Skip to content

Commit 25afd8f

Browse files
JulianPrieberJulianPrieber
committed
Added options to disable custom code in themes
1 parent 9f8b865 commit 25afd8f

File tree

5 files changed

+19
-8
lines changed

5 files changed

+19
-8
lines changed

‎.env‎

Lines changed: 5 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -80,4 +80,8 @@ CUSTOM_META_TAGS=false
8080

8181
#=FORCE_HTTPS either true or false. Used to redirect any request to HTTPS.
8282
#=Note that this will only affect port 443 if you are using the docker image.
83-
FORCE_HTTPS=false
83+
FORCE_HTTPS=false
84+
85+
#=Defines wether or not themes are allowed to inject custom code.
86+
#=Themes V2 can now implement fully custom code which you might want to disable for security reasons.
87+
ALLOW_CUSTOM_CODE_IN_THEMES=true

‎resources/views/components/finishing.blade.php‎

Lines changed: 3 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -13,6 +13,9 @@
1313
if(EnvEditor::keyExists('MAINTENANCE_MODE')){ /* Do nothing if key already exists */
1414
} else {EnvEditor::addKey('MAINTENANCE_MODE', 'false');}
1515
16+
if(EnvEditor::keyExists('ALLOW_CUSTOM_CODE_IN_THEMES')){ /* Do nothing if key already exists */
17+
} else {EnvEditor::addKey('ALLOW_CUSTOM_CODE_IN_THEMES', 'true');}
18+
1619
if (!config()->has('advanced-config.expand_panel_admin_menu_permanently') and !config()->has('disable_default_password_notice')) {
1720
1821
function getStringBetween($string, $start, $end) {

‎resources/views/home.blade.php‎

Lines changed: 3 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -23,7 +23,7 @@ function themeAsset($path){
2323
return $path;}
2424
?>
2525

26-
@if(theme('enable_custom_code') == "true" and theme('enable_custom_head') == "true")@include($GLOBALS['themeName'] . '.extra.custom-head')@endif
26+
@if(theme('enable_custom_code') == "true" and theme('enable_custom_head') == "true" and env('ALLOW_CUSTOM_CODE_IN_THEMES') == 'true')@include($GLOBALS['themeName'] . '.extra.custom-head')@endif
2727

2828
@include('layouts.analytics')
2929

@@ -91,7 +91,7 @@ function themeAsset($path){
9191
</head>
9292
<body>
9393

94-
@if(theme('enable_custom_code') == "true" and theme('enable_custom_body') == "true")@include($GLOBALS['themeName'] . '.extra.custom-body')@endif
94+
@if(theme('enable_custom_code') == "true" and theme('enable_custom_body') == "true" and env('ALLOW_CUSTOM_CODE_IN_THEMES') == 'true')@include($GLOBALS['themeName'] . '.extra.custom-body')@endif
9595

9696
@if(config('advanced-config.home_theme') != '' and config('advanced-config.home_theme') != 'default')
9797
<!-- Enables parallax background animations -->
@@ -234,6 +234,6 @@ function themeAsset($path){
234234
</div>
235235
</body>
236236

237-
@if(theme('enable_custom_code') == "true" and theme('enable_custom_body_end') == "true")@include($GLOBALS['themeName'] . '.extra.custom-body-end')@endif
237+
@if(theme('enable_custom_code') == "true" and theme('enable_custom_body_end') == "true" and env('ALLOW_CUSTOM_CODE_IN_THEMES') == 'true')@include($GLOBALS['themeName'] . '.extra.custom-body-end')@endif
238238

239239
</html>

‎resources/views/littlelink.blade.php‎

Lines changed: 3 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -23,7 +23,7 @@ function themeAsset($path){
2323
return $path;}
2424
?>
2525

26-
@if(theme('enable_custom_code') == "true" and theme('enable_custom_head') == "true")@include($GLOBALS['themeName'] . '.extra.custom-head')@endif
26+
@if(theme('enable_custom_code') == "true" and theme('enable_custom_head') == "true" and env('ALLOW_CUSTOM_CODE_IN_THEMES') == 'true')@include($GLOBALS['themeName'] . '.extra.custom-head')@endif
2727

2828
@include('layouts.analytics')
2929

@@ -124,7 +124,7 @@ function themeAsset($path){
124124
</head>
125125
<body>
126126

127-
@if(theme('enable_custom_code') == "true" and theme('enable_custom_body') == "true")@include($GLOBALS['themeName'] . '.extra.custom-body')@endif
127+
@if(theme('enable_custom_code') == "true" and theme('enable_custom_body') == "true" and env('ALLOW_CUSTOM_CODE_IN_THEMES') == 'true')@include($GLOBALS['themeName'] . '.extra.custom-body')@endif
128128

129129
@if($info->theme != '' and $info->theme != 'default')
130130
<!-- Enables parallax background animations -->
@@ -294,7 +294,7 @@ function get_operating_system() {
294294
</div>
295295
</div>
296296

297-
@if(theme('enable_custom_code') == "true" and theme('enable_custom_body_end') == "true")@include($GLOBALS['themeName'] . '.extra.custom-body-end')@endif
297+
@if(theme('enable_custom_code') == "true" and theme('enable_custom_body_end') == "true" and env('ALLOW_CUSTOM_CODE_IN_THEMES') == 'true')@include($GLOBALS['themeName'] . '.extra.custom-body-end')@endif
298298

299299
</body>
300300
</html>

‎storage/backups/default_settings‎

Lines changed: 5 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -80,4 +80,8 @@ CUSTOM_META_TAGS=false
8080

8181
#=FORCE_HTTPS either true or false. Used to redirect any request to HTTPS.
8282
#=Note that this will only affect port 443 if you are using the docker image.
83-
FORCE_HTTPS=false
83+
FORCE_HTTPS=false
84+
85+
#=Defines wether or not themes are allowed to inject custom code.
86+
#=Themes V2 can now implement fully custom code which you might want to disable for security reasons.
87+
ALLOW_CUSTOM_CODE_IN_THEMES=true

0 commit comments

Comments
 (0)