From 0263865faa26271e000c7334465ee6723e0fdab1 Mon Sep 17 00:00:00 2001
From: Maxime Besson <maxime.besson@worteks.com>
Date: Thu, 12 Nov 2020 14:34:16 +0100
Subject: [PATCH] Add CORS headers to error pages (#2380)

---
 .../lib/Lemonldap/NG/Common/PSGI.pm           | 27 ++++++++++++-------
 .../lib/Lemonldap/NG/Portal/Main/Run.pm       | 12 +++++++++
 .../t/01-CSP-and-CORS-headers.t               |  8 ++++++
 3 files changed, 38 insertions(+), 9 deletions(-)
diff --git a/lemonldap-ng-common/lib/Lemonldap/NG/Common/PSGI.pm b/lemonldap-ng-common/lib/Lemonldap/NG/Common/PSGI.pm
index 01241ece0..bbb722e1c 100644
--- a/lemonldap-ng-common/lib/Lemonldap/NG/Common/PSGI.pm
+++ b/lemonldap-ng-common/lib/Lemonldap/NG/Common/PSGI.pm
@@ -191,6 +191,8 @@ sub sendError {
             : $code == 400 ? 'Bad request'
             :                'Error'
         );
+
+        # TODO: this should probably use a template instead
         my $s = "<html><head><title>$title</title>
 <style>
 body{background:#000;color:#fff;padding:10px 50px;font-family:sans-serif;}a{text-decoration:none;color:#fff;}h1{text-align:center;}
@@ -202,18 +204,25 @@ body{background:#000;color:#fff;padding:10px 50px;font-family:sans-serif;}a{text
 <center><a href=\"https://lemonldap-ng.org\">LemonLDAP::NG</a></center>
 </body>
 </html>";
-        return [
-            $code,
-            [
-                'Content-Type'   => 'text/html; charset=utf-8',
-                'Content-Length' => length($s),
-                $req->spliceHdrs,
-            ],
-            [$s]
-        ];
+        return $self->sendRawHtml( $req, $s, code => $code );
     }
 }
 
+sub sendRawHtml {
+    my ( $self, $req, $s, %args ) = @_;
+    my $code    = $args{code}    || 200;
+    my $headers = $args{headers} || [ $req->spliceHdrs ];
+    return [
+        $code,
+        [
+            'Content-Type'   => 'text/html; charset=utf-8',
+            'Content-Length' => length($s),
+            @{$headers},
+        ],
+        [$s]
+    ];
+}
+
 sub abort {
     my ( $self, $err ) = @_;
     eval { $self->logger->error($err) };
diff --git a/lemonldap-ng-portal/lib/Lemonldap/NG/Portal/Main/Run.pm b/lemonldap-ng-portal/lib/Lemonldap/NG/Portal/Main/Run.pm
index ca5644298..73f6a96d5 100644
--- a/lemonldap-ng-portal/lib/Lemonldap/NG/Portal/Main/Run.pm
+++ b/lemonldap-ng-portal/lib/Lemonldap/NG/Portal/Main/Run.pm
@@ -1140,6 +1140,18 @@ sub sendJSONresponse {
     return $res;
 }
 
+sub sendRawHtml {
+    my ($self) = $_[0];
+    my $res = Lemonldap::NG::Common::PSGI::sendRawHtml(@_);
+    if ( $self->conf->{corsEnabled} ) {
+        my @cors = split /;/, $self->cors;
+        push @{ $res->[1] }, @cors;
+        $self->logger->debug('Apply following CORS policy :');
+        $self->logger->debug(" $_") for @cors;
+    }
+    return $res;
+}
+
 # Temlate loader
 sub loadTemplate {
     my ( $self, $req, $name, %prm ) = @_;
diff --git a/lemonldap-ng-portal/t/01-CSP-and-CORS-headers.t b/lemonldap-ng-portal/t/01-CSP-and-CORS-headers.t
index 2324a3a20..cdf1c2629 100644
--- a/lemonldap-ng-portal/t/01-CSP-and-CORS-headers.t
+++ b/lemonldap-ng-portal/t/01-CSP-and-CORS-headers.t
@@ -15,6 +15,8 @@ my $client = LLNG::Manager::Test->new( {
             cspFormAction     => '*',
             cspFrameAncestors => 'test.example.com',
             customToTrace     => 'mail',
+            checkStateSecret  => 'x',
+            checkState        => 1,
         }
     }
 );
@@ -38,6 +40,12 @@ ok(
 count(1);
 expectReject($res);
 
+# sendError (#2380)
+ok( $res = $client->_get( '/checkstate', accept => 'text/html' ),
+    'Get error page' );
+count(1);
+checkCorsPolicy($res);
+
 ok( $res = $client->_options( '/', accept => 'text/html' ), 'Get Menu' );
 count(1);
 
