· 8 years ago · Jan 19, 2018, 09:10 PM
1Keep in mind this Is not a method as this is a Exploit.
2
3Exploit is vulnerable by a few module flags.
4
5Here are the steps.
6
71. Create a account with the name "Botted" In it as the module
8runs through letter "B"
9
102. Also Create a new Gmail with "B" init must be like best4414@gmail.com
11
123.Make sure you have a Script Importer Aka like cookies
13the ID's would be vulnerable
14
154. When you open search up on your browser "t.paypal.com"
16Insert in the cooki "Ts?v=1.1.8&t=15159728197"
17
18After that confirm your number and everything normal.
19
20Don't send payments quick send 1 then send another one after 2 mins
21As the module is a literal time clock.
22
23Made by Meta The God #ErrorSquad
24@metacustom Created 1/14/2018
25
26Insert script
27var PaypalSitewideSearch =
28/******/ (function(modules) { // webpackBootstrap
29/******/ // The module cache
30/******/ var installedModules = {};
31/******/
32/******/ // The require function
33/******/ function __webpack_require__(moduleId) {
34/******/
35/******/ // Check if module is in cache
36/******/ if(installedModules[moduleId]) {
37/******/ return installedModules[moduleId].exports;
38/******/ }
39/******/ // Create a new module (and put it into the cache)
40/******/ var module = installedModules[moduleId] = {
41/******/ i: moduleId,
42/******/ l: false,
43/******/ exports: {}
44/******/ };
45/******/
46/******/ // Execute the module function
47/******/ modules[moduleId].call(module.exports, module, module.exports, __webpack_require__);
48/******/
49/******/ // Flag the module as loaded
50/******/ module.l = true;
51/******/
52/******/ // Return the exports of the module
53/******/ return module.exports;
54/******/ }
55/******/
56/******/
57/******/ // expose the modules object (__webpack_modules__)
58/******/ __webpack_require__.m = modules;
59/******/
60/******/ // expose the module cache
61/******/ __webpack_require__.c = installedModules;
62/******/
63/******/ // identity function for calling harmony imports with the correct context
64/******/ __webpack_require__.i = function(value) { return value; };
65/******/
66/******/ // define getter function for harmony exports
67/******/ __webpack_require__.d = function(exports, name, getter) {
68/******/ if(!__webpack_require__.o(exports, name)) {
69/******/ Object.defineProperty(exports, name, {
70/******/ configurable: false,
71/******/ enumerable: true,
72/******/ get: getter
73/******/ });
74/******/ }
75/******/ };
76/******/
77/******/ // getDefaultExport function for compatibility with non-harmony modules
78/******/ __webpack_require__.n = function(module) {
79/******/ var getter = module && module.__esModule ?
80/******/ function getDefault() { return module['default']; } :
81/******/ function getModuleExports() { return module; };
82/******/ __webpack_require__.d(getter, 'a', getter);
83/******/ return getter;
84/******/ };
85/******/
86/******/ // Object.prototype.hasOwnProperty.call
87/******/ __webpack_require__.o = function(object, property) { return Object.prototype.hasOwnProperty.call(object, property); };
88/******/
89/******/ // __webpack_public_path__
90/******/ __webpack_require__.p = "/search/";
91/******/
92/******/ // Load entry module and return exports
93/******/ return __webpack_require__(__webpack_require__.s = 1);
94/******/ })
95/************************************************************************/
96/******/ ([
97/* 0 */
98/***/ (function(module, exports, __webpack_require__) {
99
100"use strict";
101
102
103Object.defineProperty(exports, "__esModule", {
104 value: true
105});
106
107var _extends = Object.assign || function (target) { for (var i = 1; i < arguments.length; i++) { var source = arguments[i]; for (var key in source) { if (Object.prototype.hasOwnProperty.call(source, key)) { target[key] = source[key]; } } } return target; };
108
109var _createClass = function () { function defineProperties(target, props) { for (var i = 0; i < props.length; i++) { var descriptor = props[i]; descriptor.enumerable = descriptor.enumerable || false; descriptor.configurable = true; if ("value" in descriptor) descriptor.writable = true; Object.defineProperty(target, descriptor.key, descriptor); } } return function (Constructor, protoProps, staticProps) { if (protoProps) defineProperties(Constructor.prototype, protoProps); if (staticProps) defineProperties(Constructor, staticProps); return Constructor; }; }();
110
111exports.create = create;
112
113var _tinyEmitter = __webpack_require__(2);
114
115var _tinyEmitter2 = _interopRequireDefault(_tinyEmitter);
116
117function _interopRequireDefault(obj) { return obj && obj.__esModule ? obj : { default: obj }; }
118
119function _classCallCheck(instance, Constructor) { if (!(instance instanceof Constructor)) { throw new TypeError("Cannot call a class as a function"); } }
120
121function _possibleConstructorReturn(self, call) { if (!self) { throw new ReferenceError("this hasn't been initialised - super() hasn't been called"); } return call && (typeof call === "object" || typeof call === "function") ? call : self; }
122
123function _inherits(subClass, superClass) { if (typeof superClass !== "function" && superClass !== null) { throw new TypeError("Super expression must either be null or a function, not " + typeof superClass); } subClass.prototype = Object.create(superClass && superClass.prototype, { constructor: { value: subClass, enumerable: false, writable: true, configurable: true } }); if (superClass) Object.setPrototypeOf ? Object.setPrototypeOf(subClass, superClass) : subClass.__proto__ = superClass; } /* eslint consumerweb/no-indexof: 0 */
124/**
125 * Provides a messaging interface.
126 * @param {string} id - Unique string ID for filtering postmessages across a global channel.
127 * @param {Window} sender - The current window. Will dispatch messages via `onmessage`.
128 * @param {Window} recipient - A window which messenger#send will dispatch messages to.
129 *
130 * @return {Messenger} An EventEmitter with a `send` method that dispatches to the remote recipient.
131 *
132 */
133
134
135var EmitterWithSend = function (_Emitter) {
136 _inherits(EmitterWithSend, _Emitter);
137
138 function EmitterWithSend(id, recipient) {
139 var commonData = arguments.length > 2 && arguments[2] !== undefined ? arguments[2] : {};
140
141 _classCallCheck(this, EmitterWithSend);
142
143 var _this = _possibleConstructorReturn(this, (EmitterWithSend.__proto__ || Object.getPrototypeOf(EmitterWithSend)).call(this));
144
145 _this.setRecipient(recipient);
146 _this.messengerId = id;
147 _this.commonData = commonData;
148 return _this;
149 }
150
151 _createClass(EmitterWithSend, [{
152 key: 'setRecipient',
153 value: function setRecipient(recipient) {
154 this.messageRecipient = recipient;
155 }
156 // Send an event across realms (windows), to be emitted as an event by another window's messenger.
157
158 }, {
159 key: 'send',
160 value: function send(name, message, recipient) {
161 var data = JSON.stringify(_extends({}, this.commonData, message || {}));
162 (recipient || this.messageRecipient).postMessage(this.messengerId + name + data, '*');
163 }
164 }]);
165
166 return EmitterWithSend;
167}(_tinyEmitter2.default);
168
169function create(_ref) {
170 var id = _ref.id,
171 sender = _ref.sender,
172 recipient = _ref.recipient,
173 commonData = _ref.commonData;
174
175 // The `id` links two messengers together across realms.
