Sutty/trabajo-afectivo
5
0
Fork 0
Code Issues Pull requests Projects Releases Wiki Activity

Maintenance: Add Content Security Policy.

Browse source
This commit is contained in:
Thorsten Eckel 2020-02-13 09:35:58 +01:00
parent 33498bac91
commit 49b0ca4d58
38 changed files with 184 additions and 129 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

5
app/assets/javascripts/app/controllers/ticket_zoom/article_new.coffee
View file

@ -132,7 +132,10 @@ class App.TicketZoomArticleNew extends App.Controller
textRange.select() textRange.select()
isIE10: -> isIE10: ->
Function('/*@cc_on return document.documentMode===10@*/')() detected = App.Browser.detection()
return false if !detected.browser
return false if detected.browser.name != 'Explorer'
return detected.browser.major == 10
release: => release: =>
if @subscribeIdTextModule if @subscribeIdTextModule

7
app/assets/javascripts/app/controllers/ticket_zoom/article_view.coffee
View file

@ -134,7 +134,12 @@ class ArticleViewItem extends App.ObserverController
attachments = App.TicketArticle.contentAttachments(article) attachments = App.TicketArticle.contentAttachments(article)
if article.attachments if article.attachments
for attachment in article.attachments for attachment in article.attachments
attachment.url = "#{App.Config.get('api_path')}/ticket_attachment/#{article.ticket_id}/#{article.id}/#{attachment.id}?disposition=attachment"
dispositionParams = ''
if attachment?.preferences['Content-Type'] isnt 'application/pdf' && attachment?.preferences['Content-Type'] isnt 'text/html'
dispositionParams = '?disposition=attachment'
attachment.url = "#{App.Config.get('api_path')}/ticket_attachment/#{article.ticket_id}/#{article.id}/#{attachment.id}#{dispositionParams}"
attachment.preview_url = "#{App.Config.get('api_path')}/ticket_attachment/#{article.ticket_id}/#{article.id}/#{attachment.id}?view=preview" attachment.preview_url = "#{App.Config.get('api_path')}/ticket_attachment/#{article.ticket_id}/#{article.id}/#{attachment.id}?view=preview"
if attachment && attachment.preferences && attachment.preferences['original-format'] is true if attachment && attachment.preferences && attachment.preferences['original-format'] is true

31
app/assets/javascripts/app/controllers/widget/translation_inline.coffee
View file

@ -47,6 +47,33 @@ class Widget extends App.Controller
# enable translation inline # enable translation inline
App.Config.set('translation_inline', true) App.Config.set('translation_inline', true)
@observer = new MutationObserver((mutations) ->
mutations.forEach((mutation) ->
mutation.addedNodes.forEach((addedNode) ->
$(addedNode).find('span.translation').on('click.translation', (e) ->
e.stopPropagation()
return false
)
$(addedNode).find('span.translation').on('keydown.translation', (e) ->
e.stopPropagation()
return true
)
)
mutation.removedNodes.forEach((removedNode) ->
$(removedNode).find('span.translation').off('.translation')
)
)
)
@observer.observe(document.body, {
subtree: true,
childList: true,
})
# rerender controllers # rerender controllers
App.Event.trigger('ui:rerender') App.Event.trigger('ui:rerender')
@ -93,7 +120,9 @@ class Widget extends App.Controller
element element
disable: -> disable: ->
$('body').off('focus.translation blur.translation') @observer.disconnect()
$('body').off('.translation')
# disable translation inline # disable translation inline
App.Config.set('translation_inline', false) App.Config.set('translation_inline', false)

2
app/assets/javascripts/app/lib/app_post/i18n.coffee
View file

@ -247,7 +247,7 @@ class _i18nSingleton extends Spine.Module
return string if !string return string if !string
if App.Config.get('translation_inline') if App.Config.get('translation_inline')
return '<span class="translation" onkeydown="arguments[0].stopPropagation(); return true" onclick="arguments[0].stopPropagation(); return false" contenteditable="true" title="' + App.Utils.htmlEscape(string) + '">' + App.Utils.htmlEscape(@translate(string)) + '</span>' return '<span class="translation" contenteditable="true" title="' + App.Utils.htmlEscape(string) + '">' + App.Utils.htmlEscape(@translate(string)) + '</span>'
translated = @translate(string, args, true, true) translated = @translate(string, args, true, true)

