feat: v5.3.1

surmon-china · surmon-china · commit bef354c5c413 · 2025-07-16T22:41:38.000+08:00
diff --git a/package.json b/package.json
@@ -1,6 +1,6 @@
 {
   "name": "nodepress",
-  "version": "5.3.0",
+  "version": "5.3.1",
   "description": "RESTful API service for Surmon.me blog",
   "author": "Surmon",
   "license": "MIT",
diff --git a/src/modules/disqus/disqus.constant.ts b/src/modules/disqus/disqus.constant.ts
@@ -10,7 +10,7 @@ import { GUESTBOOK_POST_ID } from '@app/constants/biz.constant'
 
 export const DISQUS_OAUTH_CALLBACK_URL = isProdEnv
   ? `${APP_BIZ.URL}/disqus/oauth-callback`
-  : `http://localhost:8000/disqus/oauth-callback`
+  : `http://localhost:${APP_BIZ.PORT}/disqus/oauth-callback`
 
 // extends
 export const COMMENT_POST_ID_EXTEND_KEY = 'disqus-post-id'
diff --git a/src/modules/disqus/disqus.controller.ts b/src/modules/disqus/disqus.controller.ts
@@ -41,6 +41,11 @@ export class DisqusController {
     }
   }
 
+  @Get('close-window.js')
+  closeWindowScript(@Response() response: FastifyReply) {
+    response.type('application/javascript').send('window.close();')
+  }
+
   @Get('oauth-callback')
   async oauthCallback(@Query() query: CallbackCodeDTO, @Response() response: FastifyReply) {
     const accessToken = await this.disqusPublicService.getAccessToken(query.code)
@@ -57,9 +62,10 @@ export class DisqusController {
       secure: 'auto'
     })
     // Close the popup window
-    response.header('content-security-policy', "script-src 'unsafe-inline'")
     response.header('content-type', 'text/html')
-    response.send(`<script>window.close();</script>`)
+    response.send(`<!DOCTYPE html><html><script src="/disqus/close-window.js"></script></html>`)
+    // To maintain a secure `content-security-policy`, inline JavaScript is not used here.
+    // response.send(`<script>window.close();</script>`)
   }
 
   @Post('oauth-logout')

Original file line number	Diff line number	Diff line change
`@@ -1,6 +1,6 @@`
`1`	`1`	`{`
`2`	`2`	`"name": "nodepress",`
`3`		`- "version": "5.3.0",`
	`3`	`+ "version": "5.3.1",`
`4`	`4`	`"description": "RESTful API service for Surmon.me blog",`
`5`	`5`	`"author": "Surmon",`
`6`	`6`	`"license": "MIT",`