Backup_Repos/filestash
1
0
Fork 0
mirror of https://github.com/mickael-kerjean/filestash synced 2025-12-25 17:53:56 +01:00
Code Issues Projects Releases Wiki Activity

maintenance (iframe): content security policy update

Browse source
This commit is contained in:
Mickael Kerjean 2021-08-22 23:59:21 +10:00
parent 51ed97cc9d
commit 929064b55f
2 changed files with 4 additions and 20 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

4
server/common/config.go
View file

@ -617,6 +617,10 @@ func PerformMigration() (err error) {
Log.Stdout("BOOT Migration error: hide_menubar")
return err
}
if jsonStr, err = sjson.Delete(jsonStr, "features.protection.iframe"); err != nil {
Log.Stdout("BOOT Migration error: features.protection.iframe")
return err
}
if err = saveConfig(schemaVersion+1, jsonStr); err != nil {
Log.Stdout("BOOT Couldn't save config")
return err

20
server/middleware/http.go
View file

@ -4,7 +4,6 @@ import (
"fmt"
. "github.com/mickael-kerjean/filestash/server/common"
"net/http"
"os"
"path/filepath"
)
@ -59,25 +58,6 @@ func IndexHeaders(fn func(App, http.ResponseWriter, *http.Request)) func(ctx App
cspHeader += "worker-src 'self' blob:; "
cspHeader += "form-action 'self'; base-uri 'self'; "
cspHeader += "frame-src 'self'; "
if allowedDomainsForIframe := Config.Get("features.protection.iframe").Schema(func(f *FormElement) *FormElement {
if f == nil {
f = &FormElement{}
}
f.Default = ""
f.Placeholder = "Default: disabled"
if envValue := os.Getenv("FEATURES_IFRAME_PROTECTION"); envValue != "" {
f.Default = envValue
f.Placeholder = "Default: " + envValue
}
f.Name = "iframe"
f.Type = "text"
f.Target = []string{}
f.Description = "The frame-ancestors's value as part of the Content Security Policy header. Use with caution, this setting can make you vulnerable to clicjacking security issues."
return f
}).String(); allowedDomainsForIframe != "" {
cspHeader += "frame-ancestors " + allowedDomainsForIframe
}
header.Set("Content-Security-Policy", cspHeader)
fn(ctx, res, req)
}