fix: restrict rendering PDFs from other origins

lms/djangoapps/staticbook/tests.py

@@ -138,7 +138,7 @@ def test_book_chapter(self):
         url = self.make_url('pdf_book', book_index=0, chapter=2)
         response = self.client.get(url)
         self.assertContains(response, "Chapter 2 for PDF")
-        self.assertContains(response, "file={}".format(PDF_BOOK['chapters'][1]['url']))
+        self.assertNotContains(response, "file={}".format(PDF_BOOK['chapters'][1]['url']))
         self.assertNotContains(response, "page=")
 
     def test_book_page(self):
@@ -148,16 +148,16 @@ def test_book_page(self):
         response = self.client.get(url)
         self.assertContains(response, "Chapter 1 for PDF")
         self.assertNotContains(response, "options.chapterNum =")
-        self.assertContains(response, "page=17")
+        self.assertNotContains(response, "page=17")
 
     def test_book_chapter_page(self):
         # We can access a book at a particular chapter and page.
         self.make_course(pdf_textbooks=[PDF_BOOK])
         url = self.make_url('pdf_book', book_index=0, chapter=2, page=17)
         response = self.client.get(url)
         self.assertContains(response, "Chapter 2 for PDF")
-        self.assertContains(response, "file={}".format(PDF_BOOK['chapters'][1]['url']))
-        self.assertContains(response, "page=17")
+        self.assertNotContains(response, "file={}".format(PDF_BOOK['chapters'][1]['url']))
+        self.assertNotContains(response, "page=17")
 
     def test_bad_book_id(self):
         # If the book id isn't an int, we'll get a 404.

lms/djangoapps/staticbook/views.py

@@ -86,13 +86,15 @@ def pdf_index(request, course_id, book_index, chapter=None, page=None):
         raise Http404(f"Invalid book index value: {book_index}")
     textbook = course.pdf_textbooks[book_index]
 
-    viewer_params = '&file='
+    viewer_params = ''
     current_url = ''
 
     if 'url' in textbook:
         textbook['url'] = remap_static_url(textbook['url'], course)
-        viewer_params += textbook['url']
         current_url = textbook['url']
+        if not current_url.startswith(('http://', 'https://')):
+            viewer_params = '&file='
+            viewer_params += current_url
 
     # then remap all the chapter URLs as well, if they are provided.
     current_chapter = None
@@ -103,14 +105,20 @@ def pdf_index(request, course_id, book_index, chapter=None, page=None):
             current_chapter = textbook['chapters'][int(chapter) - 1]
         else:
             current_chapter = textbook['chapters'][0]
-        viewer_params += current_chapter['url']
+
         current_url = current_chapter['url']
+        if not current_url.startswith(('http://', 'https://')):
+            viewer_params = '&file='
+            viewer_params += current_url
 
     viewer_params += '#zoom=page-fit&disableRange=true'
     if page is not None:
         viewer_params += f'&page={page}'
 
-    if request.GET.get('viewer', '') == 'true':
+    if current_url.startswith('https://'):
+        current_url = ''
+        template = 'static_pdfbook.html'
+    elif request.GET.get('viewer', '') == 'true':
         template = 'pdf_viewer.html'
     else:
         template = 'static_pdfbook.html'

lms/templates/static_pdfbook.html

@@ -47,15 +47,19 @@
     %endif
 
     <div class="book">
-    <iframe
-    title="${current_chapter['title']}"
-    id="viewer-frame"
-    src="${request.path}?viewer=true${viewer_params}"
-    width="856"
-    height="1108"
-    frameborder="0"
-    tabindex="-1"
-    seamless></iframe>
+    % if 'file' in viewer_params:
+      <iframe
+        title="${current_chapter['title']}"
+        id="viewer-frame"
+        src="${request.path}?viewer=true${viewer_params}"
+        width="856" height="1108" frameborder="0" tabindex="-1" seamless></iframe>
+    % else:
+      <iframe
+        title="${current_chapter['title']}"
+        id="viewer-frame"
+        src=""
+        width="856" height="1108" frameborder="0" tabindex="-1" seamless></iframe>
+    % endif
     </div>
     </div>
 </main>