From 0de42bebaf6133d49a25617d28072d6a1fe7bdd3 Mon Sep 17 00:00:00 2001
From: Kijin Sung <kijin@kijinsung.com>
Date: Tue, 20 Jun 2023 16:43:44 +0900
Subject: [PATCH 1/4] Split frontend URL rewriting script into its own file
 loaded separately

---
 modules/board/board.view.php    |   6 +-
 modules/board/tpl/js/board.js   | 369 +++++++++++++++-----------------
 modules/board/tpl/js/rewrite.js |  20 ++
 3 files changed, 202 insertions(+), 193 deletions(-)
 create mode 100644 modules/board/tpl/js/rewrite.js

diff --git a/modules/board/board.view.php b/modules/board/board.view.php
index f811d7f44..7e27e6e08 100644
--- a/modules/board/board.view.php
+++ b/modules/board/board.view.php
@@ -105,7 +105,11 @@ class BoardView extends Board
 		 * load javascript, JS filters
 		 **/
 		Context::addJsFilter($this->module_path.'tpl/filter', 'input_password.xml');
-		Context::addJsFile($this->module_path.'tpl/js/board.js');
+		Context::loadFile([$this->module_path.'tpl/js/board.js', 'head']);
+		if (config('url.rewrite') > 1)
+		{
+			Context::loadFile([$this->module_path.'tpl/js/rewrite.js', 'body']);
+		}
 		Context::loadLang('./modules/document/lang');
 		Context::loadLang('./modules/comment/lang');
 