1
app/assets/javascripts/app/lib/mixins/view_helpers.coffee
View file

@ -193,6 +193,7 @@ App.ViewHelpers =
canDownload: (contentType) -> canDownload: (contentType) ->
contentType = App.Utils.contentTypeCleanup(contentType) contentType = App.Utils.contentTypeCleanup(contentType)
return false if contentType is 'application/pdf'
contentType != 'text/html' contentType != 'text/html'
canPreview: (contentType) -> canPreview: (contentType) ->

1
app/controllers/application_controller.rb
View file

@ -10,6 +10,7 @@ class ApplicationController < ActionController::Base
include ApplicationController::HasUser include ApplicationController::HasUser
include ApplicationController::HasResponseExtentions include ApplicationController::HasResponseExtentions
include ApplicationController::PreventsCsrf include ApplicationController::PreventsCsrf
include ApplicationController::HasSecureContentSecurityPolicyForDownloads
include ApplicationController::LogsHttpAccess include ApplicationController::LogsHttpAccess
include ApplicationController::ChecksAccess include ApplicationController::ChecksAccess
end end

23
app/controllers/application_controller/has_secure_content_security_policy_for_downloads.rb Normal file
View file

@ -0,0 +1,23 @@
module ApplicationController::HasSecureContentSecurityPolicyForDownloads
extend ActiveSupport::Concern
included do
around_action do |_controller, block|
subscriber = proc do
policy = ActionDispatch::ContentSecurityPolicy.new
policy.default_src :none
policy.plugin_types 'application/pdf'
request.content_security_policy = policy
end
ActiveSupport::Notifications.subscribed(subscriber, 'send_file.action_controller') do
ActiveSupport::Notifications.subscribed(subscriber, 'send_data.action_controller') do
block.call
end
end
end
end
end

6
app/views/init/index.html.erb
View file

@ -1,5 +1,5 @@
<!-- svgstore fallback --> <!-- svgstore fallback -->
<script> <%= javascript_tag nonce: true do -%>
/* /*
detect if browser is detect if browser is
- Chrome 14-20 - Chrome 14-20
@ -27,9 +27,9 @@
xhr.open('get', 'assets/images/icons.svg', true) xhr.open('get', 'assets/images/icons.svg', true)
xhr.send() xhr.send()
})(document) })(document)
</script> <% end -%>
<div id="app"></div> <div id="app"></div>
<div class="splash"> <div class="splash">
<svg class="icon icon-logo"><use xlink:href="assets/images/icons.svg#icon-logo" /></svg> <svg class="icon icon-logo"><use xlink:href="assets/images/icons.svg#icon-logo" /></svg>
<div class="splash-title">Loading...</div> <div class="splash-title">Loading...</div>
</div> </div>

4
app/views/layouts/application.html.erb
View file

@ -9,9 +9,9 @@
<%= stylesheet_link_tag "application", :media => 'all' %> <%= stylesheet_link_tag "application", :media => 'all' %>
<%= stylesheet_link_tag "application-print", :media => 'print' %> <%= stylesheet_link_tag "application-print", :media => 'print' %>
<% if Rails.configuration.assets.debug %> <% if Rails.configuration.assets.debug %>
<%= javascript_include_tag "application" %> <%= javascript_include_tag "application", nonce: true %>
<% else %> <% else %>
<%= javascript_include_tag "application", :defer => 'defer' %> <%= javascript_include_tag "application", nonce: true, :defer => 'defer' %>
<% end %> <% end %>
<%= csrf_meta_tags %> <%= csrf_meta_tags %>
</head> </head>