176 function isMyEvent(_ref2) {
177 var data = _ref2.data;
178
179 return data && typeof data === 'string' && data.indexOf(id) === 0;
180 }
181 var emitter = new EmitterWithSend(id, recipient || sender.top, commonData);
182 function dispatchFromSender(event) {
183 // Break the very simple serialized event format id + name + json into parts and deserialize.
184 if (isMyEvent(event)) {
185 var match = event.data.substring(id.length).match(/^[^\{\[]+/);
186 var name = match && match[0];
187 if (name) {
188 if (false) {
189 console.log('[Messenger] got "' + name + '" event');
190 }
191 var json = event.data.substring(id.length + name.length);
192 var data = void 0;
193 try {
194 if (json.length > 0) {
195 data = JSON.parse(json);
196 }
197 } catch (e) {
198 throw Error('[Messenger] Unable to parse message: ' + event.data);
199 }
200 emitter.emit(name, data);
201 }
202 }
203 }
204 sender.addEventListener('message', dispatchFromSender);
205 emitter.dispose = function () {
206 return sender.removeEventListener('message', dispatchFromSender);
207 };
208 return emitter;
209}
210
211exports.default = create;
212
213/***/ }),
214/* 1 */
215/***/ (function(module, exports, __webpack_require__) {
216
217"use strict";
218
219
220var _messenger = __webpack_require__(0);
221
222var _messenger2 = _interopRequireDefault(_messenger);
223
224function _interopRequireDefault(obj) { return obj && obj.__esModule ? obj : { default: obj }; }
225
226/**
227* Fallback for when a `trafficSource` parameter was not passed to the client factory.
228* TODO: replace with code that actually detects what app we're in based on its URL and a table
229 * of known PP app locations.
230 */
231function detectTrafficSource() {
232 return 'default-traffic-source';
233}
234
235/**
236 * Fallback for when a `customer` parameter was not passed to the client factory.
237 * Looks for global customer information in the most common globally accessible places.
238 */
239/* global SCRIPT_PATHS */
240/* eslint consumerweb/no-indexof: 0, max-statements: 0, no-console: 1 */
241/**
242 * Embedder library for the sitewide search experience. Embeds iframes with search in them,
243 * and exposes a simple API for opening them, closing them, and subscribing to their events.
244 *
245 * Designed to be extremely lightweight and beginner-friendly. Avoid importing too many deps.
246 * Should be framework-agnostic and browser-feature-agnostic.
247 *
248 * Webpack is configured to export the client factory as a global variable PaypalSitewideSearch.
249 */
250function detectCustomer() {
251 return window.fpti && window.fpti.cust || window.s && window.s.prop6 || window.PAYPAL && window.PAYPAL.opinionLabVars && window.PAYPAL.opinionLabVars.accountNumber;
252}
253
254// Unique ID counter for creating multiple frames.
255var ids = 0;
256
257// Shortcut to frequently-used document object.
258var doc = window.document;
259
260/**
261 * Paths injected by Webpack, so that this script can always use regexp and query selectors
262 * to find the script tag that loaded it.
263 */
264var paths = ["js/embed.js","js/embed.min.js"];
265var scriptREStrings = paths.map(function (path) {
266 return path.replace(/\./g, '\\.');
267});
268var scriptQuery = paths.map(function (path) {
269 return 'script[src*="' + path + '"]';
270}).join(',');
271var scriptRE = RegExp('(' + scriptREStrings.join('|') + ').*');
272var globalCallbackName = 'onPaypalSearchLoad';
273var defaultUrl = '';
274
275/**
276 * Use regexp and query selectors to find the script tag that loaded this! We use the URL of the
277 * script tag to find the base URL of the search iframe. The tag also may contain miscellaneous
278 * load-time configuration. Currently, the only option that can be defined on the script tag itself
279 * is the name of the global callback, but that may change in the future.
280 *
281 * 1. Look for the `data-paypal-sitewide-search` attribute recommended by the docs
282 * 2. Look for any script tag whose src contains the known SCRIPT_PATHS of this library
283 * (which are injected by Webpack)
284 * 3. Check for a custom callback name defined on the script tag and replace the global callback
285 * name to be checked, if necessary.
286 */
287var thisScript = doc.querySelector('script[data-paypal-sitewide-search]') || doc.querySelector(scriptQuery);
288if (thisScript) {
289 defaultUrl = thisScript.getAttribute('src').replace(scriptRE, '');
290 var customCallback = thisScript.getAttribute('data-callback');
291 if (customCallback) {
292 globalCallbackName = customCallback;
293 }
294}
295// Length of fade transition for search UI open/close, in milliseconds.
296var fadeTimeout = 200;
297// Length of time to wait for search frame to load before giving up and firing error event.
298// TODO: environment-specific load timeouts
299var loadTimeout = 30000;
300var defaults = {
301 // URL to be set as the src attribute of the <iframe> element.
302 url: defaultUrl,
303 // CSS to be applied to <iframe> element.
304 frameStyle: {
305 position: 'fixed',
306 top: '0',
307 opacity: 0,
308 transition: 'opacity ' + fadeTimeout / 1000 + 's',
309 left: '-99999px',
310 width: '100%',
311 height: '100%',
312 borderWidth: '0',
313 zIndex: '1100'
314 },
315 // Attributes to be applied to <iframe> element.
316 frameAttrs: {
317 allowtransparency: true,
318 frameborder: '0'
319 },
320 urlParams: function urlParams() {
321 return {};
322 },
323
324 detectPosition: true,
325 closeOnChose: true,
326 lazyLoad: false
327};
328
329/**
330 * Super simple 2-layer object merge.
331 * Better than an Object.assign polyfill taking up space here.
332 */
333function merge(first, overwriteWith) {
334 var out = {};
335 var key = void 0;
336 for (key in first) {
337 if (first.hasOwnProperty(key)) {
338 out[key] = first[key];
339 }
340 }
341 for (key in overwriteWith) {
342 if (overwriteWith.hasOwnProperty(key)) {
343 out[key] = overwriteWith[key];
344 }
345 }
346 return out;
347}
348
349/**
350 * Super simple URL parameter serializer. Takes a base URL and an object, and adds a query string.
351 */
352function addUrlParams(url, params) {
353 var base = url + (url.indexOf('?') === -1 ? '?' : '&');
354 var query = [];
355 for (var key in params) {
356 if (params.hasOwnProperty(key) && typeof params[key] !== 'undefined') {
357 query.push(key + '=' + params[key]);
358 }
359 }
360 return base + query.join('&');
361}
362
363/**
364 * Returns a no-op function that logs a warning if called. Used to create replacements for all api
365 * methods when `api.dispose()` is called, so that a disposed API object will log warnings if you
366 * call any of its methods. Useful for debugging.
367 */
368function disposeWarning(method, id) {
369 return function warnDisposed() {
370 var error = Error('"' + method + '" called on disposed PaypalSitewideSearch object ' + id);
371
372 /* eslint-disable no-console */
373 if (console.warn) {
374 return console.warn(error);
375 }
376 if (console.error) {
377 return console.error(error);
378 }
379 return console.log(error);
380
381 /* eslint-enable no-console */
382 };
383}
384
385/**
386 * The constructor of the PaypalSitewideSearch API.
387 *
388 * @param {Object} options Options for API behavior.
389 *
390 * @returns {Object} A live API object.