diff --git a/modules/board/tpl/js/board.js b/modules/board/tpl/js/board.js
index d97bb5c7c..3de896eee 100644
--- a/modules/board/tpl/js/board.js
+++ b/modules/board/tpl/js/board.js
@@ -1,192 +1,177 @@
-/**
- * @file   modules/board/js/board.js
- * @author NHN (developers@xpressengine.com)
- * @brief  board 모듈의 javascript
- **/
-
-/* complete tp insert document */
-function completeDocumentInserted(ret_obj)
-{
-	var error = ret_obj.error;
-	var message = ret_obj.message;
-	var mid = ret_obj.mid;
-	var document_srl = ret_obj.document_srl;
-	var category_srl = ret_obj.category_srl;
-
-	if (ret_obj.redirect_url) {
-		redirect(ret_obj.redirect_url);
-	} else {
-		var url;
-		if(!document_srl)
-		{
-			url = current_url.setQuery('mid',mid).setQuery('act','');
-		}
-		else
-		{
-			url = current_url.setQuery('mid',mid).setQuery('document_srl',document_srl).setQuery('act','');
-		}
-		if(category_srl) url = url.setQuery('category',category_srl);
-		redirect(url);
-	}
-}
-
-/* delete the document */
-function completeDeleteDocument(ret_obj)
-{
-	var error = ret_obj.error;
-	var message = ret_obj.message;
-	var mid = ret_obj.mid;
-	var page = ret_obj.page;
-
-	var url = current_url.setQuery('mid',mid).setQuery('act','').setQuery('document_srl','');
-	if(page) url = url.setQuery('page',page);
-	redirect(url);
-}
-
-/* document search */
-function completeSearch(ret_obj, response_tags, params, fo_obj)
-{
-	fo_obj.submit();
-}
-
-function completeVote(ret_obj)
-{
-	var error = ret_obj.error;
-	var message = ret_obj.message;
-	redirect(window.location.href);
-}
-
-// current page reload
-function completeReload(ret_obj)
-{
-	var error = ret_obj.error;
-	var message = ret_obj.message;
-	redirect(window.location.href);
-}
-
-/* complete to insert comment*/
-function completeInsertComment(ret_obj)
-{
-	var error = ret_obj.error;
-	var message = ret_obj.message;
-	var mid = ret_obj.mid;
-	var document_srl = ret_obj.document_srl;
-	var comment_srl = ret_obj.comment_srl;
-	if (ret_obj.redirect_url) {
-		redirect(ret_obj.redirect_url);
-	} else {
-		var url = current_url.setQuery('mid',mid).setQuery('document_srl',document_srl).setQuery('act','');
-		if (comment_srl) url = url.setQuery('comment_srl',comment_srl)+"#comment_"+comment_srl;
-		redirect(url);
-	}
-}
-
-/* delete the comment */
-function completeDeleteComment(ret_obj)
-{
-	var error = ret_obj.error;
-	var message = ret_obj.message;
-	var mid = ret_obj.mid;
-	var document_srl = ret_obj.document_srl;
-	var page = ret_obj.page;
-
-	if (ret_obj.redirect_url) {
-		redirect(ret_obj.redirect_url);
-	} else {
-		var url = current_url.setQuery('mid',mid).setQuery('document_srl',document_srl).setQuery('act','');
-		if (page) url = url.setQuery('page',page);
-		redirect(url);
-	}
-}
-
-/* delete the trackback */
-function completeDeleteTrackback(ret_obj)
-{
-	var error = ret_obj.error;
-	var message = ret_obj.message;
-	var mid = ret_obj.mid;
-	var document_srl = ret_obj.document_srl;
-	var page = ret_obj.page;
-
-	if (ret_obj.redirect_url) {
-		redirect(ret_obj.redirect_url);
-	} else {
-		var url = current_url.setQuery('mid',mid).setQuery('document_srl',document_srl).setQuery('act','');
-		if (page) url = url.setQuery('page',page);
-		redirect(url);
-	}
-}
-
-/* change category */
-function doChangeCategory()
-{
-	var category_srl = jQuery('#board_category option:selected').val();
-	location.href = decodeURI(current_url).setQuery('category',category_srl).setQuery('page', '');
-}
-
-/* scrap */
-function doScrap(document_srl)
-{
-	var params = [];
-	params.document_srl = document_srl;
-	jQuery.exec_json('member.procMemberScrapDocument', params);
-}
-
-
-jQuery(function($){
-	
-	/* remove comment_srl and unnecessary page number from short URL */
-	var match = location.pathname.match(/\/([a-zA-Z0-9_]+)\/([0-9]+)\/(comment|page)\/([0-9]+)$/);
-	if (match && match[1] === window.current_mid) {
-		var newpath = location.pathname.replace(/\/(comment|page)\/([0-9]+)$/, '');
-		if (location.hash && location.hash !== '#') {
-			newpath += location.hash;
-		}
-		if (history.replaceState) {
-			history.replaceState({
-				rx_replaced: true,
-				prev: location.pathname,
-			}, '', newpath);
-		}
-	}
-	
-	$(document.body).click(function(e){
-		var t = $(e.target), act, params = {};
-
-		if(t.parents('.layer_voted_member').length === 0 && !t.is('.layer_voted_member')){
-			$('.layer_voted_member').hide().remove();
-		}
-
-		if(!t.is('a[class^=voted_member_]')) return;
-
-		var srl = parseInt(t.attr('class').replace(/[^0-9]/g,''));
-		if(!srl) return;
-
-		if(t.hasClass('comment')){
-			act = 'comment.getCommentVotedMemberList';
-			params =
-			{'comment_srl':srl,'point':(t.hasClass('votedup')?1:-1)};
-		}else{
-			act = 'document.getDocumentVotedMemberList';
-			params =
-			{'document_srl':srl,'point':(t.hasClass('votedup')?1:-1)};
-		}
-
-		$.exec_json(act, params, function(data){
-			var l = data.voted_member_list;
-			var ul = [];
-
-			if(!l || l.length === 0) return;
-
-			$.each(l,function(){
-				ul.push(this.nick_name);
-			});
-
-			t.after($('<ul>')
-				.addClass('layer_voted_member')
-				.css({'position':'absolute','top':e.pageY+5,'left':e.pageX})
-				.append('<li>'+ul.join('</li><li>')+'</li>')
-			);
-		});
-	});
-});
+/**
