Merge branch 'release/v0.7.8' into master

.github/workflows/ci_tests.yml

@@ -1,14 +1,16 @@
 name: CI Tests
 
 on:
-    push:
+    workflow_run:
+        workflows: ['CodeQL']
         branches:
             - '**'
-            - '!master' # do not run on master
         tags-ignore:
             - '*'
         paths-ignore:
             - '**.md' # ignore changes to markdown files
+        types:
+            - completed
 
 jobs:
     test:

.github/workflows/codeql-analysis.yml

@@ -0,0 +1,71 @@
+# For most projects, this workflow file will not need changing; you simply need
+# to commit it to your repository.
+#
+# You may wish to alter this file to override the set of languages analyzed,
+# or to provide custom queries or build logic.
+name: 'CodeQL'
+
+on:
+    push:
+        branches:
+            - '**'
+        tags-ignore:
+            - '*'
+        paths-ignore:
+            - '**.md' # ignore changes to markdown files
+
+jobs:
+    analyze:
+        name: Analyze
+        runs-on: ubuntu-latest
+
+        strategy:
+            fail-fast: false
+            matrix:
+                # Override automatic language detection by changing the below list
+                # Supported options are ['csharp', 'cpp', 'go', 'java', 'javascript', 'python']
+                language: ['javascript']
+                # Learn more...
+                # https://docs.github.com/en/github/finding-security-vulnerabilities-and-errors-in-your-code/configuring-code-scanning#overriding-automatic-language-detection
+
+        steps:
+            - name: Checkout repository
+              uses: actions/checkout@v2
+              with:
+                  # We must fetch at least the immediate parents so that if this is
+                  # a pull request then we can checkout the head.
+                  fetch-depth: 2
+
+            # If this run was triggered by a pull request event, then checkout
+            # the head of the pull request instead of the merge commit.
+            - run: git checkout HEAD^2
+              if: ${{ github.event_name == 'pull_request' }}
+
+            # Initializes the CodeQL tools for scanning.
+            - name: Initialize CodeQL
+              uses: github/codeql-action/init@v1
+              with:
+                  languages: ${{ matrix.language }}
+                  # If you wish to specify custom queries, you can do so here or in a config file.
+                  # By default, queries listed here will override any specified in a config file.
+                  # Prefix the list here with "+" to use these queries and those in the config file.
+                  # queries: ./path/to/local/query, your-org/your-repo/queries@main
+
+            # Autobuild attempts to build any compiled languages  (C/C++, C#, or Java).
+            # If this step fails, then you should remove it and run the build manually (see below)
+            - name: Autobuild
+              uses: github/codeql-action/autobuild@v1
+
+            # ℹ️ Command-line programs to run using the OS shell.
+            # 📚 https://git.io/JvXDl
+
+            # ✏️ If the Autobuild fails above, remove it and uncomment the following three lines
+            #    and modify them (or add more) to build your code if your project
+            #    uses a compiled language
+
+            #- run: |
+            #   make bootstrap
+            #   make release
+
+            - name: Perform CodeQL Analysis
+              uses: github/codeql-action/analyze@v1

.github/workflows/deployment.yml

@@ -1,9 +1,11 @@
 name: Deployment
 
 on:
-    push:
-        branches:
-            - master # generally, only deploy if we are on 'master'
+    workflow_run:
+        workflows: ['CI Tests']
+        branches: [master] # generally, only deploy on 'master'
+        types:
+            - completed
 
 jobs:
     build:

CHANGELOG.md

@@ -2,6 +2,12 @@
 
 All notable changes to this project will be documented in this file. See [standard-version](https://github.com/conventional-changelog/standard-version) for commit guidelines.
 
+### [0.7.8](https://github.com/webern-unibas-ch/awg-app/compare/v0.7.7...v0.7.8) (2020-10-13)
+
+### Bug Fixes
+
+-   **core:** make postmessaging in GndService more restrict ([69120b6](https://github.com/webern-unibas-ch/awg-app/commit/69120b674d4718dc439b6a7923c8a0df11182e7d))
+
 ### [0.7.7](https://github.com/webern-unibas-ch/awg-app/compare/v0.7.6...v0.7.7) (2020-10-09)
 
 ### Bug Fixes

package.json

@@ -1,6 +1,6 @@
 {
     "name": "awg-app",
-    "version": "0.7.7",
+    "version": "0.7.8",
     "license": "MIT",
     "author": {
         "name": "Stefan Münnich",

src/app/app.globals.ts

@@ -1,15 +1,15 @@
 // THIS IS AN AUTO-GENERATED FILE. DO NOT CHANGE IT MANUALLY!
-// Generated last time on Fri Oct  9 14:23:30 CEST 2020
+// Generated last time on Tue Oct 13 15:32:01 CEST 2020
 
 /**
  * The latest version of the AWG App
  */
-export const appVersion = '0.7.7';
+export const appVersion = '0.7.8';
 
 /**
  * The release date of the latest version of the AWG App
  */
-export const appVersionReleaseDate = '09. Oktober 2020';
+export const appVersionReleaseDate = '13. Oktober 2020';
 
 /**
  * The URL of the AWG App

src/app/core/services/gnd-service/gnd.service.ts

@@ -161,10 +161,27 @@ export class GndService extends StorageService {
      * @return {void} Sends the postMessage to the parent window.
      */
     private exposeGndMessageToParent(value: string): void {
-        const parentTargets = [AppConfig.LOCALHOST_URL, AppConfig.INSERI_TEST_URL];
-
-        for (const target of parentTargets) {
-            window.parent.window.postMessage({ gnd: value }, target);
+        const localTarget = AppConfig.LOCALHOST_URL;
+        const nieTarget = AppConfig.INSERI_TEST_URL;
+        const parentTargets = [localTarget, nieTarget];
+        const LOCAL_DOMAINS = ['localhost', '127.0.0.1', ''];
+
+        if (window.location !== window.parent.location || window.self !== window.top) {
+            /*
+             * the page is running in an iFrame,
+             * posting will be only allowed to localhost (develop) or NIE-INE (production)
+             */
+            for (const target of parentTargets) {
+                window.parent.window.postMessage({ gnd: value }, target);
+            }
+        } else {
+            /*
+             * the page is not running in an iFrame,
+             * posting will be only allowed from and to localhost
+             */
+            if (LOCAL_DOMAINS.includes(window.location.hostname)) {
+                window.postMessage({ gnd: value }, localTarget);
+            }
         }
     }