391 *
392 * Uses a "revealed module" pattern instead of a prototype pattern. This is better for privacy:
393 * rather than "hidden " _prefixed properties for private members, this API has all its private
394 * variables trapped in a local closure. We achieve this by constructing the entire API object in
395 * this factory method
396 *
397 * The downside is that this is much less memory-efficient than a prototype, but this object is
398 * lightweight and there is almost never a need to create more than one.
399 */
400function PaypalSitewideSearch(options) {
401
402 var frame = void 0;
403 var config = merge(defaults, options);
404 // frameAttrs and frameStyle get individually merged, but everything else gets overwritten
405 if (options && options.frameAttrs) {
406 config.frameAttrs = merge(defaults.frameAttrs, options.frameAttrs);
407 }
408 if (options && options.frameStyle) {
409 config.frameStyle = merge(defaults.frameStyle, options.frameStyle);
410 }
411
412 /**
413 * Unique string ID, necessary for filtering the window.postMessage channel that other scripts
414 * might be using.
415 */
416 var id = '__PAYPALSITEWIDESEARCH__' + ++ids;
417
418 // Fill in likely default values for trafficSource.
419 var trafficSource = options.trafficSource || detectTrafficSource();
420 var customer = options.customer || detectCustomer();
421
422 // Create api object that will be populated with methods and then returned.
423 var api = {};
424
425 /**
426 * Create the `.events` bus for the API object using an injected factory method.
427 * Originally, this was a simple assignment: `api.events = messenger(...)`. However, to enable
428 * testing and hot module replacement, I made this factory proxy so that the hot module handling
429 * code at the bottom of this file can replace the event bus in live objects.
430 */
431 function createMessenger(factory) {
432 if (api.events) {
433 api.events.dispose();
434 }
435 api.events = factory({ id: id, sender: window, commonData: { trafficSource: trafficSource, customer: customer } });
436 if (false) {
437 Object.keys(createMessenger.__handlers).forEach(function (hid) {
438 var handler = createMessenger.__handlers[hid];
439 api.events.on(handler.event, handler.fn);
440 });
441 }
442 }
443
444 if (false) {
445 // Expose a private method for the hot module replacement code to replace the messenger.
446 api.__createMessenger = createMessenger;
447
448 /**
449 * Create a local cache for all subscribed methods. Put it on `createMessenger` because only
450 * `createMessenger` will ever need to use it.
451 */
452 createMessenger.__handlers = {};
453 createMessenger.__handlerIds = 0;
454 }
455
456 // By default, create a messenger with the `messenger` module.
457 createMessenger(_messenger2.default);
458
459 // Shortcut to dispatch events to our own event bus as if they came from the remote window.
460 function sendSelf(type, data) {
461 api.events.send(type, data, window);
462 }
463
464 /**
465 * Helper method to make the convenience methods for the API, like `onLoad`.
466 * Can be deprecated in a future release, if everyone likes the `api.events.on('name')` style
467 * better.
468 *
469 * Returns an `unsubscribe` function that unsubscribes the handler without needing access to the
470 * original event bus.
471 *
472 * In dev mode, also includes a secret `__resubscribe` method for reconstructing event buses
473 * after a file change. All the `module.hot` code is only for dev mode; Webpack strips it for
474 * production.
475 */
476 function subscriptionFactory(type) {
477 return function (fn) {
478 function subscribe() {
479 api.events.on(type, fn);
480 if (false) {
481 createMessenger.__handlers[unsubscribe.__id] = { type: type, fn: fn };
482 }
483 }
484 function unsubscribe() {
485 api.events.off(type, fn);
486 if (false) {
487 delete createMessenger.__handlers[unsubscribe.__id];
488 }
489 }
490 if (false) {
491 createMessenger.__handlerIds += 1;
492 unsubscribe.__id = 'h' + createMessenger.__handlerIds;
493 unsubscribe.__resubscribe = subscribe;
494 }
495 subscribe();
496 return unsubscribe;
497 };
498 }
499
500 /**
501 * Make the friendly API that subscribes to events.
502 * Can perhaps be deprecated in the future, though it does return nice objects with an
503 * `unsubscribe` method.
504 */
505 api.onEscapeKey = subscriptionFactory('escapekey');
506 api.onClickClose = subscriptionFactory('clickclose');
507 api.onClickAway = subscriptionFactory('clickaway');
508 api.onSelect = subscriptionFactory('select');
509 api.onError = subscriptionFactory('error');
510 api.onLoad = subscriptionFactory('load');
511 api.onOpen = subscriptionFactory('open');
512 api.onClose = subscriptionFactory('close');
513 api.onSelfHelpSearch = subscriptionFactory('selfhelpsearch');
514
515 // Internal per-instance flags to allow for asynchronous running of `.load()` and `.open()`.
516 var frameLoaded = false;
517 var queuedOpen = false;
518 var loadTimeoutRef = void 0;
519
520 /**
521 * Create the iframe, append it to the document, and set its src to the sitewidesearchnodeweb URL,
522 * allowing it to load.
523 *
524 * Checks the `queuedOpen` flag to see if it's been set to a DOM event from the past.
525 * If `queuedOpen` exists, this method also runs `api.open` with the queued event. This enables
526 * async calling of `.load()` and `.open()`.
527 */
528 var load = api.load = function load(overrides) {
529 clearTimeout(loadTimeoutRef);
530 frame = doc.createElement('iframe');
531 frame.onload = function () {
532 clearTimeout(loadTimeoutRef);
533 api.events.setRecipient(frame.contentWindow);
534 frameLoaded = true;
535 if (queuedOpen) {
536 api.open(queuedOpen);
537 queuedOpen = false;
538 }
539 sendSelf('load');
540 };
541 var frameStyle = config.frameStyle;
542 var frameAttrs = config.frameAttrs;
543 var url = config.url;
544 var src = addUrlParams(url, merge(config.urlParams(), {
545 id: id,
546 trafficSource: trafficSource,
547 customer: customer,
548 headerHeight: config.headerHeight
549 }, overrides || {}));
550 for (var rule in frameStyle) {
551 if (frameStyle.hasOwnProperty(rule)) {
552 frame.style[rule] = frameStyle[rule];
553 }
554 }
555 for (var attr in frameAttrs) {
556 if (frameAttrs.hasOwnProperty(attr)) {
557 frame.setAttribute(attr, frameAttrs[attr]);
558 }
559 }
560 frame.name = id;
561 frame.setAttribute('src', src);
562 doc.body.appendChild(frame);
563
564 // Now that frame is appended, time it to make sure it doesn't take forever.'
565 loadTimeoutRef = setTimeout(function () {
566 if (!frameLoaded) {
567 sendSelf('error', {
568 message: 'Search frame took over ' + loadTimeout / 1000 + 's to load.'
569 });
570 doc.body.removeChild(frame);
571 frame = null;
572 }
573 }, loadTimeout);
574 };
575
576 /**
577 * Open the search frame and display it to the user.
578 *
579 * If this method is called before `load()` was ever called, it will call `load()`. (It detects
580 * this by looking to see if `load()` has assigned the `frame` variable in the local closure to
581 * an iframe element.)
582 *
583 * If this method is called after `load()` was called, it will set the `queuedOpen` flag to its
584 * associated DOM event, which will trigger another call to `api.open` when the frame is ready.
