Merge branch 'experiment/disablewebsecurity' into dev

CHANGELOG.md

@@ -4,6 +4,7 @@
 ## Release v1.2.0 (Beta)
 
 ### Improvements
+- Add **Allow insecure contents** option to render images with `http://`.
 
 #### OS X
 - Add the option to show the icon on menu bar
@@ -67,7 +68,6 @@ The `electron-mattermost` project is now the official desktop application for th
 ### Known issues
 
 #### All platforms
-- Images with `http://` do not render.
 - Basic Authentication is not working.
 - Some keyboard shortcuts are missing. (e.g. <kbd>Ctrl+W</kbd>, <kbd>Command+,</kbd>)
 - Basic authentication requires a command line.

docs/setup.md

@@ -48,8 +48,12 @@ The Settings Page is available from the **File** menu under **Settings** (Click
    2. Enter **URL** for the team site location. For example: `https://example.com/teamname` then click **Add**.
 - **Delete a Team Site**:
    1. Delete a Team Site by clicking the "x" next to the URL of the team site you wish to delete.
-- **Hide Menu Bar**
+- **Options**
-   1. Under **Options** enable this option to hide the menu bar by default. Press "Alt" to show the Menu Bar.
+  - **Hide Menu Bar**
+    1. Under **Options** enable this option to hide the menu bar by default. Press "Alt" to show the Menu Bar.
+  - **Allow insecure contents**
+    1. Your team is hosted on `https://`, images with `http://` are not rendered by default.
+       This option allows such images to be rendered, but please be careful for security.
 
 ### Menu Bar
 

src/browser/index.jsx

@@ -256,6 +256,12 @@ var MattermostView = React.createClass({
     var thisObj = this;
     var webview = ReactDOM.findDOMNode(this.refs.webview);
 
+    // This option disables the same-origin policy and allows js/css/plugins not only content like images.
+    if (config.disablewebsecurity === true) {
+      // webview.setAttribute('disablewebsecurity', false) disables websecurity. (electron's bug?)
+      webview.setAttribute('disablewebsecurity', true);
+    }
+
     webview.addEventListener('did-fail-load', function(e) {
       console.log(thisObj.props.name, 'webview did-fail-load', e);
       if (e.errorCode === -3) { // An operation was aborted (due to user action).

src/browser/settings.jsx

@@ -28,11 +28,7 @@ var SettingsPage = React.createClass({
     } catch (e) {
       config = settings.loadDefault();
     }
-    return {
+    return config;
-      teams: config.teams,
-      hideMenuBar: config.hideMenuBar,
-      showTrayIcon: config.showTrayIcon
-    };
   },
   handleTeamsChange: function(teams) {
     this.setState({
@@ -44,6 +40,7 @@ var SettingsPage = React.createClass({
       teams: this.state.teams,
       hideMenuBar: this.state.hideMenuBar,
       showTrayIcon: this.state.showTrayIcon,
+      disablewebsecurity: this.state.disablewebsecurity,
       version: settings.version
     };
     settings.writeFileSync(this.props.configFile, config);
@@ -57,6 +54,11 @@ var SettingsPage = React.createClass({
   handleCancel: function() {
     backToIndex();
   },
+  handleChangeDisableWebSecurity: function() {
+    this.setState({
+      disablewebsecurity: this.refs.disablewebsecurity.getChecked()
+    });
+  },
   handleChangeHideMenuBar: function() {
     this.setState({
       hideMenuBar: this.refs.hideMenuBar.getChecked()
@@ -85,6 +87,8 @@ var SettingsPage = React.createClass({
       options.push(<Input ref="showTrayIcon" type="checkbox" label="Show Icon on Menu Bar (Need to restart the application)" checked={ this.state.showTrayIcon } onChange={ this.handleChangeShowTrayIcon }
                    />);
     }
+    options.push(<Input ref="disablewebsecurity" type="checkbox" label="Allow insecure contents (This allows not only insecure images, but also insecure scripts)" checked={ this.state.disablewebsecurity }
+                   onChange={ this.handleChangeDisableWebSecurity } />);
     var options_row = (options.length > 0) ? (
       <Row>
         <Col md={ 12 }>

src/common/settings.js

@@ -24,6 +24,7 @@ var loadDefault = function(version) {
         teams: [],
         hideMenuBar: false,
         showTrayIcon: false,
+        disablewebsecurity: false,
         version: 1
       };
   }