From e423683c4da2e29fc4e6158431408a23d57b0315 Mon Sep 17 00:00:00 2001
From: Tom Needham <tom@owncloud.com>
Date: Wed, 15 Aug 2018 13:22:39 +0100
Subject: [PATCH 1/4] WIP public preview

---
 appinfo/app.php     |  1 +
 js/editor.js        |  9 +++++++++
 js/public.js        | 36 ++++++++++++++++++++++++++++++++++++
 lib/Application.php | 18 ++++++++++++++++--
 4 files changed, 62 insertions(+), 2 deletions(-)
 create mode 100644 js/public.js

diff --git a/appinfo/app.php b/appinfo/app.php
index 5e0857f..87919ee 100644
--- a/appinfo/app.php
+++ b/appinfo/app.php
@@ -24,3 +24,4 @@
 	\OC::$server->getEventDispatcher(),
 	\OC::$server->getUserSession()
 );
+
diff --git a/js/editor.js b/js/editor.js
index bfdab9e..e4980cb 100644
--- a/js/editor.js
+++ b/js/editor.js
@@ -29,6 +29,15 @@
 		};
 	}
 
+	OCA.Drawio.LoadPublicFileHandler = function(eventHandler, downloadPath, editWindow) {
+		$.get( downloadPath, function( data ) {
+			editWindow.postMessage(JSON.stringify({
+				action: "load",
+				xml: data
+			}), "*");
+		});
+	};
+
 	OCA.Drawio.LoadEditorHandler = function(eventHandler, path, editWindow) {
 		// Handle the load event at the start of the page load
 		var loadMsg = OC.Notification.show(t(OCA.Drawio.AppName, "Loading diagram..."));
diff --git a/js/public.js b/js/public.js
new file mode 100644
index 0000000..db359d7
--- /dev/null
+++ b/js/public.js
@@ -0,0 +1,36 @@
+var eventHandler = function (evt) {
+	if (evt.data.length > 0) {
+		var payload = JSON.parse(evt.data);
+		if (payload.event === "init") {
+			OCA.Drawio.LoadPublicFileHandler(
+				eventHandler,
+				$('#downloadURL').val(),
+				$('#drawioEditor')[0].contentWindow);
+		}
+	}
+};
+window.addEventListener("message", eventHandler);
+
+$(document).ready(function(){
+	if ($('#isPublic').val()) {
+		// TODO this needs to be imported
+		var src = 'https://www.draw.io?embed=1&chrome=0&spin=1&stealth=1&proto=json';
+		var html ='<iframe ' +
+			'id="drawioEditor"' +
+			'width="100%"' +
+			'height="100%"' +
+			'align="top"' +
+			'frameborder="0"' +
+			'name="iframeEditor"' +
+			'allowfullscreen=""' +
+			'</iframe>';
+		$('#imgframe').html(html);
+		$('#drawioEditor').attr('src', src);
+		$("<style type='text/css'> img.publicpreview { display: none; } </style>").appendTo("head");
+		$('#drawioEditor').attr('height', $(window).height()*.65+'px');
+		$( window ).resize(function() {
+			$('#drawioEditor').attr('height', $(window).height()*.65+'px');
+		});
+	}
+
+});
diff --git a/lib/Application.php b/lib/Application.php
index 028063b..d6e3bd0 100644
--- a/lib/Application.php
+++ b/lib/Application.php
@@ -22,6 +22,7 @@
 
 namespace OCA\Drawio;
 
+use OC\Security\CSP\ContentSecurityPolicy;
 use OCP\AppFramework\App;
 use OCP\IRequest;
 use OCP\IUserSession;
@@ -39,11 +40,24 @@ public function __construct(
 
 		if ($userSession->isLoggedIn()) {
 			$dispatcher->addListener('OCA\Files::loadAdditionalScripts', function() {
-				Util::addScript(self::APPID, "files");
-				Util::addStyle(self::APPID, "files");
+				Util::addScript(self::APPID, 'files');
+				Util::addStyle(self::APPID, 'files');
 
 			});
 		}
+
+		$dispatcher->addListener(
+			'OCA\Files_Sharing::loadAdditionalScripts',
+			function() {
+				Util::addScript(self::APPID, 'public');
+				Util::addScript(self::APPID, 'editor');
+			}
+		);
+
+		$manager = \OC::$server->getContentSecurityPolicyManager();
+		$policy = new ContentSecurityPolicy();
+		$policy->addAllowedFrameDomain('https://www.draw.io');
+		$manager->addDefaultPolicy($policy);
 	}
 