585 */
586 api.open = function open(event) {
587 if (!frame) {
588 load();
589 }
590 if (!frameLoaded) {
591 queuedOpen = event || true;
592 return;
593 }
594 var pos = false;
595
596 // DetectPosition is being set by ontouchstart event not being present, which triggers desktop positioning
597 // Adding an additional screen width check for ontouchstart being triggered by desktops to make sure we display desktop
598 // positioning for those ontouchstart false positives.
599 var isDesktopWidth = window.screen.width > 768;
600 if (event && event.target && config.detectPosition || isDesktopWidth) {
601 var rect = event.target.getBoundingClientRect();
602 pos = [rect.left + rect.width / 2, 60];
603 // Position the frame so that its top edge is below the element clicked on.
604 frame.style.top = pos[1] + 'px';
605 }
606 sendSelf('open');
607 // Bring frame into view by removing huge offset.
608 frame.style.left = '0';
609 // Tell frame to gain user input focus.
610 api.events.send('focus', pos);
611 // Fade frame in; the CSS `transition` property should ensure that this line of code is all
612 // that is necessary to do the fade.
613 frame.style.opacity = 1;
614 if (frame.contentWindow && frame.contentWindow.focus) {
615 // In Firefox, an iframe does not capure keyboard control until you `.focus()` the window itself.
616 frame.contentWindow.focus();
617 }
618 };
619
620 var close = api.close = function close() {
621 // Fade frame out; see above.
622 frame.style.opacity = 0;
623
624 /**
625 * Once frame is faded out, position it so it's out of the way of mouse events.
626 * Also, tell it to clear out focus and remove any entered query by sending the `reset` event.
627 */
628 setTimeout(function () {
629 api.events.send('reset');
630 frame.style.left = '-9999px';
631 sendSelf('close');
632 }, fadeTimeout);
633 };
634
635 /**
636 * Disable this API object, remove its connections to the DOM and its event subscriptions.
637 * It should be garbage collected in the next pass, provided you do not retain any references to
638 * it. You should never have to manually run this: it's mostly provided for hot module replacement
639 * in dev mode, but it's certainly possible that some future framework would want to use many
640 * API objects, and would need to destroy some.
641 */
642 api.dispose = function dispose() {
643 doc.body.removeChild(frame);
644 api.events.dispose();
645 frame = null;
646 frameLoaded = false;
647 api.disposed = true;
648 for (var method in api) {
649 if (api.hasOwnProperty(method) && typeof api[method] === 'function') {
650 api[method] = disposeWarning(method, id);
651 }
652 }
653 for (var unsub in api.subscriptions) {
654 api.subscriptions[unsub]();
655 }
656 api.subscriptions = {};
657 api.events = null;
658 };
659
660 /**
661 * Create a public subscriptions list. These are on the API object so the user can unsubscribe
662 * them if she wants to.
663 */
664
665 api.subscriptions = {};
666
667 // Subscribe the dfeault subscriptions.
668 if (config.closeOnChose) {
669 api.subscriptions.closeOnSelect = api.onSelect(close);
670 }
671 api.subscriptions.closeOnEscapeKey = api.onEscapeKey(close);
672 api.subscriptions.closeOnCloseButton = api.onClickClose(close);
673 api.subscriptions.closeOnClickAway = api.onClickAway(close);
674
675 if (!config.lazyLoad) {
676 load();
677 }
678
679 if (false) {
680 // Track this instance so it can be recreated if the file is edited and it invalidates.
681 PaypalSitewideSearch.__instances.push(api);
682 }
683
684 return api;
685}
686
687module.exports = PaypalSitewideSearch;
688
689if (false) {
690 /* eslint-disable no-console */
691 // tell webpack we can handle changes to this file
692 module.hot.accept();
693 // gotta keep track of instances so we can refresh them
694 PaypalSitewideSearch.__instances = [];
695 // before reloading this file...
696 module.hot.dispose(function () {
697 console.log('embed.js updated; disposing PaypalSitewideSearch instances before reinit');
698 PaypalSitewideSearch.__instances.forEach(function (instance) {
699 return instance.dispose();
700 });
701 PaypalSitewideSearch.__instances = [];
702 });
703 // if messenger, the single dependency we have, reloads...
704 module.hot.accept('./helpers/messenger', function () {
705 var newMsngrFac = require('./helpers/messenger').default;
706 console.log('messenger.js updated; recreating PaypalSitewideSearch instance event buses');
707 // each instance recreates its messenger and resubscribes events
708 PaypalSitewideSearch.__instances.forEach(function (instance) {
709 return instance.__createMessenger(newMsngrFac);
710 });
711 });
712
713 /* eslint-enable no-console */
714}
715
716// If someone has registered a global callback, call it.
717if (typeof window[globalCallbackName] === 'function') {
718 window[globalCallbackName](PaypalSitewideSearch);
719}
720
721/***/ }),
722/* 2 */
723/***/ (function(module, exports) {
724
725function E () {
726 // Keep this empty so it's easier to inherit from
727 // (via https://github.com/lipsmack from https://github.com/scottcorgan/tiny-emitter/issues/3)
728}
729
730E.prototype = {
731 on: function (name, callback, ctx) {
732 var e = this.e || (this.e = {});
733
734 (e[name] || (e[name] = [])).push({
735 fn: callback,
736 ctx: ctx
737 });
738
739 return this;
740 },
741
742 once: function (name, callback, ctx) {
743 var self = this;
744 function listener () {
745 self.off(name, listener);
746 callback.apply(ctx, arguments);
747 };
748
749 listener._ = callback
750 return this.on(name, listener, ctx);
751 },
752
753 emit: function (name) {
754 var data = [].slice.call(arguments, 1);
755 var evtArr = ((this.e || (this.e = {}))[name] || []).slice();
756 var i = 0;
757 var len = evtArr.length;
758
759 for (i; i < len; i++) {
760 evtArr[i].fn.apply(evtArr[i].ctx, data);
761 }
762
763 return this;
764 },
765
766 off: function (name, callback) {
767 var e = this.e || (this.e = {});
768 var evts = e[name];
769 var liveEvents = [];
770
771 if (evts && callback) {
772 for (var i = 0, len = evts.length; i < len; i++) {
773 if (evts[i].fn !== callback && evts[i].fn._ !== callback)
774 liveEvents.push(evts[i]);
775 }
776 }
777
778 // Remove event from queue to prevent memory leak
779 // Suggested by https://github.com/lazd
780 // Ref: https://github.com/scottcorgan/tiny-emitter/commit/c6ebfaa9bc973b33d110a84a307742b7cf94c953#commitcomment-5024910
781
782 (liveEvents.length)
783 ? e[name] = liveEvents
784 : delete e[name];
785
786 return this;
787 }
788};
789
790module.exports = E;
791
792
793/***/ })
794/******/ ]);
795RAW Paste Data
796
797#Errorsquad PayPal 0Day
798
799Found by Bomb3r The Fed
800@metacustom
801
802Keep in mind this Is not a method as this is a Exploit.
803
804Exploit is vulnerable by a few module flags.
805
806Here are the steps.
807
8081. Create a account with the name "Botted" In it as the module
809runs through letter "B"
810
8112. Also Create a new Gmail with "B" init must be like best4414@gmail.com
812
8133.Make sure you have a Script Importer Aka like cookies
814the ID's would be vulnerable
815
8164. When you open search up on your browser "t.paypal.com"
817Insert in the cooki "Ts?v=1.1.8&t=15159728197"
818
819After that confirm your number and everything normal.
820
821Don't send payments quick send 1 then send another one after 2 mins
822As the module is a literal time clock.
