Files
MagicMirror/js/loader.js
Karsten Hassel fb41d24ef5 Release 2.36.0 (#4127)
## Release Notes
Thanks to: @cgillinger, @khassel, @KristjanESPERANTO, @sonnyb9
> ⚠️ This release needs nodejs version >=22.21.1 <23 || >=24 (no change
to previous release)

[Compare to previous Release
v2.35.0](https://github.com/MagicMirrorOrg/MagicMirror/compare/v2.35.0...v2.36.0)

This release falls outside the quarterly schedule. We opted for an early
release due to:
- Security fix for the internal cors proxy
- API change of the weather provider smi
- Several bug fixes

### Breaking Changes

The cors proxy is now disabled by default. If required, it must be
explicitly enabled in the `config.js` file. See the
[documentation](https://docs.magicmirror.builders/configuration/cors.html).

### ⚠️ Security

You can find several publicly accessible MagicMirror² instances.

This should never be done. Doing so makes your entire configuration,
including secrets and API keys, publicly visible. Furthermore, it allows
attackers to target the host; this is only prevented beginning with this
release.

Public MagicMirror² instances should always run behind a reverse proxy
with authentication.

### [core]
- Prepare Release 2.36.0 (#4126)
- Allow HTTPFetcher to pass through 304 responses (#4120)
- fix(http-fetcher): fall back to reloadInterval after retries exhausted
(#4113)
- config endpoint must handle functions in module configs (#4106)
- fix replaceSecretPlaceholder (#4104)
- restrict replaceSecretPlaceholder to cors with allowWhitelist (#4102)
- fix: prevent crash when config is undefined in socket handler (#4096)
- fix cors function for alpine linux (#4091)
- fix(cors): prevent SSRF via DNS rebinding (#4090)
- add option to disable or restrict cors endpoint (#4087)
- fix: prevent SSRF via /cors endpoint by blocking private/reserved IPs
(#4084)
- chore: add permissions section to enforce pull-request rules workflow
(#4079)
- update version for develop

### [dependencies]
- update dependencies (#4124)
- chore: update dependencies (#4088)
- refactor: enable ESLint rule "no-unused-vars" and handle related
issues (#4080)

### [modules/newsfeed]
- fix(newsfeed): prevent duplicate parse error callback when using
pipeline (#4083)

### [modules/updatenotification]
- fix(updatenotification): harden git command execution + simplify
checkUpdates (#4115)
- fix(tests): correct import path for git_helper module in
updatenotification tests (#4078)

### [modules/weather]
- fix(weather): use nearest openmeteo hourly data (#4123)
- fix(weather): avoid loading state after reconnect (#4121)
- weather: fix UV index display and add WeatherFlow precipitation
(#4108)
- fix(weather): restore OpenWeatherMap v2.5 support (#4101)
- fix(weather): use stable instanceId to prevent duplicate fetchers
(#4092)
- SMHI: migrate to SNOW1gv1 API (replace deprecated PMP3gv2) (#4082)

### [testing]
- ci(actions): set explicit token permissions (#4114)
- fix(http_fetcher): use undici.fetch when dispatcher is present (#4097)
- ci(codeql): also scan develop branch on push and PR (#4086)
- refactor: replace implicit global config with explicit global.config
(#4085)

---------

Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: sam detweiler <sdetweil@gmail.com>
Co-authored-by: Kristjan ESPERANTO <35647502+KristjanESPERANTO@users.noreply.github.com>
Co-authored-by: Veeck <github@veeck.de>
Co-authored-by: veeck <gitkraken@veeck.de>
Co-authored-by: Magnus <34011212+MagMar94@users.noreply.github.com>
Co-authored-by: Ikko Eltociear Ashimine <eltociear@gmail.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
Co-authored-by: DevIncomin <56730075+Developer-Incoming@users.noreply.github.com>
Co-authored-by: Nathan <n8nyoung@gmail.com>
Co-authored-by: mixasgr <mixasgr@users.noreply.github.com>
Co-authored-by: Savvas Adamtziloglou <savvas-gr@greeklug.gr>
Co-authored-by: Konstantinos <geraki@gmail.com>
Co-authored-by: OWL4C <124401812+OWL4C@users.noreply.github.com>
Co-authored-by: BugHaver <43462320+bughaver@users.noreply.github.com>
Co-authored-by: BugHaver <43462320+lsaadeh@users.noreply.github.com>
Co-authored-by: Bugsounet - Cédric <github@bugsounet.fr>
Co-authored-by: Koen Konst <koenspero@gmail.com>
Co-authored-by: Koen Konst <c.h.konst@avisi.nl>
Co-authored-by: dathbe <github@beffa.us>
Co-authored-by: Marcel <m-idler@users.noreply.github.com>
Co-authored-by: Kevin G. <crazylegstoo@gmail.com>
Co-authored-by: Jboucly <33218155+jboucly@users.noreply.github.com>
Co-authored-by: Jboucly <contact@jboucly.fr>
Co-authored-by: Jarno <54169345+jarnoml@users.noreply.github.com>
Co-authored-by: Jordan Welch <JordanHWelch@gmail.com>
Co-authored-by: Blackspirits <blackspirits@gmail.com>
Co-authored-by: Samed Ozdemir <samed@xsor.io>
Co-authored-by: in-voker <58696565+in-voker@users.noreply.github.com>
Co-authored-by: Andrés Vanegas Jiménez <142350+angeldeejay@users.noreply.github.com>
Co-authored-by: cgillinger <christian.gillinger@gmail.com>
Co-authored-by: Sonny B <43247590+sonnyb9@users.noreply.github.com>
Co-authored-by: sonnyb9 <sonnyb9@users.noreply.github.com>
2026-04-30 22:49:25 +02:00