+ * @file   modules/board/js/board.js
+ * @author NHN (developers@xpressengine.com)
+ * @brief  board 모듈의 javascript
+ **/
+
+/* complete tp insert document */
+function completeDocumentInserted(ret_obj)
+{
+	var error = ret_obj.error;
+	var message = ret_obj.message;
+	var mid = ret_obj.mid;
+	var document_srl = ret_obj.document_srl;
+	var category_srl = ret_obj.category_srl;
+
+	if (ret_obj.redirect_url) {
+		redirect(ret_obj.redirect_url);
+	} else {
+		var url;
+		if(!document_srl)
+		{
+			url = current_url.setQuery('mid',mid).setQuery('act','');
+		}
+		else
+		{
+			url = current_url.setQuery('mid',mid).setQuery('document_srl',document_srl).setQuery('act','');
+		}
+		if(category_srl) url = url.setQuery('category',category_srl);
+		redirect(url);
+	}
+}
+
+/* delete the document */
+function completeDeleteDocument(ret_obj)
+{
+	var error = ret_obj.error;
+	var message = ret_obj.message;
+	var mid = ret_obj.mid;
+	var page = ret_obj.page;
+
+	var url = current_url.setQuery('mid',mid).setQuery('act','').setQuery('document_srl','');
+	if(page) url = url.setQuery('page',page);
+	redirect(url);
+}
+
+/* document search */
+function completeSearch(ret_obj, response_tags, params, fo_obj)
+{
+	fo_obj.submit();
+}
+
+function completeVote(ret_obj)
+{
+	var error = ret_obj.error;
+	var message = ret_obj.message;
+	redirect(window.location.href);
+}
+
+// current page reload
+function completeReload(ret_obj)
+{
+	var error = ret_obj.error;
+	var message = ret_obj.message;
+	redirect(window.location.href);
+}
+
+/* complete to insert comment*/
+function completeInsertComment(ret_obj)
+{
+	var error = ret_obj.error;
+	var message = ret_obj.message;
+	var mid = ret_obj.mid;
+	var document_srl = ret_obj.document_srl;
+	var comment_srl = ret_obj.comment_srl;
+	if (ret_obj.redirect_url) {
+		redirect(ret_obj.redirect_url);
+	} else {
+		var url = current_url.setQuery('mid',mid).setQuery('document_srl',document_srl).setQuery('act','');
+		if (comment_srl) url = url.setQuery('comment_srl',comment_srl)+"#comment_"+comment_srl;
+		redirect(url);
+	}
+}
+
+/* delete the comment */
+function completeDeleteComment(ret_obj)
+{
+	var error = ret_obj.error;
+	var message = ret_obj.message;
+	var mid = ret_obj.mid;
+	var document_srl = ret_obj.document_srl;
+	var page = ret_obj.page;
+
+	if (ret_obj.redirect_url) {
+		redirect(ret_obj.redirect_url);
+	} else {
+		var url = current_url.setQuery('mid',mid).setQuery('document_srl',document_srl).setQuery('act','');
+		if (page) url = url.setQuery('page',page);
+		redirect(url);
+	}
+}
+
+/* delete the trackback */
+function completeDeleteTrackback(ret_obj)
+{
+	var error = ret_obj.error;
+	var message = ret_obj.message;
+	var mid = ret_obj.mid;
+	var document_srl = ret_obj.document_srl;
+	var page = ret_obj.page;
+
+	if (ret_obj.redirect_url) {
+		redirect(ret_obj.redirect_url);
+	} else {
+		var url = current_url.setQuery('mid',mid).setQuery('document_srl',document_srl).setQuery('act','');
+		if (page) url = url.setQuery('page',page);
+		redirect(url);
+	}
+}
+
+/* change category */
+function doChangeCategory()
+{
+	var category_srl = jQuery('#board_category option:selected').val();
+	location.href = decodeURI(current_url).setQuery('category',category_srl).setQuery('page', '');
+}
+
+/* scrap */
+function doScrap(document_srl)
+{
+	var params = [];
+	params.document_srl = document_srl;
+	jQuery.exec_json('member.procMemberScrapDocument', params);
+}
+
+
+jQuery(function($){
+
+	$(document.body).click(function(e){
+		var t = $(e.target), act, params = {};
+
+		if(t.parents('.layer_voted_member').length === 0 && !t.is('.layer_voted_member')){
+			$('.layer_voted_member').hide().remove();
+		}
+
+		if(!t.is('a[class^=voted_member_]')) return;
+
+		var srl = parseInt(t.attr('class').replace(/[^0-9]/g,''));
+		if(!srl) return;
+
+		if(t.hasClass('comment')){
+			act = 'comment.getCommentVotedMemberList';
+			params =
+			{'comment_srl':srl,'point':(t.hasClass('votedup')?1:-1)};
+		}else{
+			act = 'document.getDocumentVotedMemberList';
+			params =
+			{'document_srl':srl,'point':(t.hasClass('votedup')?1:-1)};
+		}
+
+		$.exec_json(act, params, function(data){
+			var l = data.voted_member_list;
+			var ul = [];
+
+			if(!l || l.length === 0) return;
+
+			$.each(l,function(){
+				ul.push(this.nick_name);
+			});
+
+			t.after($('<ul>')
+				.addClass('layer_voted_member')
+				.css({'position':'absolute','top':e.pageY+5,'left':e.pageX})
+				.append('<li>'+ul.join('</li><li>')+'</li>')
+			);
+		});
+	});
+});
diff --git a/modules/board/tpl/js/rewrite.js b/modules/board/tpl/js/rewrite.js
new file mode 100644
index 000000000..2224e04df
--- /dev/null
+++ b/modules/board/tpl/js/rewrite.js
@@ -0,0 +1,20 @@
+'use strict';
+
+/**
+ * Remove comment_srl and unnecessary page number from short URL
+ */
+(function() {
+	var match = location.pathname.match(/\/([a-zA-Z0-9_]+)\/([0-9]+)\/(comment|page)\/([0-9]+)$/);
+	if (match && match[1] === window.current_mid) {
+		var newpath = location.pathname.replace(/\/(comment|page)\/([0-9]+)$/, '');
+		if (location.hash && location.hash !== '#') {
+			newpath += location.hash;
+		}
+		if (history.replaceState) {
+			history.replaceState({
+				rx_replaced: true,
+				prev: location.pathname,
+			}, '', newpath);
+		}
+	}
+})();

