Make "disablewebsecurity" optional

src/browser/index.jsx

@@ -247,8 +247,10 @@ var MattermostView = React.createClass({
     var webview = ReactDOM.findDOMNode(this.refs.webview);
 
     // This option disables the same-origin policy and allows js/css/plugins not only content like images.
-    // So this should not be enabled.
-    webview.setAttribute('disablewebsecurity', true);
+    if (config.disablewebsecurity === true) {
+      // webview.setAttribute('disablewebsecurity', false) disables websecurity. (electron's bug?)
+      webview.setAttribute('disablewebsecurity', true);
+    }
 
     webview.addEventListener('did-fail-load', function(e) {
       console.log(thisObj.props.name, 'webview did-fail-load', e);

src/browser/settings.jsx

@@ -28,11 +28,7 @@ var SettingsPage = React.createClass({
     } catch (e) {
       config = settings.loadDefault();
     }
-    return {
-      teams: config.teams,
-      hideMenuBar: config.hideMenuBar,
-      showTrayIcon: config.showTrayIcon
-    };
+    return config;
   },
   handleTeamsChange: function(teams) {
     this.setState({
@@ -44,6 +40,7 @@ var SettingsPage = React.createClass({
       teams: this.state.teams,
       hideMenuBar: this.state.hideMenuBar,
       showTrayIcon: this.state.showTrayIcon,
+      disablewebsecurity: this.state.disablewebsecurity,
       version: settings.version
     };
     settings.writeFileSync(this.props.configFile, config);
@@ -57,6 +54,11 @@ var SettingsPage = React.createClass({
   handleCancel: function() {
     backToIndex();
   },
+  handleChangeDisableWebSecurity: function() {
+    this.setState({
+      disablewebsecurity: this.refs.disablewebsecurity.getChecked()
+    });
+  },
   handleChangeHideMenuBar: function() {
     this.setState({
       hideMenuBar: this.refs.hideMenuBar.getChecked()
@@ -85,6 +87,8 @@ var SettingsPage = React.createClass({
       options.push(<Input ref="showTrayIcon" type="checkbox" label="Show Icon on Menu Bar (Need to restart the application)" checked={ this.state.showTrayIcon } onChange={ this.handleChangeShowTrayIcon }
                    />);
     }
+    options.push(<Input ref="disablewebsecurity" type="checkbox" label="Allow insecure contents (This allows not only insecure images, but also insecure scripts)" checked={ this.state.disablewebsecurity }
+                   onChange={ this.handleChangeDisableWebSecurity } />);
     var options_row = (options.length > 0) ? (
       <Row>
         <Col md={ 12 }>

src/common/settings.js

@@ -24,6 +24,7 @@ var loadDefault = function(version) {
         teams: [],
         hideMenuBar: false,
         showTrayIcon: false,
+        disablewebsecurity: false,
         version: 1
       };
   }