298 lines
8.6 KiB
JavaScript

/* global defaultModules, vendor */
// eslint-disable-next-line no-unused-vars
const Loader = (function () {
/* Create helper variables */
const loadedModuleFiles = [];
const loadedFiles = [];
const moduleObjects = [];
/* Private Methods */
/**
* Get environment variables from config.
* @returns {object} Env vars with modulesDir and customCss paths from config.
*/
const getEnvVarsFromConfig = function () {
return {
modulesDir: config.foreignModulesDir || "modules",
defaultModulesDir: config.defaultModulesDir || "defaultmodules",
customCss: config.customCss || "config/custom.css"
};
};
/**
* Retrieve object of env variables.
* @returns {object} with key: values as assembled in js/server_functions.js
*/
const getEnvVars = async function () {
// In test mode, skip server fetch and use config values directly
if (typeof process !== "undefined" && process.env && process.env.mmTestMode === "true") {
return getEnvVarsFromConfig();
}
// In production, fetch env vars from server
try {
const res = await fetch(new URL("env", `${location.origin}${config.basePath}`));
return JSON.parse(await res.text());
} catch (error) {
// Fallback to config values if server fetch fails
Log.error("Unable to retrieve env configuration", error);
return getEnvVarsFromConfig();
}
};
/**
* Loops through all modules and requests start for every module.
*/
const startModules = async function () {
const modulePromises = [];
for (const module of moduleObjects) {
try {
modulePromises.push(module.start());
} catch (error) {
Log.error(`Error when starting node_helper for module ${module.name}:`);
Log.error(error);
}
}
const results = await Promise.allSettled(modulePromises);
// Log errors that happened during async node_helper startup
results.forEach((result) => {
if (result.status === "rejected") {
Log.error(result.reason);
}
});
// Notify core of loaded modules.
MM.modulesStarted(moduleObjects);
// Starting modules also hides any modules that have requested to be initially hidden
for (const thisModule of moduleObjects) {
if (thisModule.data.hiddenOnStartup) {
Log.info(`Initially hiding ${thisModule.name}`);
thisModule.hide();
}
}
};
/**
* Retrieve list of all modules.
* @returns {object[]} module data as configured in config
*/
const getAllModules = function () {
const AllModules = config.modules.filter((module) => (module.module !== undefined) && (MM.getAvailableModulePositions.indexOf(module.position) > -1 || typeof (module.position) === "undefined"));
return AllModules;
};
/**
* Generate array with module information including module paths.
* @returns {object[]} Module information.
*/
const getModuleData = async function () {
const modules = getAllModules();
const moduleFiles = [];
const envVars = await getEnvVars();
modules.forEach(function (moduleData, index) {
const module = moduleData.module;
const elements = module.split("/");
const moduleName = elements[elements.length - 1];
let moduleFolder = `${envVars.modulesDir}/${module}`;
if (defaultModules.indexOf(moduleName) !== -1) {
const defaultModuleFolder = `${envVars.defaultModulesDir}/${module}`;
if (window.name !== "jsdom") {
moduleFolder = defaultModuleFolder;
} else {
// running in test mode, allow defaultModules placed under moduleDir for testing
if (envVars.modulesDir === "modules") {
moduleFolder = defaultModuleFolder;
}
}
}
if (moduleData.disabled === true) {
return;
}
moduleFiles.push({
index: index,
identifier: `module_${index}_${module}`,
name: moduleName,
path: `${moduleFolder}/`,
file: `${moduleName}.js`,
position: moduleData.position,
animateIn: moduleData.animateIn,
animateOut: moduleData.animateOut,
hiddenOnStartup: moduleData.hiddenOnStartup,
header: moduleData.header,
configDeepMerge: typeof moduleData.configDeepMerge === "boolean" ? moduleData.configDeepMerge : false,
config: moduleData.config,
classes: typeof moduleData.classes !== "undefined" ? `${moduleData.classes} ${module}` : module,
order: (typeof moduleData.order === "number" && Number.isInteger(moduleData.order)) ? moduleData.order : 0