 }
\ No newline at end of file

From 32e46eddbdb9a906e0bf37a00cfee69984fac217 Mon Sep 17 00:00:00 2001
From: Tom Needham <tom@owncloud.com>
Date: Wed, 15 Aug 2018 15:14:04 +0100
Subject: [PATCH 2/4] Drawio host is configurable

---
 README.md           | 12 ++++++++++++
 appinfo/app.php     |  3 ++-
 appinfo/routes.php  |  3 ++-
 js/public.js        |  1 -
 lib/Application.php | 21 ++++++++++++++++++---
 5 files changed, 34 insertions(+), 6 deletions(-)
 create mode 100644 README.md

diff --git a/README.md b/README.md
new file mode 100644
index 0000000..112382f
--- /dev/null
+++ b/README.md
@@ -0,0 +1,12 @@
+# Draw.io
+Create, edit and share drawio diagrams right within ownCloud!
+
+![Screenshot of drawio editor](screenshot.png?raw=true "Embedded drawio editor")
+
+Author: Tom Needham <tom@owncloud.com>
+
+### Configuration
+
+You can set the drawio hostname to use a self hosted instance using `occ`:  
+
+`occ config:app:set drawio host_url https://my.draw.io.host.com`
\ No newline at end of file
diff --git a/appinfo/app.php b/appinfo/app.php
index 87919ee..8098de1 100644
--- a/appinfo/app.php
+++ b/appinfo/app.php
@@ -22,6 +22,7 @@
 
 new \OCA\Drawio\Application(
 	\OC::$server->getEventDispatcher(),
-	\OC::$server->getUserSession()
+	\OC::$server->getUserSession(),
+	\OC::$server->getConfig()
 );
 
diff --git a/appinfo/routes.php b/appinfo/routes.php
index 6543b03..33ea797 100644
--- a/appinfo/routes.php
+++ b/appinfo/routes.php
@@ -22,7 +22,8 @@
 
 $app = new \OCA\Drawio\Application(
 	\OC::$server->getEventDispatcher(),
-	\OC::$server->getUserSession()
+	\OC::$server->getUserSession(),
+	\OC::$server->getConfig()
 );
 $app->registerRoutes(
 	$this, [
diff --git a/js/public.js b/js/public.js
index db359d7..3adc38d 100644
--- a/js/public.js
+++ b/js/public.js
@@ -13,7 +13,6 @@ window.addEventListener("message", eventHandler);
 
 $(document).ready(function(){
 	if ($('#isPublic').val()) {
-		// TODO this needs to be imported
 		var src = 'https://www.draw.io?embed=1&chrome=0&spin=1&stealth=1&proto=json';
 		var html ='<iframe ' +
 			'id="drawioEditor"' +
diff --git a/lib/Application.php b/lib/Application.php
index d6e3bd0..77f3247 100644
--- a/lib/Application.php
+++ b/lib/Application.php
@@ -24,7 +24,7 @@
 
 use OC\Security\CSP\ContentSecurityPolicy;
 use OCP\AppFramework\App;
-use OCP\IRequest;
+use OCP\IConfig;
 use OCP\IUserSession;
 use OCP\Util;
 use Symfony\Component\EventDispatcher\EventDispatcherInterface;
@@ -33,11 +33,17 @@ class Application extends App {
 
 	const APPID = 'drawio';
 
+	/** @var IConfig  */
+	protected $config;
+
 	public function __construct(
 		EventDispatcherInterface $dispatcher,
-		IUserSession $userSession) {
+		IUserSession $userSession,
+		IConfig $config) {
 		parent::__construct(self::APPID);
+		$this->config = $config;
 
+		// Add scripts for files app integration
 		if ($userSession->isLoggedIn()) {
 			$dispatcher->addListener('OCA\Files::loadAdditionalScripts', function() {
 				Util::addScript(self::APPID, 'files');
@@ -46,6 +52,7 @@ public function __construct(
 			});
 		}
 
+		// Add scripts for public preview
 		$dispatcher->addListener(
 			'OCA\Files_Sharing::loadAdditionalScripts',
 			function() {
@@ -56,8 +63,16 @@ function() {
 
 		$manager = \OC::$server->getContentSecurityPolicyManager();
 		$policy = new ContentSecurityPolicy();
-		$policy->addAllowedFrameDomain('https://www.draw.io');
+		$publicHost = 'https://www.draw.io';
+		$policy->addAllowedFrameDomain($publicHost);
+		if ($this->getDrawIoHost() !== $publicHost) {
+			$policy->addAllowedFrameDomain($this->getDrawIoHost());
+		}
 		$manager->addDefaultPolicy($policy);
 	}
 