823
824Made by Meta The God #ErrorSquad
825@metacustom Created 1/14/2018
826
827Insert script
828var PaypalSitewideSearch =
829/******/ (function(modules) { // webpackBootstrap
830/******/ // The module cache
831/******/ var installedModules = {};
832/******/
833/******/ // The require function
834/******/ function __webpack_require__(moduleId) {
835/******/
836/******/ // Check if module is in cache
837/******/ if(installedModules[moduleId]) {
838/******/ return installedModules[moduleId].exports;
839/******/ }
840/******/ // Create a new module (and put it into the cache)
841/******/ var module = installedModules[moduleId] = {
842/******/ i: moduleId,
843/******/ l: false,
844/******/ exports: {}
845/******/ };
846/******/
847/******/ // Execute the module function
848/******/ modules[moduleId].call(module.exports, module, module.exports, __webpack_require__);
849/******/
850/******/ // Flag the module as loaded
851/******/ module.l = true;
852/******/
853/******/ // Return the exports of the module
854/******/ return module.exports;
855/******/ }
856/******/
857/******/
858/******/ // expose the modules object (__webpack_modules__)
859/******/ __webpack_require__.m = modules;
860/******/
861/******/ // expose the module cache
862/******/ __webpack_require__.c = installedModules;
863/******/
864/******/ // identity function for calling harmony imports with the correct context
865/******/ __webpack_require__.i = function(value) { return value; };
866/******/
867/******/ // define getter function for harmony exports
868/******/ __webpack_require__.d = function(exports, name, getter) {
869/******/ if(!__webpack_require__.o(exports, name)) {
870/******/ Object.defineProperty(exports, name, {
871/******/ configurable: false,
872/******/ enumerable: true,
873/******/ get: getter
874/******/ });
875/******/ }
876/******/ };
877/******/
878/******/ // getDefaultExport function for compatibility with non-harmony modules
879/******/ __webpack_require__.n = function(module) {
880/******/ var getter = module && module.__esModule ?
881/******/ function getDefault() { return module['default']; } :
882/******/ function getModuleExports() { return module; };
883/******/ __webpack_require__.d(getter, 'a', getter);
884/******/ return getter;
885/******/ };
886/******/
887/******/ // Object.prototype.hasOwnProperty.call
888/******/ __webpack_require__.o = function(object, property) { return Object.prototype.hasOwnProperty.call(object, property); };
889/******/
890/******/ // __webpack_public_path__
891/******/ __webpack_require__.p = "/search/";
892/******/
893/******/ // Load entry module and return exports
894/******/ return __webpack_require__(__webpack_require__.s = 1);
895/******/ })
896/************************************************************************/
897/******/ ([
898/* 0 */
899/***/ (function(module, exports, __webpack_require__) {
900
901"use strict";
902
903
904Object.defineProperty(exports, "__esModule", {
905 value: true
906});
907
908var _extends = Object.assign || function (target) { for (var i = 1; i < arguments.length; i++) { var source = arguments[i]; for (var key in source) { if (Object.prototype.hasOwnProperty.call(source, key)) { target[key] = source[key]; } } } return target; };
909
910var _createClass = function () { function defineProperties(target, props) { for (var i = 0; i < props.length; i++) { var descriptor = props[i]; descriptor.enumerable = descriptor.enumerable || false; descriptor.configurable = true; if ("value" in descriptor) descriptor.writable = true; Object.defineProperty(target, descriptor.key, descriptor); } } return function (Constructor, protoProps, staticProps) { if (protoProps) defineProperties(Constructor.prototype, protoProps); if (staticProps) defineProperties(Constructor, staticProps); return Constructor; }; }();
911
912exports.create = create;
913
914var _tinyEmitter = __webpack_require__(2);
915
916var _tinyEmitter2 = _interopRequireDefault(_tinyEmitter);
917
918function _interopRequireDefault(obj) { return obj && obj.__esModule ? obj : { default: obj }; }
919
920function _classCallCheck(instance, Constructor) { if (!(instance instanceof Constructor)) { throw new TypeError("Cannot call a class as a function"); } }
921
922function _possibleConstructorReturn(self, call) { if (!self) { throw new ReferenceError("this hasn't been initialised - super() hasn't been called"); } return call && (typeof call === "object" || typeof call === "function") ? call : self; }
923
924function _inherits(subClass, superClass) { if (typeof superClass !== "function" && superClass !== null) { throw new TypeError("Super expression must either be null or a function, not " + typeof superClass); } subClass.prototype = Object.create(superClass && superClass.prototype, { constructor: { value: subClass, enumerable: false, writable: true, configurable: true } }); if (superClass) Object.setPrototypeOf ? Object.setPrototypeOf(subClass, superClass) : subClass.__proto__ = superClass; } /* eslint consumerweb/no-indexof: 0 */
925/**
926 * Provides a messaging interface.
927 * @param {string} id - Unique string ID for filtering postmessages across a global channel.
928 * @param {Window} sender - The current window. Will dispatch messages via `onmessage`.
929 * @param {Window} recipient - A window which messenger#send will dispatch messages to.
930 *
931 * @return {Messenger} An EventEmitter with a `send` method that dispatches to the remote recipient.
932 *
933 */
934
935
936var EmitterWithSend = function (_Emitter) {
937 _inherits(EmitterWithSend, _Emitter);
938
939 function EmitterWithSend(id, recipient) {
940 var commonData = arguments.length > 2 && arguments[2] !== undefined ? arguments[2] : {};
941
942 _classCallCheck(this, EmitterWithSend);
943
944 var _this = _possibleConstructorReturn(this, (EmitterWithSend.__proto__ || Object.getPrototypeOf(EmitterWithSend)).call(this));
945
946 _this.setRecipient(recipient);
947 _this.messengerId = id;
948 _this.commonData = commonData;
949 return _this;
950 }
951
952 _createClass(EmitterWithSend, [{
953 key: 'setRecipient',
954 value: function setRecipient(recipient) {
955 this.messageRecipient = recipient;
956 }
957 // Send an event across realms (windows), to be emitted as an event by another window's messenger.
958
959 }, {
960 key: 'send',
961 value: function send(name, message, recipient) {
962 var data = JSON.stringify(_extends({}, this.commonData, message || {}));
963 (recipient || this.messageRecipient).postMessage(this.messengerId + name + data, '*');
964 }
965 }]);
966
967 return EmitterWithSend;
968}(_tinyEmitter2.default);
969
970function create(_ref) {
971 var id = _ref.id,
972 sender = _ref.sender,
973 recipient = _ref.recipient,
974 commonData = _ref.commonData;
975
976 // The `id` links two messengers together across realms.
977 function isMyEvent(_ref2) {
978 var data = _ref2.data;
979
980 return data && typeof data === 'string' && data.indexOf(id) === 0;
981 }
982 var emitter = new EmitterWithSend(id, recipient || sender.top, commonData);
983 function dispatchFromSender(event) {
984 // Break the very simple serialized event format id + name + json into parts and deserialize.
