Merge pull request #76 from zendesk/mio/security_fix

miogalang · miogalang · commit e1801da3b8fd · 2015-06-22T13:38:21.000+08:00
[CE-875] Update magento widget script to use https instead of the relative convention
diff --git a/src/app/code/community/Zendesk/Zendesk/Model/Observer.php b/src/app/code/community/Zendesk/Zendesk/Model/Observer.php
@@ -105,7 +105,7 @@ public function saveConfig(Varien_Event_Observer $observer)
         if($zDomain && stripos($widgetSnippet, "'{$zDomain}'") === false && stripos($widgetSnippet, '"'.$zDomain.'"') === false) {
             $webWidgetSnippet=<<<EOJS
 <!-- Start of Zendesk Widget script -->
-<script>/*<![CDATA[*/window.zEmbed||function(e,t){var n,o,d,i,s,a=[],r=document.createElement("iframe");window.zEmbed=function(){a.push(arguments)},window.zE=window.zE||window.zEmbed,r.src="javascript:false",r.title="",r.role="presentation",(r.frameElement||r).style.cssText="display: none",d=document.getElementsByTagName("script"),d=d[d.length-1],d.parentNode.insertBefore(r,d),i=r.contentWindow,s=i.document;try{o=s}catch(c){n=document.domain,r.src='javascript:var d=document.open();d.domain="'+n+'";void(0);',o=s}o.open()._l=function(){var o=this.createElement("script");n&&(this.domain=n),o.id="js-iframe-async",o.src=e,this.t=+new Date,this.zendeskHost=t,this.zEQueue=a,this.body.appendChild(o)},o.write('<body onload="document._l();">'),o.close()}("//assets.zendesk.com/embeddable_framework/main.js","{$zDomain}");/*]]>*/</script>
+<script>/*<![CDATA[*/window.zEmbed||function(e,t){var n,o,d,i,s,a=[],r=document.createElement("iframe");window.zEmbed=function(){a.push(arguments)},window.zE=window.zE||window.zEmbed,r.src="javascript:false",r.title="",r.role="presentation",(r.frameElement||r).style.cssText="display: none",d=document.getElementsByTagName("script"),d=d[d.length-1],d.parentNode.insertBefore(r,d),i=r.contentWindow,s=i.document;try{o=s}catch(c){n=document.domain,r.src='javascript:var d=document.open();d.domain="'+n+'";void(0);',o=s}o.open()._l=function(){var o=this.createElement("script");n&&(this.domain=n),o.id="js-iframe-async",o.src=e,this.t=+new Date,this.zendeskHost=t,this.zEQueue=a,this.body.appendChild(o)},o.write('<body onload="document._l();">'),o.close()}("https://assets.zendesk.com/embeddable_framework/main.js","{$zDomain}");/*]]>*/</script>
 <!-- End of Zendesk Widget script -->
 EOJS;
 
diff --git a/src/app/code/community/Zendesk/Zendesk/data/zendesk_setup/data-upgrade-2.0.5-2.0.6.php b/src/app/code/community/Zendesk/Zendesk/data/zendesk_setup/data-upgrade-2.0.5-2.0.6.php
@@ -0,0 +1,39 @@
+<?php
+/**
+ * Copyright 2015 Zendesk
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *   http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+/**
+ * In this data upgrade we are going to update the web widget settings to use https instead of the current relative format.
+ */
+
+$config = new Mage_Core_Model_Config();
+
+// Retrieve the domain from the config settings
+$domain = Mage::getStoreConfig('zendesk/general/domain');
+
+if($domain) {
+    // We are activating the Web Widget by default
+    $config->saveConfig('zendesk/frontend_features/web_widget_code_active', 1);
+
+    // The Web Widget code snippet, using the account zendesk domain from settings
+    $webWidgetSnippet=<<<EOJS
+<!-- Start of Zendesk Widget script -->
+<script>/*<![CDATA[*/window.zEmbed||function(e,t){var n,o,d,i,s,a=[],r=document.createElement("iframe");window.zEmbed=function(){a.push(arguments)},window.zE=window.zE||window.zEmbed,r.src="javascript:false",r.title="",r.role="presentation",(r.frameElement||r).style.cssText="display: none",d=document.getElementsByTagName("script"),d=d[d.length-1],d.parentNode.insertBefore(r,d),i=r.contentWindow,s=i.document;try{o=s}catch(c){n=document.domain,r.src='javascript:var d=document.open();d.domain="'+n+'";void(0);',o=s}o.open()._l=function(){var o=this.createElement("script");n&&(this.domain=n),o.id="js-iframe-async",o.src=e,this.t=+new Date,this.zendeskHost=t,this.zEQueue=a,this.body.appendChild(o)},o.write('<body onload="document._l();">'),o.close()}("https://assets.zendesk.com/embeddable_framework/main.js","{$domain}");/*]]>*/</script>
+<!-- End of Zendesk Widget script -->
+EOJS;
+
+    $config->saveConfig('zendesk/frontend_features/web_widget_code_snippet', $webWidgetSnippet);
+}
