@watou it’s a small library so I guess it’s a candidate for inclusion as built-in (like sprintf
and others).
However, I guess it’s time to “reveal” a potential ticking time bomb: loading scripts in templates & custom widgets is actually possible with the ocLazyLoad directive which is available.
So if you download https://github.com/yaru22/angular-timeago/blob/master/dist/angular-timeago.min.js to conf/html
and try this:
<div oc-lazy-load="['/static/angular-timeago.min.js']">
<p>The sun set <time-ago from-time="{{itemValue('Sunset_Time')}}"></time-ago></p>
</div>
It will give you, as expected:
For full disclosure, this makes the HABPanel version that shipped with openHAB 2.0 vulnerable to trivial XSS attacks so once again:
To all, make sure never to run HABPanel (or openHAB, for that matter) outside trusted local networks with no protection! Never publish it on the Internet without at least access control with a reverse proxy! Check http://docs.openhab.org/installation/security.html for details.
The loading of non-local scripts was disabled this week through the introduction of a Content Security Policy but the vulnerability remains, it’s just significantly less easy to exploit.