Template widget - tutorial & examples - make your own widget!

@watou it’s a small library so I guess it’s a candidate for inclusion as built-in (like sprintf and others). :slight_smile:

However, I guess it’s time to “reveal” a potential ticking time bomb: loading scripts in templates & custom widgets is actually possible with the ocLazyLoad directive which is available.

So if you download https://github.com/yaru22/angular-timeago/blob/master/dist/angular-timeago.min.js to conf/html and try this:

<div oc-lazy-load="['/static/angular-timeago.min.js']">
  <p>The sun set <time-ago from-time="{{itemValue('Sunset_Time')}}"></time-ago></p>
</div>

It will give you, as expected:

For full disclosure, this makes the HABPanel version that shipped with openHAB 2.0 vulnerable to trivial XSS attacks so once again:

To all, make sure never to run HABPanel (or openHAB, for that matter) outside trusted local networks with no protection! Never publish it on the Internet without at least access control with a reverse proxy! Check http://docs.openhab.org/installation/security.html for details.

The loading of non-local scripts was disabled this week through the introduction of a Content Security Policy but the vulnerability remains, it’s just significantly less easy to exploit.

12 Likes