From 61f2c93493f5655897cd3ad382680c8473810586 Mon Sep 17 00:00:00 2001
From: minoplhy <c@3qx.nl>
Date: Sat, 12 Apr 2025 14:15:32 +0700
Subject: [PATCH] 1.2.1: change versioning scheme / avoid unsafe inline
 javascript

---
 actix/Cargo.lock           |  2 +-
 actix/Cargo.toml           |  2 +-
 resources/index.html       |  7 ++---
 resources/static/script.js | 57 ++++++++++++++++++++++++++++++++++----
 4 files changed, 57 insertions(+), 11 deletions(-)

diff --git a/actix/Cargo.lock b/actix/Cargo.lock
index 524a140..196c464 100644
--- a/actix/Cargo.lock
+++ b/actix/Cargo.lock
@@ -458,7 +458,7 @@ checksum = "baf1de4339761588bc0619e3cbc0120ee582ebb74b53b4efbf79117bd2da40fd"
 
 [[package]]
 name = "chhoto-url"
-version = "1.2.0"
+version = "1.2.1"
 dependencies = [
  "actix-files",
  "actix-session",
diff --git a/actix/Cargo.toml b/actix/Cargo.toml
index 4659b49..e3e0ac6 100644
--- a/actix/Cargo.toml
+++ b/actix/Cargo.toml
@@ -3,7 +3,7 @@
 
 [package]
 name = "chhoto-url"
-version = "1.2.0"
+version = "1.2.1"
 edition = "2021"
 authors = ["Sayantan Santra <sayantan[dot]santra689[at]gmail[dot]com"]
 license = "mit"
diff --git a/resources/index.html b/resources/index.html
index 2cccb2d..f91bfa4 100644
--- a/resources/index.html
+++ b/resources/index.html
@@ -32,8 +32,7 @@
                 <legend id="logo"><img src="assets/favicon-32.png" width="26px" alt="logo"> Chhoto URL</legend>
                 <div class="pure-control-group">
                     <label for="longUrl">Long URL</label>
-                    <input type="url" name="longUrl" id="longUrl" placeholder="Please enter a valid URL"
-                        onblur="addProtocol(this)" required />
+                    <input type="url" name="longUrl" id="longUrl" placeholder="Please enter a valid URL" required />
                 </div>
                 <div class="pure-control-group">
                     <label for="shortUrl">Short URL (optional)</label>
@@ -67,9 +66,9 @@
     </div>
 
     <div name="links-div">
-        <a id="admin-button" href="javascript:getLogin()" hidden>login</a>
+        <a id="admin-button" href="#" hidden>login</a>
         &nbsp;
-        <a id="api-key-button" href="javascript:fetchApiKey()" hidden>API Key</a>
+        <a id="api-key-button" href="#" hidden>API Key</a>
         &nbsp;
         <a id="version-number" href="https://github.com/minoplhy/chhoto-url" target="_blank" rel="noopener noreferrer"
             hidden>Source Code</a>
diff --git a/resources/static/script.js b/resources/static/script.js
index e90bf56..b26ba6b 100644
--- a/resources/static/script.js
+++ b/resources/static/script.js
@@ -30,7 +30,7 @@ const showVersion = async () => {
     let version = await getVersion();
     link = document.getElementById("version-number");
     link.innerText = "v" + version;
-    link.href = "https://github.com/SinTan1729/chhoto-url/releases/tag/" + version;
+    link.href = "https://github.com/minoplhy/chhoto-url/releases/tag/" + version;
     link.hidden = false;
 }
 
@@ -38,7 +38,17 @@ const getLogin = async () => {
     document.getElementById("container").style.filter = "blur(2px)";
     document.getElementById("login-dialog").showModal();
     document.getElementById("password").focus();
-}
+};
+
+document.addEventListener("DOMContentLoaded", () => {
+    const adminButton = document.getElementById("admin-button");
+    if (adminButton) {
+        adminButton.addEventListener("click", (e) => {
+            e.preventDefault();
+            getLogin();
+        });
+    }
+});
 
 const refreshData = async () => {
     let res = await fetch(prepSubdir("/api/all"));
@@ -65,11 +75,21 @@ const refreshData = async () => {
 const displayData = async (data) => {
     showVersion();
     let site = await getSiteUrl();
-    admin_button = document.getElementById("admin-button");
+
+    const admin_button = document.getElementById("admin-button");
     admin_button.innerText = "logout";
-    admin_button.href = "javascript:logOut()";
+    admin_button.removeAttribute("href");
     admin_button.hidden = false;
 
+    const newButton = admin_button.cloneNode(true);
+    newButton.href = "#";
+    admin_button.parentNode.replaceChild(newButton, admin_button);
+
+    newButton.addEventListener("click", (e) => {
+        e.preventDefault();
+        logOut();
+    });
+
     apikey_button = document.getElementById("api-key-button");
     apikey_button.innerText = "API Key"
     apikey_button.hidden = false;
@@ -105,6 +125,15 @@ const showAlert = async (text, col) => {
     controls.appendChild(alertBox);
 }
 
+document.addEventListener("click", (e) => {
+    const link = e.target.closest(".copy-short-url");
+    if (link) {
+        e.preventDefault();
+        const shortlink = link.dataset.shortlink;
+        copyShortUrl(shortlink);
+    }
+});
+
 const TR = (row, site) => {
     const tr = document.createElement("tr");
     const longTD = TD(A_LONG(row["longlink"]), "Long URL");
@@ -153,8 +182,16 @@ const addProtocol = (input) => {
     return input;
 }
 
+document.addEventListener("DOMContentLoaded", () => {
+    const longUrlInput = document.getElementById("longUrl");
+
+    longUrlInput.addEventListener("blur", () => {
+        addProtocol(longUrlInput);
+    });
+});
+
 const A_LONG = (s) => `<a href='${s}'>${s}</a>`;
-const A_SHORT = (s, t) => `<a href="javascript:copyShortUrl('${s}');">${s}</a>`;
+const A_SHORT = (s, t) => `<a href="#" class="copy-short-url" data-shortlink="${s}">${s}</a>`;
 const A_SHORT_INSECURE = (s, t) => `<a href="${t}/${s}">${s}</a>`;
 
 const deleteButton = (shortUrl) => {
@@ -312,6 +349,16 @@ const fetchApiKey = async () => {
     }
 }
 
+document.addEventListener("DOMContentLoaded", () => {
+    const adminButton = document.getElementById("api-key-button");
+    if (adminButton) {
+        adminButton.addEventListener("click", (e) => {
+            e.preventDefault();
+            fetchApiKey();
+        });
+    }
+});
+
 const logOut = async () => {
     let reply = await fetch(prepSubdir("/api/logout"), {method: "DELETE"}).then(res => res.text());
     console.log(reply);