11
app/views/layouts/knowledge_base.html.erb
View file

@ -70,10 +70,13 @@
</footer> </footer>
</div> </div>
<script type='text/javascript'> <%= javascript_tag nonce: true do -%>
if(window.fetch === undefined || window.Promise === undefined || Element.prototype.prepend === undefined){ if(window.fetch === undefined || window.Promise === undefined || Element.prototype.prepend === undefined){
document.write('<script src="<%= path_to_javascript('knowledge_base_public_polyfills') %>"><\/script>') var polyfillScriptTag = document.createElement('script');
polyfillScriptTag.setAttribute('src', '<%= path_to_javascript('knowledge_base_public_polyfills') %>');
polyfillScriptTag.setAttribute('nonce', '<%= content_security_policy_nonce %>');
document.body.appendChild(polyfillScriptTag);
} }
</script> <% end -%>
<%= javascript_include_tag 'knowledge_base_public' %> <%= javascript_include_tag 'knowledge_base_public', nonce: true %>

8
app/views/tests/color_object.html.erb
View file

@ -1,7 +1,5 @@
<link rel="stylesheet" href="/assets/tests/qunit-1.21.0.css"> <link rel="stylesheet" href="/assets/tests/qunit-1.21.0.css">
<script src="/assets/tests/qunit-1.21.0.js"></script> <%= javascript_include_tag "/assets/tests/qunit-1.21.0.js", "/assets/tests/color_object.js", nonce: true %>
<script src="/assets/tests/color_object.js"></script>
<style type="text/css"> <style type="text/css">
body { body {
@ -9,7 +7,7 @@ body {
} }
</style> </style>
<script type="text/javascript"> <%= javascript_tag nonce: true do -%>
</script> <% end -%>
<div id="qunit" class="u-dontfold"></div> <div id="qunit" class="u-dontfold"></div>

8
app/views/tests/core.html.erb
View file

@ -1,7 +1,5 @@
<link rel="stylesheet" href="/assets/tests/qunit-1.21.0.css"> <link rel="stylesheet" href="/assets/tests/qunit-1.21.0.css">
<script src="/assets/tests/qunit-1.21.0.js"></script> <%= javascript_include_tag "/assets/tests/qunit-1.21.0.js", "/assets/tests/core.js", nonce: true %>
<script src="/assets/tests/core.js"></script>
<style type="text/css"> <style type="text/css">
body { body {
@ -9,8 +7,8 @@ body {
} }
</style> </style>
<script type="text/javascript"> <%= javascript_tag nonce: true do -%>
</script> <% end -%>
<div id="qunit" class="u-dontfold"></div> <div id="qunit" class="u-dontfold"></div>

7
app/views/tests/form.html.erb
View file

@ -1,7 +1,6 @@
<link rel="stylesheet" href="/assets/tests/qunit-1.21.0.css"> <link rel="stylesheet" href="/assets/tests/qunit-1.21.0.css">
<script src="/assets/tests/qunit-1.21.0.js"></script> <%= javascript_include_tag "/assets/tests/qunit-1.21.0.js", "/assets/tests/form.js", nonce: true %>
<script src="/assets/tests/form.js"></script>
<style type="text/css"> <style type="text/css">
body { body {
@ -9,8 +8,8 @@ body {
} }
</style> </style>
<script type="text/javascript"> <%= javascript_tag nonce: true do -%>
</script> <% end -%>
<div id="qunit" class="u-dontfold"></div> <div id="qunit" class="u-dontfold"></div>

9
app/views/tests/form_color.html.erb
View file

@ -1,8 +1,5 @@
<link rel="stylesheet" href="/assets/tests/qunit-1.21.0.css"> <link rel="stylesheet" href="/assets/tests/qunit-1.21.0.css">
<script src="/assets/tests/qunit-1.21.0.js"></script> <%= javascript_include_tag "/assets/tests/qunit-1.21.0.js", "/assets/tests/syn-0.14.1.js", "/assets/tests/form_color.js", nonce: true %>
<script src="/assets/tests/syn-0.14.1.js"></script>
<script src="/assets/tests/form_color.js"></script>
<style type="text/css"> <style type="text/css">
body { body {
@ -10,8 +7,8 @@ body {
} }
</style> </style>
<script type="text/javascript"> <%= javascript_tag nonce: true do -%>
</script> <% end -%>
<div id="qunit" class="u-dontfold"></div> <div id="qunit" class="u-dontfold"></div>