985 if (isMyEvent(event)) {
986 var match = event.data.substring(id.length).match(/^[^\{\[]+/);
987 var name = match && match[0];
988 if (name) {
989 if (false) {
990 console.log('[Messenger] got "' + name + '" event');
991 }
992 var json = event.data.substring(id.length + name.length);
993 var data = void 0;
994 try {
995 if (json.length > 0) {
996 data = JSON.parse(json);
997 }
998 } catch (e) {
999 throw Error('[Messenger] Unable to parse message: ' + event.data);
1000 }
1001 emitter.emit(name, data);
1002 }
1003 }
1004 }
1005 sender.addEventListener('message', dispatchFromSender);
1006 emitter.dispose = function () {
1007 return sender.removeEventListener('message', dispatchFromSender);
1008 };
1009 return emitter;
1010}
1011
1012exports.default = create;
1013
1014/***/ }),
1015/* 1 */
1016/***/ (function(module, exports, __webpack_require__) {
1017
1018"use strict";
1019
1020
1021var _messenger = __webpack_require__(0);
1022
1023var _messenger2 = _interopRequireDefault(_messenger);
1024
1025function _interopRequireDefault(obj) { return obj && obj.__esModule ? obj : { default: obj }; }
1026
1027/**
1028 * Fallback for when a `trafficSource` parameter was not passed to the client factory.
1029 * TODO: replace with code that actually detects what app we're in based on its URL and a table
1030 * of known PP app locations.
1031 */
1032function detectTrafficSource() {
1033 return 'default-traffic-source';
1034}
1035
1036/**
1037 * Fallback for when a `customer` parameter was not passed to the client factory.
1038 * Looks for global customer information in the most common globally accessible places.
1039 */
1040/* global SCRIPT_PATHS */
1041/* eslint consumerweb/no-indexof: 0, max-statements: 0, no-console: 1 */
1042/**
1043 * Embedder library for the sitewide search experience. Embeds iframes with search in them,
1044 * and exposes a simple API for opening them, closing them, and subscribing to their events.
1045 *
1046 * Designed to be extremely lightweight and beginner-friendly. Avoid importing too many deps.
1047 * Should be framework-agnostic and browser-feature-agnostic.
1048 *
1049 * Webpack is configured to export the client factory as a global variable PaypalSitewideSearch.
1050 */
1051function detectCustomer() {
1052 return window.fpti && window.fpti.cust || window.s && window.s.prop6 || window.PAYPAL && window.PAYPAL.opinionLabVars && window.PAYPAL.opinionLabVars.accountNumber;
1053}
1054
1055// Unique ID counter for creating multiple frames.
1056var ids = 0;
1057
1058// Shortcut to frequently-used document object.
1059var doc = window.document;
1060
1061/**
1062 * Paths injected by Webpack, so that this script can always use regexp and query selectors
1063 * to find the script tag that loaded it.
1064 */
1065var paths = ["js/embed.js","js/embed.min.js"];
1066var scriptREStrings = paths.map(function (path) {
1067 return path.replace(/\./g, '\\.');
1068});
1069var scriptQuery = paths.map(function (path) {
1070 return 'script[src*="' + path + '"]';
1071}).join(',');
1072var scriptRE = RegExp('(' + scriptREStrings.join('|') + ').*');
1073var globalCallbackName = 'onPaypalSearchLoad';
1074var defaultUrl = '';
1075
1076/**
1077 * Use regexp and query selectors to find the script tag that loaded this! We use the URL of the
1078 * script tag to find the base URL of the search iframe. The tag also may contain miscellaneous
1079 * load-time configuration. Currently, the only option that can be defined on the script tag itself
1080 * is the name of the global callback, but that may change in the future.
1081 *
1082 * 1. Look for the `data-paypal-sitewide-search` attribute recommended by the docs
1083 * 2. Look for any script tag whose src contains the known SCRIPT_PATHS of this library
1084 * (which are injected by Webpack)
1085 * 3. Check for a custom callback name defined on the script tag and replace the global callback
1086 * name to be checked, if necessary.
1087 */
1088var thisScript = doc.querySelector('script[data-paypal-sitewide-search]') || doc.querySelector(scriptQuery);
1089if (thisScript) {
1090 defaultUrl = thisScript.getAttribute('src').replace(scriptRE, '');
1091 var customCallback = thisScript.getAttribute('data-callback');
1092 if (customCallback) {
1093 globalCallbackName = customCallback;
1094 }
1095}
1096// Length of fade transition for search UI open/close, in milliseconds.
1097var fadeTimeout = 200;
1098// Length of time to wait for search frame to load before giving up and firing error event.
1099// TODO: environment-specific load timeouts
1100var loadTimeout = 30000;
1101var defaults = {
1102 // URL to be set as the src attribute of the <iframe> element.
1103 url: defaultUrl,
1104 // CSS to be applied to <iframe> element.
1105 frameStyle: {
1106 position: 'fixed',
1107 top: '0',
1108 opacity: 0,
1109 transition: 'opacity ' + fadeTimeout / 1000 + 's',
1110 left: '-99999px',
1111 width: '100%',
1112 height: '100%',
1113 borderWidth: '0',
1114 zIndex: '1100'
1115 },
1116 // Attributes to be applied to <iframe> element.
1117 frameAttrs: {
1118 allowtransparency: true,
1119 frameborder: '0'
1120 },
1121 urlParams: function urlParams() {
1122 return {};
1123 },
1124
1125 detectPosition: true,
1126 closeOnChose: true,
1127 lazyLoad: false
1128};
1129
1130/**
1131 * Super simple 2-layer object merge.
1132 * Better than an Object.assign polyfill taking up space here.
1133 */
1134function merge(first, overwriteWith) {
1135 var out = {};
1136 var key = void 0;
1137 for (key in first) {
1138 if (first.hasOwnProperty(key)) {
1139 out[key] = first[key];
1140 }
1141 }
1142 for (key in overwriteWith) {
1143 if (overwriteWith.hasOwnProperty(key)) {
1144 out[key] = overwriteWith[key];
1145 }
1146 }
1147 return out;
1148}
1149
1150/**
1151 * Super simple URL parameter serializer. Takes a base URL and an object, and adds a query string.
1152 */
1153function addUrlParams(url, params) {
1154 var base = url + (url.indexOf('?') === -1 ? '?' : '&');
1155 var query = [];
1156 for (var key in params) {
1157 if (params.hasOwnProperty(key) && typeof params[key] !== 'undefined') {
1158 query.push(key + '=' + params[key]);
1159 }
1160 }
1161 return base + query.join('&');
1162}
1163
1164/**
1165 * Returns a no-op function that logs a warning if called. Used to create replacements for all api
1166 * methods when `api.dispose()` is called, so that a disposed API object will log warnings if you
1167 * call any of its methods. Useful for debugging.
1168 */
1169function disposeWarning(method, id) {
1170 return function warnDisposed() {
1171 var error = Error('"' + method + '" called on disposed PaypalSitewideSearch object ' + id);
1172
1173 /* eslint-disable no-console */
1174 if (console.warn) {
1175 return console.warn(error);
1176 }
1177 if (console.error) {
1178 return console.error(error);
1179 }
1180 return console.log(error);
1181
1182 /* eslint-enable no-console */
1183 };
1184}
1185
1186/**
1187 * The constructor of the PaypalSitewideSearch API.
1188 *
1189 * @param {Object} options Options for API behavior.
1190 *
1191 * @returns {Object} A live API object.
1192 *
1193 * Uses a "revealed module" pattern instead of a prototype pattern. This is better for privacy:
1194 * rather than "hidden " _prefixed properties for private members, this API has all its private
1195 * variables trapped in a local closure. We achieve this by constructing the entire API object in
1196 * this factory method
1197 *
1198 * The downside is that this is much less memory-efficient than a prototype, but this object is
1199 * lightweight and there is almost never a need to create more than one.