From be6cc58311bf51608d8841e5bbd6cf0f7b1d76ea Mon Sep 17 00:00:00 2001
From: Kijin Sung <kijin@kijinsung.com>
Date: Tue, 20 Jun 2023 17:03:34 +0900
Subject: [PATCH 2/4] Remove <html>, <head>, <body> tags from header and footer
 scripts

---
 .../controllers/systemconfig/Domains.php      |  5 +++--
 modules/admin/models/Utility.php              | 19 +++++++++++++++++++
 2 files changed, 22 insertions(+), 2 deletions(-)
 create mode 100644 modules/admin/models/Utility.php

diff --git a/modules/admin/controllers/systemconfig/Domains.php b/modules/admin/controllers/systemconfig/Domains.php
index eb1ca2259..34bf3456e 100644
--- a/modules/admin/controllers/systemconfig/Domains.php
+++ b/modules/admin/controllers/systemconfig/Domains.php
@@ -14,6 +14,7 @@ use Rhymix\Framework\Storage;
 use Rhymix\Framework\URL;
 use Rhymix\Modules\Admin\Controllers\Base;
 use Rhymix\Modules\Admin\Models\Icon as IconModel;
+use Rhymix\Modules\Admin\Models\Utility as UtilityModel;
 
 class Domains extends Base
 {
@@ -340,8 +341,8 @@ class Domains extends Base
 		$vars->meta_description = utf8_trim($vars->meta_description);
 