7
app/views/tests/form_column_select.html.erb
View file

@ -1,7 +1,6 @@
<link rel="stylesheet" href="/assets/tests/qunit-1.21.0.css"> <link rel="stylesheet" href="/assets/tests/qunit-1.21.0.css">
<script src="/assets/tests/qunit-1.21.0.js"></script> <%= javascript_include_tag "/assets/tests/qunit-1.21.0.js", "/assets/tests/form_column_select.js", nonce: true %>
<script src="/assets/tests/form_column_select.js"></script>
<style type="text/css"> <style type="text/css">
body { body {
@ -9,8 +8,8 @@ body {
} }
</style> </style>
<script type="text/javascript"> <%= javascript_tag nonce: true do -%>
</script> <% end -%>
<div id="qunit" class="u-dontfold"></div> <div id="qunit" class="u-dontfold"></div>

7
app/views/tests/form_extended.html.erb
View file

@ -1,7 +1,6 @@
<link rel="stylesheet" href="/assets/tests/qunit-1.21.0.css"> <link rel="stylesheet" href="/assets/tests/qunit-1.21.0.css">
<script src="/assets/tests/qunit-1.21.0.js"></script> <%= javascript_include_tag "/assets/tests/qunit-1.21.0.js", "/assets/tests/form_extended.js", nonce: true %>
<script src="/assets/tests/form_extended.js"></script>
<style type="text/css"> <style type="text/css">
body { body {
@ -9,8 +8,8 @@ body {
} }
</style> </style>
<script type="text/javascript"> <%= javascript_tag nonce: true do -%>
</script> <% end -%>
<div id="qunit" class="u-dontfold"></div> <div id="qunit" class="u-dontfold"></div>

7
app/views/tests/form_find.html.erb
View file

@ -1,7 +1,6 @@
<link rel="stylesheet" href="/assets/tests/qunit-1.21.0.css"> <link rel="stylesheet" href="/assets/tests/qunit-1.21.0.css">
<script src="/assets/tests/qunit-1.21.0.js"></script> <%= javascript_include_tag "/assets/tests/qunit-1.21.0.js", "/assets/tests/form_find.js", nonce: true %>
<script src="/assets/tests/form_find.js"></script>
<style type="text/css"> <style type="text/css">
body { body {
@ -9,8 +8,8 @@ body {
} }
</style> </style>
<script type="text/javascript"> <%= javascript_tag nonce: true do -%>
</script> <% end -%>
<div id="qunit" class="u-dontfold"></div> <div id="qunit" class="u-dontfold"></div>

7
app/views/tests/form_searchable_select.html.erb
View file

@ -1,7 +1,6 @@
<link rel="stylesheet" href="/assets/tests/qunit-1.21.0.css"> <link rel="stylesheet" href="/assets/tests/qunit-1.21.0.css">
<script src="/assets/tests/qunit-1.21.0.js"></script> <%= javascript_include_tag "/assets/tests/qunit-1.21.0.js", "/assets/tests/form_searchable_select.js", nonce: true %>
<script src="/assets/tests/form_searchable_select.js"></script>
<style type="text/css"> <style type="text/css">
body { body {
@ -9,8 +8,8 @@ body {
} }
</style> </style>
<script type="text/javascript"> <%= javascript_tag nonce: true do -%>
</script> <% end -%>
<div id="qunit" class="u-dontfold"></div> <div id="qunit" class="u-dontfold"></div>

7
app/views/tests/form_ticket_perform_action.html.erb
View file

@ -1,7 +1,6 @@
<link rel="stylesheet" href="/assets/tests/qunit-1.21.0.css"> <link rel="stylesheet" href="/assets/tests/qunit-1.21.0.css">
<script src="/assets/tests/qunit-1.21.0.js"></script> <%= javascript_include_tag "/assets/tests/qunit-1.21.0.js", "/assets/tests/form_ticket_perform_action.js", nonce: true %>
<script src="/assets/tests/form_ticket_perform_action.js"></script>
<style type="text/css"> <style type="text/css">
body { body {
@ -9,8 +8,8 @@ body {
} }
</style> </style>
<script type="text/javascript"> <%= javascript_tag nonce: true do -%>
</script> <% end -%>
<div id="qunit" class="u-dontfold"></div> <div id="qunit" class="u-dontfold"></div>