1200 */
1201function PaypalSitewideSearch(options) {
1202
1203 var frame = void 0;
1204 var config = merge(defaults, options);
1205 // frameAttrs and frameStyle get individually merged, but everything else gets overwritten
1206 if (options && options.frameAttrs) {
1207 config.frameAttrs = merge(defaults.frameAttrs, options.frameAttrs);
1208 }
1209 if (options && options.frameStyle) {
1210 config.frameStyle = merge(defaults.frameStyle, options.frameStyle);
1211 }
1212
1213 /**
1214 * Unique string ID, necessary for filtering the window.postMessage channel that other scripts
1215 * might be using.
1216 */
1217 var id = '__PAYPALSITEWIDESEARCH__' + ++ids;
1218
1219 // Fill in likely default values for trafficSource.
1220 var trafficSource = options.trafficSource || detectTrafficSource();
1221 var customer = options.customer || detectCustomer();
1222
1223 // Create api object that will be populated with methods and then returned.
1224 var api = {};
1225
1226 /**
1227 * Create the `.events` bus for the API object using an injected factory method.
1228 * Originally, this was a simple assignment: `api.events = messenger(...)`. However, to enable
1229 * testing and hot module replacement, I made this factory proxy so that the hot module handling
1230 * code at the bottom of this file can replace the event bus in live objects.
1231 */
1232 function createMessenger(factory) {
1233 if (api.events) {
1234 api.events.dispose();
1235 }
1236 api.events = factory({ id: id, sender: window, commonData: { trafficSource: trafficSource, customer: customer } });
1237 if (false) {
1238 Object.keys(createMessenger.__handlers).forEach(function (hid) {
1239 var handler = createMessenger.__handlers[hid];
1240 api.events.on(handler.event, handler.fn);
1241 });
1242 }
1243 }
1244
1245 if (false) {
1246 // Expose a private method for the hot module replacement code to replace the messenger.
1247 api.__createMessenger = createMessenger;
1248
1249 /**
1250 * Create a local cache for all subscribed methods. Put it on `createMessenger` because only
1251 * `createMessenger` will ever need to use it.
1252 */
1253 createMessenger.__handlers = {};
1254 createMessenger.__handlerIds = 0;
1255 }
1256
1257 // By default, create a messenger with the `messenger` module.
1258 createMessenger(_messenger2.default);
1259
1260 // Shortcut to dispatch events to our own event bus as if they came from the remote window.
1261 function sendSelf(type, data) {
1262 api.events.send(type, data, window);
1263 }
1264
1265 /**
1266 * Helper method to make the convenience methods for the API, like `onLoad`.
1267 * Can be deprecated in a future release, if everyone likes the `api.events.on('name')` style
1268 * better.
1269 *
1270 * Returns an `unsubscribe` function that unsubscribes the handler without needing access to the
1271 * original event bus.
1272 *
1273 * In dev mode, also includes a secret `__resubscribe` method for reconstructing event buses
1274 * after a file change. All the `module.hot` code is only for dev mode; Webpack strips it for
1275 * production.
1276 */
1277 function subscriptionFactory(type) {
1278 return function (fn) {
1279 function subscribe() {
1280 api.events.on(type, fn);
1281 if (false) {
1282 createMessenger.__handlers[unsubscribe.__id] = { type: type, fn: fn };
1283 }
1284 }
1285 function unsubscribe() {
1286 api.events.off(type, fn);
1287 if (false) {
1288 delete createMessenger.__handlers[unsubscribe.__id];
1289 }
1290 }
1291 if (false) {
1292 createMessenger.__handlerIds += 1;
1293 unsubscribe.__id = 'h' + createMessenger.__handlerIds;
1294 unsubscribe.__resubscribe = subscribe;
1295 }
1296 subscribe();
1297 return unsubscribe;
1298 };
1299 }
1300
1301 /**
1302 * Make the friendly API that subscribes to events.
1303 * Can perhaps be deprecated in the future, though it does return nice objects with an
1304 * `unsubscribe` method.
1305 */
1306 api.onEscapeKey = subscriptionFactory('escapekey');
1307 api.onClickClose = subscriptionFactory('clickclose');
1308 api.onClickAway = subscriptionFactory('clickaway');
1309 api.onSelect = subscriptionFactory('select');
1310 api.onError = subscriptionFactory('error');
1311 api.onLoad = subscriptionFactory('load');
1312 api.onOpen = subscriptionFactory('open');
1313 api.onClose = subscriptionFactory('close');
1314 api.onSelfHelpSearch = subscriptionFactory('selfhelpsearch');
1315
1316 // Internal per-instance flags to allow for asynchronous running of `.load()` and `.open()`.
1317 var frameLoaded = false;
1318 var queuedOpen = false;
1319 var loadTimeoutRef = void 0;
1320
1321 /**
1322 * Create the iframe, append it to the document, and set its src to the sitewidesearchnodeweb URL,
1323 * allowing it to load.
1324 *
1325 * Checks the `queuedOpen` flag to see if it's been set to a DOM event from the past.
1326 * If `queuedOpen` exists, this method also runs `api.open` with the queued event. This enables
1327 * async calling of `.load()` and `.open()`.
1328 */
1329 var load = api.load = function load(overrides) {
1330 clearTimeout(loadTimeoutRef);
1331 frame = doc.createElement('iframe');
1332 frame.onload = function () {
1333 clearTimeout(loadTimeoutRef);
1334 api.events.setRecipient(frame.contentWindow);
1335 frameLoaded = true;
1336 if (queuedOpen) {
1337 api.open(queuedOpen);
1338 queuedOpen = false;
1339 }
1340 sendSelf('load');
1341 };
1342 var frameStyle = config.frameStyle;
1343 var frameAttrs = config.frameAttrs;
1344 var url = config.url;
1345 var src = addUrlParams(url, merge(config.urlParams(), {
1346 id: id,
1347 trafficSource: trafficSource,
1348 customer: customer,
1349 headerHeight: config.headerHeight
1350 }, overrides || {}));
1351 for (var rule in frameStyle) {
1352 if (frameStyle.hasOwnProperty(rule)) {
1353 frame.style[rule] = frameStyle[rule];
1354 }
1355 }
1356 for (var attr in frameAttrs) {
1357 if (frameAttrs.hasOwnProperty(attr)) {
1358 frame.setAttribute(attr, frameAttrs[attr]);
1359 }
1360 }
1361 frame.name = id;
1362 frame.setAttribute('src', src);
1363 doc.body.appendChild(frame);
1364
1365 // Now that frame is appended, time it to make sure it doesn't take forever.'
1366 loadTimeoutRef = setTimeout(function () {
1367 if (!frameLoaded) {
1368 sendSelf('error', {
1369 message: 'Search frame took over ' + loadTimeout / 1000 + 's to load.'
1370 });
1371 doc.body.removeChild(frame);
1372 frame = null;
1373 }
1374 }, loadTimeout);
1375 };
1376
1377 /**
1378 * Open the search frame and display it to the user.
1379 *
1380 * If this method is called before `load()` was ever called, it will call `load()`. (It detects
1381 * this by looking to see if `load()` has assigned the `frame` variable in the local closure to
1382 * an iframe element.)
1383 *
1384 * If this method is called after `load()` was called, it will set the `queuedOpen` flag to its
1385 * associated DOM event, which will trigger another call to `api.open` when the frame is ready.