});
});
return moduleFiles;
};
/**
* Load modules via ajax request and create module objects.
* @param {object} module Information about the module we want to load.
* @returns {Promise<void>} resolved when module is loaded
*/
const loadModule = async function (module) {
const url = module.path + module.file;
/**
* @returns {Promise<void>}
*/
const afterLoad = async function () {
const moduleObject = Module.create(module.name);
if (moduleObject) {
await bootstrapModule(module, moduleObject);
}
};
if (loadedModuleFiles.indexOf(url) !== -1) {
await afterLoad();
} else {
await loadFile(url);
loadedModuleFiles.push(url);
await afterLoad();
}
};
/**
* Bootstrap modules by setting the module data and loading the scripts & styles.
* @param {object} module Information about the module we want to load.
* @param {Module} mObj Modules instance.
*/
const bootstrapModule = async function (module, mObj) {
Log.info(`Bootstrapping module: ${module.name}`);
mObj.setData(module);
await mObj.loadScripts();
Log.log(`Scripts loaded for: ${module.name}`);
await mObj.loadStyles();
Log.log(`Styles loaded for: ${module.name}`);
await mObj.loadTranslations();
Log.log(`Translations loaded for: ${module.name}`);
moduleObjects.push(mObj);
};
/**
* Load a script or stylesheet by adding it to the dom.
* @param {string} fileName Path of the file we want to load.
* @returns {Promise} resolved when the file is loaded
*/
const loadFile = function (fileName) {
const extension = fileName.slice((Math.max(0, fileName.lastIndexOf(".")) || Infinity) + 1);
let script, stylesheet;
switch (extension.toLowerCase()) {
case "js":
return new Promise((resolve) => {
Log.log(`Load script: ${fileName}`);
script = document.createElement("script");
script.type = "text/javascript";
script.src = fileName;
script.onload = function () {
resolve();
};
script.onerror = function () {
Log.error("Error on loading script:", fileName);
script.remove();
resolve();
};
document.getElementsByTagName("body")[0].appendChild(script);
});
case "css":
return new Promise((resolve) => {
Log.log(`Load stylesheet: ${fileName}`);
stylesheet = document.createElement("link");
stylesheet.rel = "stylesheet";
stylesheet.type = "text/css";
stylesheet.href = fileName;
stylesheet.onload = function () {
resolve();
};
stylesheet.onerror = function () {
Log.error("Error on loading stylesheet:", fileName);
stylesheet.remove();
resolve();
};
document.getElementsByTagName("head")[0].appendChild(stylesheet);
});
}
};
/* Public Methods */
return {
/**
* Load all modules as defined in the config.
*/
async loadModules () {
const moduleData = await getModuleData();
const envVars = await getEnvVars();
const customCss = envVars.customCss;
// Load all modules
for (const module of moduleData) {
await loadModule(module);
}
// Load custom.css
// Since this happens after loading the modules,
// it overwrites the default styles.
await loadFile(customCss);
// Start all modules.
await startModules();
},
/**
* Load a file (script or stylesheet).
* Prevent double loading and search for files defined in js/vendor.js.
* @param {string} fileName Path of the file we want to load.
* @param {Module} module The module that calls the loadFile function.
* @returns {Promise} resolved when the file is loaded
*/
loadFileForModule (fileName, module) {
if (loadedFiles.indexOf(fileName.toLowerCase()) !== -1) {
Log.log(`File already loaded: ${fileName}`);
return Promise.resolve();
}
if (fileName.indexOf("http://") === 0 || fileName.indexOf("https://") === 0 || fileName.indexOf("/") !== -1) {
// This is an absolute or relative path.
// Load it and then return.
loadedFiles.push(fileName.toLowerCase());
return loadFile(fileName);
}
if (vendor[fileName] !== undefined) {
// This file is defined in js/vendor.js.
// Load it from its location.
loadedFiles.push(fileName.toLowerCase());
return loadFile(`${vendor[fileName]}`);
}
// File not loaded yet.
// Load it based on the module path.
loadedFiles.push(fileName.toLowerCase());
return loadFile(module.file(fileName));
}
};
}());