7
app/views/tests/form_timer.html.erb
View file

@ -1,7 +1,6 @@
<link rel="stylesheet" href="/assets/tests/qunit-1.21.0.css"> <link rel="stylesheet" href="/assets/tests/qunit-1.21.0.css">
<script src="/assets/tests/qunit-1.21.0.js"></script> <%= javascript_include_tag "/assets/tests/qunit-1.21.0.js", "/assets/tests/form_timer.js", nonce: true %>
<script src="/assets/tests/form_timer.js"></script>
<style type="text/css"> <style type="text/css">
body { body {
@ -9,8 +8,8 @@ body {
} }
</style> </style>
<script type="text/javascript"> <%= javascript_tag nonce: true do -%>
</script> <% end -%>
<div id="qunit" class="u-dontfold"></div> <div id="qunit" class="u-dontfold"></div>

7
app/views/tests/form_tree_select.html.erb
View file

@ -1,7 +1,6 @@
<link rel="stylesheet" href="/assets/tests/qunit-1.21.0.css"> <link rel="stylesheet" href="/assets/tests/qunit-1.21.0.css">
<script src="/assets/tests/qunit-1.21.0.js"></script> <%= javascript_include_tag "/assets/tests/qunit-1.21.0.js", "/assets/tests/form_tree_select.js", nonce: true %>
<script src="/assets/tests/form_tree_select.js"></script>
<style type="text/css"> <style type="text/css">
body { body {
@ -9,8 +8,8 @@ body {
} }
</style> </style>
<script type="text/javascript"> <%= javascript_tag nonce: true do -%>
</script> <% end -%>
<div id="qunit" class="u-dontfold"></div> <div id="qunit" class="u-dontfold"></div>

7
app/views/tests/form_trim.html.erb
View file

@ -1,7 +1,6 @@
<link rel="stylesheet" href="/assets/tests/qunit-1.21.0.css"> <link rel="stylesheet" href="/assets/tests/qunit-1.21.0.css">
<script src="/assets/tests/qunit-1.21.0.js"></script> <%= javascript_include_tag "/assets/tests/qunit-1.21.0.js", "/assets/tests/form_trim.js", nonce: true %>
<script src="/assets/tests/form_trim.js"></script>
<style type="text/css"> <style type="text/css">
body { body {
@ -9,8 +8,8 @@ body {
} }
</style> </style>
<script type="text/javascript"> <%= javascript_tag nonce: true do -%>
</script> <% end -%>
<div id="qunit" class="u-dontfold"></div> <div id="qunit" class="u-dontfold"></div>

9
app/views/tests/form_validation.html.erb
View file

@ -1,7 +1,6 @@
<link rel="stylesheet" href="/assets/tests/qunit-1.21.0.css"> <link rel="stylesheet" href="/assets/tests/qunit-1.21.0.css">
<script src="/assets/tests/qunit-1.21.0.js"></script> <%= javascript_include_tag "/assets/tests/qunit-1.21.0.js", "/assets/tests/form_validation.js", nonce: true %>
<script src="/assets/tests/form_validation.js"></script>
<style type="text/css"> <style type="text/css">
body { body {
@ -9,8 +8,8 @@ body {
} }
</style> </style>
<script type="text/javascript"> <%= javascript_tag nonce: true do -%>
</script> <% end -%>
<div id="qunit" class="u-dontfold"></div> <div id="qunit" class="u-dontfold"></div>
@ -19,4 +18,4 @@ body {
<div id="forms"></div> <div id="forms"></div>
<button type="submit" class="btn btn-primary submit">Submit</button> <button type="submit" class="btn btn-primary submit">Submit</button>
</form> </form>
</div> </div>

7
app/views/tests/html_utils.html.erb
View file

@ -1,7 +1,6 @@
<link rel="stylesheet" href="/assets/tests/qunit-1.21.0.css"> <link rel="stylesheet" href="/assets/tests/qunit-1.21.0.css">
<script src="/assets/tests/qunit-1.21.0.js"></script> <%= javascript_include_tag "/assets/tests/qunit-1.21.0.js", "/assets/tests/html_utils.js", nonce: true %>
<script src="/assets/tests/html_utils.js"></script>
<style type="text/css"> <style type="text/css">
body { body {
@ -9,8 +8,8 @@ body {
} }
</style> </style>
<script type="text/javascript"> <%= javascript_tag nonce: true do -%>
</script> <% end -%>
<div id="qunit" class="u-dontfold"></div> <div id="qunit" class="u-dontfold"></div>

