad.html
+++ b/src/templates/pad.html
@@ -44,7 +44,7 @@
         <link href="../static/css/pad.css" rel="stylesheet">
 
         <% e.begin_block("customStyles"); %>
-        <link href="../static/custom/pad.css" rel="stylesheet">
+        <link href="../static/skins/<%=encodeURI(settings.skinName)%>/pad.css" rel="stylesheet">
         <% e.end_block(); %>
 
         <style title="dynamicsyntax"></style>
@@ -378,7 +378,7 @@
         <script type="text/javascript" src="../javascripts/lib/ep_etherpad-lite/static/js/ace2_common.js?callback=require.define"></script>
 
         <% e.begin_block("customScripts"); %>
-        <script type="text/javascript" src="../static/custom/pad.js"></script>
+        <script type="text/javascript" src="../static/skins/<%=encodeURI(settings.skinName)%>/pad.js"></script>
         <% e.end_block(); %>
 
         <!-- Bootstrap page -->