+	public function getDrawIoHost() {
+		return $this->config->getAppValue(self::APPID, 'host_url', 'https://www.draw.io');
+	}
+
 }
\ No newline at end of file

From 35f777e6c9f0629e579e5b67184182f3b752f8e3 Mon Sep 17 00:00:00 2001
From: Tom Needham <tom@owncloud.com>
Date: Wed, 15 Aug 2018 15:18:03 +0100
Subject: [PATCH 3/4] use app config url in page controller

---
 lib/Controller/PageController.php | 12 ++----------
 1 file changed, 2 insertions(+), 10 deletions(-)

diff --git a/lib/Controller/PageController.php b/lib/Controller/PageController.php
index b6c5ae2..089a857 100644
--- a/lib/Controller/PageController.php
+++ b/lib/Controller/PageController.php
@@ -34,9 +34,6 @@
 
 class PageController extends Controller {
 
-	const SERVERURL = 'https://www.draw.io';
-	const THEME = 'minimal';
-
 	/** @var IRootFolder  */
 	protected $rootFolder;
 	/** @var IL10N  */
@@ -68,11 +65,6 @@ public function editor($fileid) {
 			'editor');
 		$csp = new ContentSecurityPolicy();
 		$csp->allowInlineScript(true);
-		$csp->addAllowedScriptDomain(self::SERVERURL);
-		$csp->addAllowedFrameDomain(self::SERVERURL);
-		$csp->addAllowedFrameDomain("blob:");
-		$csp->addAllowedChildSrcDomain(self::SERVERURL);
-		$csp->addAllowedChildSrcDomain("blob:");
 		$response->setContentSecurityPolicy($csp);
 		$UID = $this->userSession->getUser()->getUID();
 		$userFolder = $this->rootFolder->getUserFolder($UID);
@@ -96,12 +88,12 @@ public function editor($fileid) {
 			'stealth' => 1,
 			'spin' => 1,
 			'proto' => 'json',
-			'ui' => self::THEME
+			'ui' => 'minimal'
 		];
 		if (!$canEdit) {
 			$params['chrome'] = 0;
 		}
-		$dioString = self::SERVERURL . '?' . http_build_query($params);
+		$dioString = \OC::$server->query(Application::class)->getDrawIoHost() . '?' . http_build_query($params);
 		$response->setParams([
 			'path' => $filePath,
 			'dio_src_string' => $dioString,

From 58897fea58a6711fc0876b7f1e8ee2408b147b88 Mon Sep 17 00:00:00 2001
From: Tom Needham <tom@owncloud.com>
Date: Wed, 15 Aug 2018 15:22:24 +0100
Subject: [PATCH 4/4] Only enable public preview for drawio extensions

---
 js/public.js | 24 +++++++++++++++---------
 1 file changed, 15 insertions(+), 9 deletions(-)

diff --git a/js/public.js b/js/public.js
index 3adc38d..59479ef 100644
--- a/js/public.js
+++ b/js/public.js
@@ -1,18 +1,25 @@
 var eventHandler = function (evt) {
-	if (evt.data.length > 0) {
-		var payload = JSON.parse(evt.data);
-		if (payload.event === "init") {
-			OCA.Drawio.LoadPublicFileHandler(
-				eventHandler,
-				$('#downloadURL').val(),
-				$('#drawioEditor')[0].contentWindow);
+	// Only on public page
+	if ($('#isPublic').val()) {
+		if (evt.data.length > 0) {
+			var payload = JSON.parse(evt.data);
+			if (payload.event === "init") {
+				OCA.Drawio.LoadPublicFileHandler(
+					eventHandler,
+					$('#downloadURL').val(),
+					$('#drawioEditor')[0].contentWindow);
+			}
 		}
 	}
 };
 window.addEventListener("message", eventHandler);
 
 $(document).ready(function(){
-	if ($('#isPublic').val()) {
+	var mimes = [
+		'application/octet-stream',
+		'application/xml'
+	];
+	if ($('#isPublic').val() && mimes.indexOf($('#mimetype').val()) !== -1 && $('#filename').val().split('.').pop() === 'drawio') {
 		var src = 'https://www.draw.io?embed=1&chrome=0&spin=1&stealth=1&proto=json';
 		var html ='<iframe ' +
 			'id="drawioEditor"' +
@@ -31,5 +38,4 @@ $(document).ready(function(){
 			$('#drawioEditor').attr('height', $(window).height()*.65+'px');
 		});
 	}
-
 });