7
app/views/tests/i18n.html.erb
View file

@ -1,6 +1,5 @@
<link rel="stylesheet" href="/assets/tests/qunit-1.21.0.css"> <link rel="stylesheet" href="/assets/tests/qunit-1.21.0.css">
<script src="/assets/tests/qunit-1.21.0.js"></script> <%= javascript_include_tag "/assets/tests/qunit-1.21.0.js", "/assets/tests/i18n.js", nonce: true %>
<script src="/assets/tests/i18n.js"></script>
<style type="text/css"> <style type="text/css">
body { body {
@ -8,7 +7,7 @@ body {
} }
</style> </style>
<script type="text/javascript"> <%= javascript_tag nonce: true do -%>
</script> <% end -%>
<div id="qunit" class="u-dontfold"></div> <div id="qunit" class="u-dontfold"></div>

7
app/views/tests/local_storage.html.erb
View file

@ -1,7 +1,6 @@
<link rel="stylesheet" href="/assets/tests/qunit-1.21.0.css"> <link rel="stylesheet" href="/assets/tests/qunit-1.21.0.css">
<script src="/assets/tests/qunit-1.21.0.js"></script> <%= javascript_include_tag "/assets/tests/qunit-1.21.0.js", "/assets/tests/local_storage.js", nonce: true %>
<script src="/assets/tests/local_storage.js"></script>
<style type="text/css"> <style type="text/css">
body { body {
@ -9,8 +8,8 @@ body {
} }
</style> </style>
<script type="text/javascript"> <%= javascript_tag nonce: true do -%>
</script> <% end -%>
<div id="qunit" class="u-dontfold"></div> <div id="qunit" class="u-dontfold"></div>

7
app/views/tests/model.html.erb
View file

@ -1,7 +1,6 @@
<link rel="stylesheet" href="/assets/tests/qunit-1.21.0.css"> <link rel="stylesheet" href="/assets/tests/qunit-1.21.0.css">
<script src="/assets/tests/qunit-1.21.0.js"></script> <%= javascript_include_tag "/assets/tests/qunit-1.21.0.js", "/assets/tests/model.js", nonce: true %>
<script src="/assets/tests/model.js"></script>
<style type="text/css"> <style type="text/css">
body { body {
@ -9,8 +8,8 @@ body {
} }
</style> </style>
<script type="text/javascript"> <%= javascript_tag nonce: true do -%>
</script> <% end -%>
<div id="qunit" class="u-dontfold"></div> <div id="qunit" class="u-dontfold"></div>

7
app/views/tests/model_binding.html.erb
View file

@ -1,7 +1,6 @@
<link rel="stylesheet" href="/assets/tests/qunit-1.21.0.css"> <link rel="stylesheet" href="/assets/tests/qunit-1.21.0.css">
<script src="/assets/tests/qunit-1.21.0.js"></script> <%= javascript_include_tag "/assets/tests/qunit-1.21.0.js", "/assets/tests/model_binding.js", nonce: true %>
<script src="/assets/tests/model_binding.js"></script>
<style type="text/css"> <style type="text/css">
body { body {
@ -9,8 +8,8 @@ body {
} }
</style> </style>
<script type="text/javascript"> <%= javascript_tag nonce: true do -%>
</script> <% end -%>
<div id="qunit" class="u-dontfold"></div> <div id="qunit" class="u-dontfold"></div>

7
app/views/tests/model_ticket.html.erb
View file

@ -1,7 +1,6 @@
<link rel="stylesheet" href="/assets/tests/qunit-1.21.0.css"> <link rel="stylesheet" href="/assets/tests/qunit-1.21.0.css">
<script src="/assets/tests/qunit-1.21.0.js"></script> <%= javascript_include_tag "/assets/tests/qunit-1.21.0.js", "/assets/tests/model_ticket.js", nonce: true %>
<script src="/assets/tests/model_ticket.js"></script>
<style type="text/css"> <style type="text/css">
body { body {
@ -9,8 +8,8 @@ body {
} }
</style> </style>
<script type="text/javascript"> <%= javascript_tag nonce: true do -%>
</script> <% end -%>
<div id="qunit" class="u-dontfold"></div> <div id="qunit" class="u-dontfold"></div>

