From a9d0d3b0a7de59034a9827830c9dde858af42b42 Mon Sep 17 00:00:00 2001
From: Lynn <lynn@symphony.com>
Date: Thu, 25 May 2017 09:48:40 -0700
Subject: [PATCH] fix opening A tag (#105)

* fix opening A tag

* remove console.log
---
 js/preload/preloadMain.js | 21 +++++++++++++++++
 js/windowMgr.js           | 49 +++++++++++++++++++++++++--------------
 2 files changed, 53 insertions(+), 17 deletions(-)

diff --git a/js/preload/preloadMain.js b/js/preload/preloadMain.js
index 0f78d090..e4f33777 100644
--- a/js/preload/preloadMain.js
+++ b/js/preload/preloadMain.js
@@ -19,6 +19,8 @@ const apiCmds = apiEnums.cmds;
 const apiName = apiEnums.apiName;
 const getMediaSources = require('../desktopCapturer/getSources');
 
+const nodeURL = require('url');
+
 // hold ref so doesn't get GC'ed
 const local = {
     ipcRenderer: ipcRenderer
@@ -43,6 +45,25 @@ function createAPI() {
         return;
     }
 
+    // bug in electron is preventing using event 'will-navigate' from working
+    // in sandboxed environment. https://github.com/electron/electron/issues/8841
+    // so in the mean time using this code below to block clicking on A tags.
+    // A tags are allowed if they include href='_blank', this cause 'new-window'
+    // event to be received which is handled properly in windowMgr.js
+    window.addEventListener('beforeunload', function(event) {
+        var newUrl = document.activeElement && document.activeElement.href;
+        if (newUrl) {
+            var currHostName = window.location.hostname;
+            var parsedNewUrl = nodeURL.parse(newUrl);
+            var parsedNewUrlHostName = parsedNewUrl && parsedNewUrl.hostname;
+            if (currHostName !== parsedNewUrlHostName) {
+                /* eslint-disable no-param-reassign */
+                event.returnValue = 'false';
+                /* eslint-enable no-param-reassign */
+            }
+        }
+    });
+
     // note: window.open from main window (if in the same domain) will get
     // api access.  window.open in another domain will be opened in the default
     // browser (see: handler for event 'new-window' in windowMgr.js)
diff --git a/js/windowMgr.js b/js/windowMgr.js
index 8406d421..4863cc56 100644
--- a/js/windowMgr.js
+++ b/js/windowMgr.js
@@ -178,7 +178,14 @@ function doCreateMainWindow(initialUrl, initialBounds) {
 
     mainWindow.on('closed', destroyAllWindows);
 
-    // open external links in default browser - a tag, window.open
+    // bug in electron is preventing this from working in sandboxed evt...
+    // https://github.com/electron/electron/issues/8841
+    mainWindow.webContents.on('will-navigate', function(event, willNavUrl) {
+        event.preventDefault();
+        openUrlInDefaultBrower(willNavUrl);
+    });
+
+    // open external links in default browser - a tag with href='_blank' or window.open
     mainWindow.webContents.on('new-window', function (event, newWinUrl,
                                                       frameName, disposition, newWinOptions) {
         let newWinParsedUrl = getParsedUrl(newWinUrl);
@@ -187,12 +194,9 @@ function doCreateMainWindow(initialUrl, initialBounds) {
         let newWinHost = newWinParsedUrl && newWinParsedUrl.host;
         let mainWinHost = mainWinParsedUrl && mainWinParsedUrl.host;
 
-        // if host url doesn't match then open in external browser
-        if (newWinHost !== mainWinHost) {
-            event.preventDefault();
-            electron.shell.openExternal(newWinUrl);
-        } else if (disposition === 'foreground-tab' ||
-            disposition === 'new-window') {
+        // only allow window.open to succeed is if coming from same hsot,
+        // otherwise open in default browser.
+        if (disposition === 'new-window' && newWinHost === mainWinHost) {
             // handle: window.open
 
             if (!frameName) {
@@ -266,6 +270,9 @@ function doCreateMainWindow(initialUrl, initialBounds) {
                     browserWin.on('resize', throttledBoundsChange);
                 }
             });
+        } else {
+            event.preventDefault();
+            openUrlInDefaultBrower(newWinUrl)
         }
     });
 
@@ -289,17 +296,19 @@ function getMainWindow() {
 }
 
 function getWindowSizeAndPosition(window) {
-    let newPos = window.getPosition();
-    let newSize = window.getSize();
+    if (window) {
+        let newPos = window.getPosition();
+        let newSize = window.getSize();
 
-    if (newPos && newPos.length === 2 &&
-        newSize && newSize.length === 2) {
-        return {
-            x: newPos[0],
-            y: newPos[1],
-            width: newSize[0],
-            height: newSize[1],
-        };
+        if (newPos && newPos.length === 2 &&
+            newSize && newSize.length === 2) {
+            return {
+                x: newPos[0],
+                y: newPos[1],
+                width: newSize[0],
+                height: newSize[1],
+            };
+        }
     }
 
     return null;
@@ -369,6 +378,12 @@ function sendChildWinBoundsChange(window) {
     }
 }
 
+function openUrlInDefaultBrower(urlToOpen) {
+    if (urlToOpen) {
+        electron.shell.openExternal(urlToOpen);
+    }
+}
+
 module.exports = {
     createMainWindow: createMainWindow,
     getMainWindow: getMainWindow,