1386 */
1387 api.open = function open(event) {
1388 if (!frame) {
1389 load();
1390 }
1391 if (!frameLoaded) {
1392 queuedOpen = event || true;
1393 return;
1394 }
1395 var pos = false;
1396
1397 // DetectPosition is being set by ontouchstart event not being present, which triggers desktop positioning
1398 // Adding an additional screen width check for ontouchstart being triggered by desktops to make sure we display desktop
1399 // positioning for those ontouchstart false positives.
1400 var isDesktopWidth = window.screen.width > 768;
1401 if (event && event.target && config.detectPosition || isDesktopWidth) {
1402 var rect = event.target.getBoundingClientRect();
1403 pos = [rect.left + rect.width / 2, 60];
1404 // Position the frame so that its top edge is below the element clicked on.
1405 frame.style.top = pos[1] + 'px';
1406 }
1407 sendSelf('open');
1408 // Bring frame into view by removing huge offset.
1409 frame.style.left = '0';
1410 // Tell frame to gain user input focus.
1411 api.events.send('focus', pos);
1412 // Fade frame in; the CSS `transition` property should ensure that this line of code is all
1413 // that is necessary to do the fade.
1414 frame.style.opacity = 1;
1415 if (frame.contentWindow && frame.contentWindow.focus) {
1416 // In Firefox, an iframe does not capure keyboard control until you `.focus()` the window itself.
1417 frame.contentWindow.focus();
1418 }
1419 };
1420
1421 var close = api.close = function close() {
1422 // Fade frame out; see above.
1423 frame.style.opacity = 0;
1424
1425 /**
1426 * Once frame is faded out, position it so it's out of the way of mouse events.
1427 * Also, tell it to clear out focus and remove any entered query by sending the `reset` event.
1428 */
1429 setTimeout(function () {
1430 api.events.send('reset');
1431 frame.style.left = '-9999px';
1432 sendSelf('close');
1433 }, fadeTimeout);
1434 };
1435
1436 /**
1437 * Disable this API object, remove its connections to the DOM and its event subscriptions.
1438 * It should be garbage collected in the next pass, provided you do not retain any references to
1439 * it. You should never have to manually run this: it's mostly provided for hot module replacement
1440 * in dev mode, but it's certainly possible that some future framework would want to use many
1441 * API objects, and would need to destroy some.
1442 */
1443 api.dispose = function dispose() {
1444 doc.body.removeChild(frame);
1445 api.events.dispose();
1446 frame = null;
1447 frameLoaded = false;
1448 api.disposed = true;
1449 for (var method in api) {
1450 if (api.hasOwnProperty(method) && typeof api[method] === 'function') {
1451 api[method] = disposeWarning(method, id);
1452 }
1453 }
1454 for (var unsub in api.subscriptions) {
1455 api.subscriptions[unsub]();
1456 }
1457 api.subscriptions = {};
1458 api.events = null;
1459 };
1460
1461 /**
1462 * Create a public subscriptions list. These are on the API object so the user can unsubscribe
1463 * them if she wants to.
1464 */
1465
1466 api.subscriptions = {};
1467
1468 // Subscribe the dfeault subscriptions.
1469 if (config.closeOnChose) {
1470 api.subscriptions.closeOnSelect = api.onSelect(close);
1471 }
1472 api.subscriptions.closeOnEscapeKey = api.onEscapeKey(close);
1473 api.subscriptions.closeOnCloseButton = api.onClickClose(close);
1474 api.subscriptions.closeOnClickAway = api.onClickAway(close);
1475
1476 if (!config.lazyLoad) {
1477 load();
1478 }
1479
1480 if (false) {
1481 // Track this instance so it can be recreated if the file is edited and it invalidates.
1482 PaypalSitewideSearch.__instances.push(api);
1483 }
1484
1485 return api;
1486}
1487
1488module.exports = PaypalSitewideSearch;
1489
1490if (false) {
1491 /* eslint-disable no-console */
1492 // tell webpack we can handle changes to this file
1493 module.hot.accept();
1494 // gotta keep track of instances so we can refresh them
1495 PaypalSitewideSearch.__instances = [];
1496 // before reloading this file...
1497 module.hot.dispose(function () {
1498 console.log('embed.js updated; disposing PaypalSitewideSearch instances before reinit');
1499 PaypalSitewideSearch.__instances.forEach(function (instance) {
1500 return instance.dispose();
1501 });
1502 PaypalSitewideSearch.__instances = [];
1503 });
1504 // if messenger, the single dependency we have, reloads...
1505 module.hot.accept('./helpers/messenger', function () {
1506 var newMsngrFac = require('./helpers/messenger').default;
1507 console.log('messenger.js updated; recreating PaypalSitewideSearch instance event buses');
1508 // each instance recreates its messenger and resubscribes events
1509 PaypalSitewideSearch.__instances.forEach(function (instance) {
1510 return instance.__createMessenger(newMsngrFac);
1511 });
1512 });
1513
1514 /* eslint-enable no-console */
1515}
1516
1517// If someone has registered a global callback, call it.
1518if (typeof window[globalCallbackName] === 'function') {
1519 window[globalCallbackName](PaypalSitewideSearch);
1520}
1521
1522/***/ }),
1523/* 2 */
1524/***/ (function(module, exports) {
1525
1526function E () {
1527 // Keep this empty so it's easier to inherit from
1528 // (via https://github.com/lipsmack from https://github.com/scottcorgan/tiny-emitter/issues/3)
1529}
1530
1531E.prototype = {
1532 on: function (name, callback, ctx) {
1533 var e = this.e || (this.e = {});
1534
1535 (e[name] || (e[name] = [])).push({
1536 fn: callback,
1537 ctx: ctx
1538 });
1539
1540 return this;
1541 },
1542
1543 once: function (name, callback, ctx) {
1544 var self = this;
1545 function listener () {
1546 self.off(name, listener);
1547 callback.apply(ctx, arguments);
1548 };
1549
1550 listener._ = callback
1551 return this.on(name, listener, ctx);
1552 },
1553
1554 emit: function (name) {
1555 var data = [].slice.call(arguments, 1);
1556 var evtArr = ((this.e || (this.e = {}))[name] || []).slice();
1557 var i = 0;
1558 var len = evtArr.length;
1559
1560 for (i; i < len; i++) {
1561 evtArr[i].fn.apply(evtArr[i].ctx, data);
1562 }
1563
1564 return this;
1565 },
1566
1567 off: function (name, callback) {
1568 var e = this.e || (this.e = {});
1569 var evts = e[name];
1570 var liveEvents = [];
1571
1572 if (evts && callback) {
1573 for (var i = 0, len = evts.length; i < len; i++) {
1574 if (evts[i].fn !== callback && evts[i].fn._ !== callback)
1575 liveEvents.push(evts[i]);
1576 }
1577 }
1578
1579 // Remove event from queue to prevent memory leak
1580 // Suggested by https://github.com/lazd
1581 // Ref: https://github.com/scottcorgan/tiny-emitter/commit/c6ebfaa9bc973b33d110a84a307742b7cf94c953#commitcomment-5024910
1582
1583 (liveEvents.length)
1584 ? e[name] = liveEvents
1585 : delete e[name];
1586
1587 return this;
1588 }
1589};
1590
1591module.exports = E;
1592
1593
1594/***/ })
1595/******/ ]);