mirrors/jellyfin-web
1
0
Fork 0
mirror of https://github.com/jellyfin/jellyfin-web synced 2025-03-30 19:56:21 +00:00
Code Activity

Merge pull request #5694 from thornbill/pdfjs-patch

Browse source
This commit is contained in:
Bill Thornton 2024-06-10 12:12:45 -04:00 • committed by GitHub
commit 4bb0c67340
No known key found for this signature in database
GPG key ID: B5690EEEBB952194
1 changed files with 6 additions and 1 deletions
Download patch file Download diff file Expand all files Collapse all files

7
src/plugins/pdfPlayer/plugin.js
View file

@ -207,7 +207,12 @@ export class PdfPlayer {
this.bindEvents();
GlobalWorkerOptions.workerSrc = appRouter.baseUrl() + '/libraries/pdf.worker.js';
const downloadTask = getDocument(downloadHref);
const downloadTask = getDocument({
url: downloadHref,
// Disable for PDF.js XSS vulnerability
// https://github.com/mozilla/pdf.js/security/advisories/GHSA-wgrm-67xf-hhpq
isEvalSupported: false
});
return downloadTask.promise.then(book => {
if (this.cancellationToken) return;
this.book = book;