dani/lemonldap-ng
1
0
Fork 0
Code Issues Pull Requests Packages Projects Releases Wiki Activity

WIP - Add CSP form-action attribute in LLNG conf. Need more tests (#1480)

Browse Source
This commit is contained in:
Christophe Maudoux 2018-08-07 23:54:42 +02:00
parent 8b94550e79
commit 6619e56714
8 changed files with 16 additions and 3 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

1
lemonldap-ng-common/lib/Lemonldap/NG/Common/Conf/DefaultValues.pm
View File

@ -31,6 +31,7 @@ sub defaultValues {
'cspConnect' => '\'self\'',
'cspDefault' => '\'self\'',
'cspFont' => '\'self\'',
'cspFormAction' => '\'self\'',
'cspImg' => '\'self\' data:',
'cspScript' => '\'self\'',
'cspStyle' => '\'self\'',

4
lemonldap-ng-manager/lib/Lemonldap/NG/Manager/Attributes.pm
View File

@ -907,6 +907,10 @@ qr/(?:(?:https?):\/\/(?:(?:(?:(?:(?:(?:[a-zA-Z0-9][-a-zA-Z0-9]*)?[a-zA-Z0-9])[.]
'default' => '\'self\'',
'type' => 'text'
},
'cspFormAction' => {
'default' => '\'self\'',
'type' => 'text'
},
'cspImg' => {
'default' => '\'self\' data:',
'type' => 'text'

5
lemonldap-ng-manager/lib/Lemonldap/NG/Manager/Build/Attributes.pm
View File

@ -599,6 +599,11 @@ sub attributes {
default => "'self'",
documentation => 'Font source for Content-Security-Policy',
},
cspFormAction => {
type => 'text',
default => "'self'",
documentation => 'Form-Action source for Content-Security-Policy',
},
portalAntiFrame => {
default => 1,
type => 'bool',

1
lemonldap-ng-manager/lib/Lemonldap/NG/Manager/Build/Tree.pm
View File

@ -736,6 +736,7 @@ sub tree {
'cspDefault', 'cspImg',
'cspScript', 'cspStyle',
'cspConnect', 'cspFont',
'cspFormAction',
]
},
'requireToken',

2
lemonldap-ng-manager/site/htdocs/static/reverseTree.json
View File

File diff suppressed because one or more lines are too long

2
lemonldap-ng-manager/site/htdocs/static/struct.json
View File

File diff suppressed because one or more lines are too long

1
lemonldap-ng-portal/lib/Lemonldap/NG/Portal/Main/Init.pm
View File

@ -174,6 +174,7 @@ sub reloadConf {
my $prm = $self->conf->{ 'csp' . ucfirst($_) };
$csp .= "$_-src $prm;" if ($prm);
}
$csp = $csp . "form-action 'self' " . $self->conf->{ cspFormAction };
$self->csp($csp);
# Initialize templateDir

3
lemonldap-ng-portal/lib/Lemonldap/NG/Portal/Main/Run.pm
View File

@ -723,7 +723,8 @@ sub sendHtml {
'X-Content-Type-Options' => 'nosniff';
# Set authorizated URL for POST
my $csp = $self->csp . "form-action 'self'";
#my $csp = $self->csp . "form-action 'self'";
my $csp = $self->csp;
if ( my $url = $req->urldc ) {
$url =~ s#(https?://[^/]+).*#$1#;
$csp .= " $url";