18.0.8 release

ChangeLog

@@ -1,3 +1,7 @@
+19-MAY-2022: 18.0.8
+
+- Deletes unused ExportProxyServlet
+
 17-MAY-2022: 18.0.7
 
 - Sets setInstanceFollowRedirects(false) in proxyservlet

VERSION

@@ -1 +1 @@
-18.0.7
+18.0.8

src/main/java/com/mxgraph/online/EmbedServlet2.java

@@ -24,6 +24,7 @@
 import java.io.InputStream;
 import java.io.OutputStream;
 import java.io.PrintWriter;
+import java.net.HttpURLConnection;
 import java.net.URL;
 import java.net.URLConnection;
 import java.text.DateFormat;
@@ -398,6 +399,7 @@ public String createEmbedJavaScript(HttpServletRequest request)
 						completed.add(urls[i]);
 						URL url = new URL(urls[i]);
 						URLConnection connection = url.openConnection();
+						((HttpURLConnection) connection).setInstanceFollowRedirects(false);
 						ByteArrayOutputStream stream = new ByteArrayOutputStream();
 						Utils.copy(connection.getInputStream(), stream);
 						setCachedUrls += "GraphViewer.cachedUrls['"

src/main/webapp/WEB-INF/web.xml

@@ -95,20 +95,6 @@
     <servlet-name>ConverterServlet</servlet-name>
     <url-pattern>/convert</url-pattern>
   </servlet-mapping>
-  <servlet>
-    <description/>
-    <display-name>ExportProxyServlet</display-name>
-    <servlet-name>ExportProxyServlet</servlet-name>
-    <servlet-class>com.mxgraph.online.ExportProxyServlet</servlet-class>
-  </servlet>
-  <servlet-mapping>
-    <servlet-name>ExportProxyServlet</servlet-name>
-    <url-pattern>/export</url-pattern>
-  </servlet-mapping>
-  <servlet-mapping>
-    <servlet-name>ExportProxyServlet</servlet-name>
-    <url-pattern>/service/*</url-pattern>
-  </servlet-mapping>
   <servlet>
     <description/>
     <display-name>GitlabAuthServlet</display-name>

src/main/webapp/electron.js

@@ -38,6 +38,7 @@ const isMac = process.platform === 'darwin'
 const isWin = process.platform === 'win32'
 let enableSpellCheck = store.get('enableSpellCheck');
 enableSpellCheck = enableSpellCheck != null? enableSpellCheck : isMac;
+let enableStoreBkp = store.get('enableStoreBkp') != null? store.get('enableStoreBkp') : true;
 
 //Read config file
 var queryObj = {
@@ -55,7 +56,8 @@ var queryObj = {
 	'export': 'https://convert.diagrams.net/node/export',
 	'disableUpdate': disableUpdate? 1 : 0,
 	'winCtrls': isMac? 0 : 1,
-	'enableSpellCheck': enableSpellCheck? 1 : 0
+	'enableSpellCheck': enableSpellCheck? 1 : 0,
+	'enableStoreBkp': enableStoreBkp? 1 : 0
 };
 
 try
@@ -75,6 +77,9 @@ catch(e)
 	console.log('Error in urlParams.json file: ' + e.message);
 }
 
+// Trying sandboxing the renderer for more protection
+app.enableSandbox();
+
 function createWindow (opt = {})
 {
 	let lastWinSizeStr = store.get('lastWinSize');
@@ -93,7 +98,7 @@ function createWindow (opt = {})
 			preload: `${__dirname}/electron-preload.js`,
 			spellcheck: enableSpellCheck,
 			contextIsolation: true,
-			disableBlinkFeatures: 'Auxclick'
+			disableBlinkFeatures: 'Auxclick' // Is this needed?
 		}
 	}, opt)
 
@@ -300,7 +305,7 @@ app.on('ready', e =>
 			webPreferences: {
 				preload: `${__dirname}/electron-preload.js`,
 				contextIsolation: true,
-				disableBlinkFeatures: 'Auxclick'
+				disableBlinkFeatures: 'Auxclick' // Is this needed?
 			}
 		});
 
@@ -687,6 +692,14 @@ app.on('ready', e =>
 
 	ipcMain.on('toggleSpellCheck', toggleSpellCheck);
 
+	function toggleStoreBkp()
+	{
+		enableStoreBkp = !enableStoreBkp;
+		store.set('enableStoreBkp', enableStoreBkp);
+	};
+
+	ipcMain.on('toggleStoreBkp', toggleStoreBkp);
+
     let updateNoAvailAdded = false;
 
 	function checkForUpdatesFn() 
@@ -880,6 +893,11 @@ app.on('web-contents-created', (event, contents) => {
 			return {action: 'deny'}
 		}
 	})
+
+	// Disable all webviews
+	contents.on('will-attach-webview', (event, webPreferences, params) => {
+		event.preventDefault()
+	})
 })
 
 autoUpdater.on('error', e => log.error('@error@\n', e))
@@ -1260,7 +1278,7 @@ function exportDiagram(event, args, directFinalize)
 				preload: `${__dirname}/electron-preload.js`,
 				backgroundThrottling: false,
 				contextIsolation: true,
-				disableBlinkFeatures: 'Auxclick'
+				disableBlinkFeatures: 'Auxclick' // Is this needed?
 			},
 			show : false,
 			frame: false,
@@ -1680,7 +1698,7 @@ async function saveFile(fileObject, data, origStat, overwrite, defEnc)
 
 	async function doSaveFile(isNew)
 	{
-		if (!isNew)
+		if (enableStoreBkp && !isNew)
 		{
 			//Copy file to backup file (after conflict and stat is checked)
 			let bkpFh;