From 8dacbbbb157359447a07ea4562ab6447dacb5f06 Mon Sep 17 00:00:00 2001
From: Ivan Gabaldon <igabaldon@inetol.net>
Date: Fri, 24 Oct 2025 11:28:07 +0200
Subject: [fix] client/simple: insecure ctx clipboard copy

Uses the deprecated [`execCommand()`](https://developer.mozilla.org/en-US/docs/Web/API/Document/execCommand)
to copy content to clipboard if accessing the instance through HTTP, this method
isn't going away soon.

Closes https://github.com/searxng/searxng/issues/5359
---
 client/simple/src/js/main/preferences.ts | 36 +++++++++++++++++++-------------
 1 file changed, 21 insertions(+), 15 deletions(-)

(limited to 'client/simple/src/js/main/preferences.ts')

diff --git a/client/simple/src/js/main/preferences.ts b/client/simple/src/js/main/preferences.ts
index aad01df57..620370ee5 100644
--- a/client/simple/src/js/main/preferences.ts
+++ b/client/simple/src/js/main/preferences.ts
@@ -1,6 +1,6 @@
 // SPDX-License-Identifier: AGPL-3.0-or-later
 
-import { http, listen, settings } from "../core/toolkit.ts";
+import { assertElement, http, listen, settings } from "../core/toolkit.ts";
 
 let engineDescriptions: Record<string, [string, string]> | undefined;
 
@@ -52,19 +52,25 @@ for (const engine of disableAllEngines) {
   listen("click", engine, () => toggleEngines(false, engineToggles));
 }
 
-const copyHashButton: HTMLElement | null = document.querySelector<HTMLElement>("#copy-hash");
-if (copyHashButton) {
-  listen("click", copyHashButton, async (event: Event) => {
-    event.preventDefault();
+listen("click", "#copy-hash", async function (this: HTMLElement) {
+  const target = this.parentElement?.querySelector<HTMLPreElement>("pre");
+  assertElement(target);
 
-    const { copiedText, hash } = copyHashButton.dataset;
-    if (!(copiedText && hash)) return;
-
-    try {
-      await navigator.clipboard.writeText(hash);
-      copyHashButton.innerText = copiedText;
-    } catch (error) {
-      console.error("Failed to copy hash:", error);
+  if (window.isSecureContext) {
+    await navigator.clipboard.writeText(target.innerText);
+  } else {
+    const selection = window.getSelection();
+    if (selection) {
+      const range = document.createRange();
+      range.selectNodeContents(target);
+      selection.removeAllRanges();
+      selection.addRange(range);
+      document.execCommand("copy");
     }
-  });
-}
+  }
+
+  const copiedText = this.dataset.copiedText;
+  if (copiedText) {
+    this.innerText = copiedText;
+  }
+});
-- 
cgit v1.2.3