7
app/views/tests/model_ui.html.erb
View file

@ -1,7 +1,6 @@
<link rel="stylesheet" href="/assets/tests/qunit-1.21.0.css"> <link rel="stylesheet" href="/assets/tests/qunit-1.21.0.css">
<script src="/assets/tests/qunit-1.21.0.js"></script> <%= javascript_include_tag "/assets/tests/qunit-1.21.0.js", "/assets/tests/model_ui.js", nonce: true %>
<script src="/assets/tests/model_ui.js"></script>
<style type="text/css"> <style type="text/css">
body { body {
@ -9,7 +8,7 @@ body {
} }
</style> </style>
<script type="text/javascript"> <%= javascript_tag nonce: true do -%>
</script> <% end -%>
<div id="qunit" class="u-dontfold"></div> <div id="qunit" class="u-dontfold"></div>

7
app/views/tests/session.html.erb
View file

@ -1,7 +1,6 @@
<link rel="stylesheet" href="/assets/tests/qunit-1.21.0.css"> <link rel="stylesheet" href="/assets/tests/qunit-1.21.0.css">
<script src="/assets/tests/qunit-1.21.0.js"></script> <%= javascript_include_tag "/assets/tests/qunit-1.21.0.js", "/assets/tests/session.js", nonce: true %>
<script src="/assets/tests/session.js"></script>
<style type="text/css"> <style type="text/css">
body { body {
@ -9,8 +8,8 @@ body {
} }
</style> </style>
<script type="text/javascript"> <%= javascript_tag nonce: true do -%>
</script> <% end -%>
<div id="qunit" class="u-dontfold"></div> <div id="qunit" class="u-dontfold"></div>

9
app/views/tests/table.html.erb
View file

@ -1,7 +1,6 @@
<link rel="stylesheet" href="/assets/tests/qunit-1.21.0.css"> <link rel="stylesheet" href="/assets/tests/qunit-1.21.0.css">
<script src="/assets/tests/qunit-1.21.0.js"></script> <%= javascript_include_tag "/assets/tests/qunit-1.21.0.js", "/assets/tests/table.js", nonce: true %>
<script src="/assets/tests/table.js"></script>
<style type="text/css"> <style type="text/css">
body { body {
@ -9,9 +8,9 @@ body {
} }
</style> </style>
<script type="text/javascript"> <%= javascript_tag nonce: true do -%>
</script> <% end -%>
<div id="qunit" class="u-dontfold"></div> <div id="qunit" class="u-dontfold"></div>
<div id="table"></div> <div id="table"></div>

9
app/views/tests/table_extended.html.erb
View file

@ -1,7 +1,6 @@
<link rel="stylesheet" href="/assets/tests/qunit-1.21.0.css"> <link rel="stylesheet" href="/assets/tests/qunit-1.21.0.css">
<script src="/assets/tests/qunit-1.21.0.js"></script> <%= javascript_include_tag "/assets/tests/qunit-1.21.0.js", "/assets/tests/table_extended.js", nonce: true %>
<script src="/assets/tests/table_extended.js"></script>
<style type="text/css"> <style type="text/css">
body { body {
@ -9,9 +8,9 @@ body {
} }
</style> </style>
<script type="text/javascript"> <%= javascript_tag nonce: true do -%>
</script> <% end -%>
<div id="qunit" class="u-dontfold"></div> <div id="qunit" class="u-dontfold"></div>
<div id="table"></div> <div id="table"></div>

7
app/views/tests/taskbar.html.erb
View file

@ -1,7 +1,6 @@
<link rel="stylesheet" href="/assets/tests/qunit-1.21.0.css"> <link rel="stylesheet" href="/assets/tests/qunit-1.21.0.css">
<script src="/assets/tests/qunit-1.21.0.js"></script> <%= javascript_include_tag "/assets/tests/qunit-1.21.0.js", "/assets/tests/taskbar.js", nonce: true %>
<script src="/assets/tests/taskbar.js"></script>
<style type="text/css"> <style type="text/css">
body { body {
@ -9,8 +8,8 @@ body {
} }
</style> </style>
<script type="text/javascript"> <%= javascript_tag nonce: true do -%>
</script> <% end -%>
<div id="qunit" class="u-dontfold"></div> <div id="qunit" class="u-dontfold"></div>