 		// Clean up the header and footer scripts.
-		$vars->html_header = utf8_trim($vars->html_header);
-		$vars->html_footer = utf8_trim($vars->html_footer);
+		$vars->html_header = UtilityModel::cleanHeaderAndFooterScripts($vars->html_header ?? '');
+		$vars->html_footer = UtilityModel::cleanHeaderAndFooterScripts($vars->html_footer ?? '');
 
 		// Validate the color scheme setting.
 		$valid_color_scheme_options = array('auto', 'light', 'dark');
diff --git a/modules/admin/models/Utility.php b/modules/admin/models/Utility.php
new file mode 100644
index 000000000..d0c8edd56
--- /dev/null
+++ b/modules/admin/models/Utility.php
@@ -0,0 +1,19 @@
+<?php
+
+namespace Rhymix\Modules\Admin\Models;
+
+class Utility
+{
+	/**
+	 * Clean up header and footer scripts.
+	 *
+	 * @param string $content
+	 * @return string
+	 */
+	public static function cleanHeaderAndFooterScripts(string $content)
+	{
+		$content = utf8_clean($content);
+		$content = preg_replace('!</?(html|head|body)[^>]*>!', '', $content);
+		return utf8_trim($content);
+	}
+}

From b521c07721e63e0aa8b01709370dd646a49c639e Mon Sep 17 00:00:00 2001
From: Kijin Sung <kijin@kijinsung.com>
Date: Tue, 20 Jun 2023 17:06:37 +0900
Subject: [PATCH 3/4] Also remove unnecessary tags from layout header script

---
 modules/layout/layout.admin.controller.php | 3 ++-
 1 file changed, 2 insertions(+), 1 deletion(-)

diff --git a/modules/layout/layout.admin.controller.php b/modules/layout/layout.admin.controller.php
index 58df55250..dd086d079 100644
--- a/modules/layout/layout.admin.controller.php
+++ b/modules/layout/layout.admin.controller.php
@@ -175,7 +175,8 @@ class layoutAdminController extends layout
 		$oModuleModel = getModel('module');
 		$oModuleController = getController('module');
 		$layout_config = new stdClass();
-		$layout_config->header_script = Context::get('header_script');
+		$layout_config->header_script = Context::get('header_script') ?? '';
+		$layout_config->header_script = Rhymix\Modules\Admin\Models\Utility::cleanHeaderAndFooterScripts($layout_config->header_script);
 		$oModuleController->insertModulePartConfig('layout',$args->layout_srl,$layout_config);
 		// Save a title of the menu
 		$extra_vars->menu_name_list = $menu_name_list;

From 6df47d69946384887ceb5cd8952fc766910623fd Mon Sep 17 00:00:00 2001
From: Kijin Sung <kijin@kijinsung.com>
Date: Tue, 20 Jun 2023 17:08:30 +0900
Subject: [PATCH 4/4] Also remove unnecessary tags from board header and footer
 scripts

---
 modules/board/board.admin.controller.php | 2 ++
 1 file changed, 2 insertions(+)

diff --git a/modules/board/board.admin.controller.php b/modules/board/board.admin.controller.php
index dcd5e69e8..d5fac230a 100644
--- a/modules/board/board.admin.controller.php
+++ b/modules/board/board.admin.controller.php
@@ -85,6 +85,8 @@ class BoardAdminController extends Board {
 		$args->browser_title = trim(utf8_normalize_spaces($args->browser_title));
 		$args->meta_keywords = $args->meta_keywords ? implode(', ', array_map('trim', explode(',', $args->meta_keywords))) : '';
 		$args->meta_description = trim(utf8_normalize_spaces($args->meta_description));
+		$args->header_text = Rhymix\Modules\Admin\Models\Utility::cleanHeaderAndFooterScripts($args->header_text ?? '');
+		$args->footer_text = Rhymix\Modules\Admin\Models\Utility::cleanHeaderAndFooterScripts($args->footer_text ?? '');
 
 		// if there is an existed module
 		if ($args->module_srl && $module_info->module_srl != $args->module_srl)