Merge pull request #315 from hypermodules/electron3

Electron3 + CSP
hypermodules · Aug 7, 2018 · a4334b2 · a4334b2
2 parents f1fdc11 + f820e59
commit a4334b2
Show file tree

Hide file tree

Showing 9 changed files with 52 additions and 27 deletions.
diff --git a/CHANGELOG.md b/CHANGELOG.md
@@ -2,6 +2,21 @@
 All notable changes to this project will be documented in this file.
 This project adheres to [Semantic Versioning](http://semver.org/).
 
+## 0.6.1 - 2018-08-02
+- Upgrade to electron 3
+- Add CSP to harden electron environment
+
+## 0.6.0 - 2018-08-02
+- Pause playback when entering sleep https://github.com/hypermodules/hyperamp/pull/314
+- add always-on-top view menu item https://github.com/hypermodules/hyperamp/pull/313
+- update deps
+  - "electron-context-menu": "^0.10.0",
+  - "electron-updater": "3.0.3",
+  - "music-metadata": "^2.4.2",
+  - "through2-filter": "^3.0.0",
+  - "electron": "2.0.6",
+  - "electron-builder": "20.26.1",
+
 ## 0.5.15 - 2018-05-22
 * Update deps
   * "electron": "2.0.2",

diff --git a/main/index.js b/main/index.js
@@ -50,8 +50,14 @@ var al = new AudioLibrary(libraryPersist.store)
 module.exports = state
 module.exports.al = al
 
-var shouldQuit = app.makeSingleInstance(function (commandLine, workingDirectory) {
-  // https://github.com/electron/electron/blob/v0.36.10/docs/api/app.md#appmakesingleinstancecallback
+const gotTheLock = app.requestSingleInstanceLock()
+
+if (!gotTheLock) {
+  app.quit()
+}
+
+app.on('second-instance', (commandLine, workingDirectory) => {
+  //
   // Someone tried to run a second instance, we should focus our window.
   if (player.win) {
     if (player.win.isMinimized()) player.win.restore()
@@ -62,9 +68,7 @@ var shouldQuit = app.makeSingleInstance(function (commandLine, workingDirectory)
   }
 })
 
-if (shouldQuit) {
-  app.exit()
-}
+app.commandLine.appendSwitch('autoplay-policy', 'no-user-gesture-required')
 
 app.on('ready', function appReady () {
   menu.init()

diff --git a/main/windows/audio.js b/main/windows/audio.js
@@ -23,7 +23,10 @@ function init () {
     show: false,
     skipTaskbar: true,
     useContentSize: true,
-    width: 200
+    width: 200,
+    contextIsolation: true,
+    nodeIntegration: false,
+    webSecurity: true
   })
 
   win.loadURL(AUDIO_WINDOW)

diff --git a/main/windows/player.js b/main/windows/player.js
@@ -31,7 +31,10 @@ function init () {
     show: false,
     backgroundColor: '#fff',
     thickFrame: true,
-    alwaysOnTop: alwaysOnTop
+    alwaysOnTop: alwaysOnTop,
+    contextIsolation: true,
+    nodeIntegration: false,
+    webSecurity: true
   })
 
   player.windowState.manage(win)

diff --git a/package.json b/package.json
@@ -1,7 +1,7 @@
 {
   "name": "hyperamp",
   "description": "Indescribable music player",
-  "version": "0.6.0",
+  "version": "0.6.1",
   "author": "Hypermodules (https://github.com/hypermodules)",
   "browserify": {
     "transform": [
@@ -90,8 +90,8 @@
     "common-shakeify": "^0.5.0",
     "concat-stream": "^1.6.0",
     "dependency-check": "^3.0.0",
-    "electron": "2.0.6",
-    "electron-builder": "20.26.1",
+    "electron": "^3.0.0-beta.3",
+    "electron-builder": "20.27.1",
     "electron-renderify": "0.0.2",
     "envify": "^4.1.0",
     "gh-release": "^3.2.0",

diff --git a/renderer/audio/index.html b/renderer/audio/index.html
@@ -6,15 +6,12 @@
   <style>
     h1 { text-align: center }
   </style>
+  <meta http-equiv="Content-Security-Policy" content="default-src 'self'">
 </head>
 <body>
   <h1>🎵</h1>
   <audio id="audio"></audio>
   <audio id="needle"></audio>
-  <script>
-    var isDev = require('electron-is-dev')
-    if (!isDev) require('../../lib/sentry.js')
-    require('./index.js')
-  </script>
+  <script src="./loader.js"></script>
 </body>
 </html>
diff --git a/renderer/audio/loader.js b/renderer/audio/loader.js
@@ -0,0 +1,3 @@
+var isDev = require('electron-is-dev')
+if (!isDev) require('../../lib/sentry.js')
+require('./index.js')
diff --git a/renderer/player/index.html b/renderer/player/index.html
@@ -3,20 +3,10 @@
 <head>
   <title>HyperAmp</title>
   <link rel="stylesheet" href="../shared/css/index.css">
+  <meta http-equiv="Content-Security-Policy" content="default-src 'self'; style-src 'self' 'unsafe-inline'; script-src 'self' http://localhost:9966">
 </head>
 <body>
   <main id="app"></main>
-  <script>
-    var isDev = require('electron-is-dev')
-    if (!isDev) window.raven = require('../../lib/sentry.js')
-    if (isDev || process.env.DEV_SERVER) {
-      var bundle = document.createElement('script')
-      bundle.src = 'http://localhost:9966/bundle.js'
-      document.body.appendChild(bundle)
-    } else {
-      window.localStorage.DISABLE_NANOTIMING = true
-      require('./bundle.js')
-    }
-  </script>
+  <script src="./loader.js" ></script>
 </body>
 </html>
diff --git a/renderer/player/loader.js b/renderer/player/loader.js
@@ -0,0 +1,10 @@
+var isDev = require('electron-is-dev')
+if (!isDev) window.raven = require('../../lib/sentry.js')
+if (isDev || process.env.DEV_SERVER) {
+  var bundle = document.createElement('script')
+  bundle.src = 'http://localhost:9966/bundle.js'
+  document.body.appendChild(bundle)
+} else {
+  window.localStorage.DISABLE_NANOTIMING = true
+  require('./bundle.js')
+}