7
app/views/tests/text_module.html.erb
View file

@ -1,7 +1,6 @@
<link rel="stylesheet" href="/assets/tests/qunit-1.21.0.css"> <link rel="stylesheet" href="/assets/tests/qunit-1.21.0.css">
<script src="/assets/tests/qunit-1.21.0.js"></script> <%= javascript_include_tag "/assets/tests/qunit-1.21.0.js", "/assets/tests/text_module.js", nonce: true %>
<script src="/assets/tests/text_module.js"></script>
<style type="text/css"> <style type="text/css">
body { body {
@ -9,8 +8,8 @@ body {
} }
</style> </style>
<script type="text/javascript"> <%= javascript_tag nonce: true do -%>
</script> <% end -%>
<div id="qunit" class="u-dontfold"></div> <div id="qunit" class="u-dontfold"></div>

7
app/views/tests/ticket_selector.html.erb
View file

@ -1,7 +1,6 @@
<link rel="stylesheet" href="/assets/tests/qunit-1.21.0.css"> <link rel="stylesheet" href="/assets/tests/qunit-1.21.0.css">
<script src="/assets/tests/qunit-1.21.0.js"></script> <%= javascript_include_tag "/assets/tests/qunit-1.21.0.js", "/assets/tests/ticket_selector.js", nonce: true %>
<script src="/assets/tests/ticket_selector.js"></script>
<style type="text/css"> <style type="text/css">
body { body {
@ -9,7 +8,7 @@ body {
} }
</style> </style>
<script type="text/javascript"> <%= javascript_tag nonce: true do -%>
</script> <% end -%>
<div id="qunit" class="u-dontfold"></div> <div id="qunit" class="u-dontfold"></div>

7
app/views/tests/ui.html.erb
View file

@ -1,7 +1,6 @@
<link rel="stylesheet" href="/assets/tests/qunit-1.21.0.css"> <link rel="stylesheet" href="/assets/tests/qunit-1.21.0.css">
<script src="/assets/tests/qunit-1.21.0.js"></script> <%= javascript_include_tag "/assets/tests/qunit-1.21.0.js", "/assets/tests/ui.js", nonce: true %>
<script src="/assets/tests/ui.js"></script>
<style type="text/css"> <style type="text/css">
body { body {
@ -9,7 +8,7 @@ body {
} }
</style> </style>
<script type="text/javascript"> <%= javascript_tag nonce: true do -%>
</script> <% end -%>
<div id="qunit" class="u-dontfold"></div> <div id="qunit" class="u-dontfold"></div>

23
config/initializers/content_security_policy.rb
View file

@ -16,8 +16,29 @@
# # policy.report_uri "/csp-violation-report-endpoint" # # policy.report_uri "/csp-violation-report-endpoint"
# end # end
Rails.application.config.content_security_policy do |policy|
base_uri = proc do
next if !Rails.env.production?
next if !Setting.get('system_init_done')
http_type = Setting.get('http_type')
fqdn = Setting.get('fqdn')
"#{http_type}://#{fqdn}"
end
policy.base_uri :self, base_uri
policy.default_src :self, :ws, :wss, 'https://log.zammad.com', 'https://images.zammad.com'
policy.font_src :self, :data
policy.img_src '*', :data
policy.object_src :none
policy.script_src :self, :unsafe_eval, :unsafe_inline, :strict_dynamic
policy.style_src :self, :unsafe_inline
end
# If you are using UJS then enable automatic nonce generation # If you are using UJS then enable automatic nonce generation
# Rails.application.config.content_security_policy_nonce_generator = -> request { SecureRandom.base64(16) } Rails.application.config.content_security_policy_nonce_generator = ->(_request) { SecureRandom.base64(16) }
# Report CSP violations to a specified URI # Report CSP violations to a specified URI
# For further information see the following documentation: # For further information see the following documentation: