fix: events improvements #2630
fix: events improvements #2630
Conversation
remove enable from emit function which causes unnecessary dialogue open post message only for webln enabled pages, so that malicious pages doesn't listen to such events this also results in emitting the event only when we are on webln enabled page signed-off-by: pavan joshi <[email protected]>
| @@ -41,7 +40,7 @@ async function init() { | |||
| extractLightningData(); | |||
| } | |||
| // forward account changed messaged to inpage script | |||
| else if (request.action === "accountChanged") { | |||
| else if (request.action === "accountChanged" && isEnabled) { | |||
There was a problem hiding this comment.
The line below, can we replace "*"? we only want the inpage script to receive the message so it can emit the event for any listeners. Currently all frames on the website are receiving it.
There was a problem hiding this comment.
we can use window.location.origin here. which returns domain without any routes/ query parameters
@pavanjoshi914 please could you make this change too? |
send messaged only to the target origin signed-off-by: pavan joshi <[email protected]>
made those changes. |
Describe the changes you have made in this PR
remove enable from emit function which causes unnecessary dialogue open post message only for webln enabled pages, so that malicious pages doesn't listen to such events this also results in emitting the event only when we are on webln enabled page
Type of change
fix: Bug fix (non-breaking change which fixes an issue)Checklist