Strona główna Odkrywaj Pomoc
Zaloguj się
LBP
/
FressRSS
kopia lustrzana https://github.com/FreshRSS/FreshRSS.git
4
0
Forkuj 0
Pliki Problemy 0 Wiki
Przeglądaj źródła

CSP no inline javascript draft

https://github.com/FreshRSS/FreshRSS/issues/1075
Alexandre Alapetite 10 lat temu
rodzic
ad54c6624c
commit
e4a459a6ed
6 zmienionych plików z 87 dodań i 81 usunięć
Widok podzielony Pokaż statystyki zmian
  1. 62 0
      app/FreshRSS.php
  2. 3 3
      app/layout/layout.phtml
  3. 0 70
      app/views/helpers/javascript_vars.phtml
  4. 9 6
      lib/Minz/Session.php
  5. 12 1
      p/scripts/main.js
  6. 1 1
      p/scripts/persona.js

+ 62 - 0
app/FreshRSS.php
Wyświetl plik 

@@ -110,6 +110,68 @@ class FreshRSS extends Minz_FrontController {
 
 		}
 
 	}
 
 
+	private static function setJavascriptCookie() {
 
+		$mark = FreshRSS_Context::$user_conf->mark_when;
 
+		$mail = Minz_Session::param('mail', false);
 
+		$s = FreshRSS_Context::$user_conf->shortcuts;
 
+		$json = json_encode(array(
 
+			'context' => array(
 
+				'auto_remove_article' => !!FreshRSS_Context::isAutoRemoveAvailable(),
 
+				'hide_posts' => !(FreshRSS_Context::$user_conf->display_posts || Minz_Request::actionName() === 'reader'),
 
+				'display_order' => Minz_Request::param('order', FreshRSS_Context::$user_conf->sort_order),
 
+				'auto_mark_article' => !!$mark['article'],
 
+				'auto_mark_site' => !!$mark['site'],
 
+				'auto_mark_scroll' => !!$mark['scroll'],
 
+				'auto_load_more' => !!FreshRSS_Context::$user_conf->auto_load_more,
 
+				'auto_actualize_feeds' => !!Minz_Session::param('actualize_feeds', false),
 
+				'does_lazyload' => !!FreshRSS_Context::$user_conf->lazyload ,
 
+				'sticky_post' => !!FreshRSS_Context::isStickyPostEnabled(),
 
+				'html5_notif_timeout' => FreshRSS_Context::$user_conf->html5_notif_timeout,
 
+				'auth_type' => FreshRSS_Context::$system_conf->auth_type,
 
+				'current_user_mail' => $mail ? ('"' . $mail . '"') : null,
 
+				'current_view' => Minz_Request::actionName(),
 
+			),
 
+			'shortcuts' => array(
 
+				'mark_read' => @$s['mark_read'],
 
+				'mark_favorite' => @$s['mark_favorite'],
 
+				'go_website' => @$s['go_website'],
 
+				'prev_entry' => @$s['prev_entry'],
 
+				'next_entry' => @$s['next_entry'],
 
+				'first_entry' => @$s['first_entry'],
 
+				'last_entry' => @$s['last_entry'],
 
+				'collapse_entry' => @$s['collapse_entry'],
 
+				'load_more' => @$s['load_more'],
 
+				'auto_share' => @$s['auto_share'],
 
+				'focus_search' => @$s['focus_search'],
 
+				'user_filter' => @$s['user_filter'],
 
+				'help' => @$s['help'],
 
+				'close_dropdown' => @$s['close_dropdown'],
 
+			),
 
+			'url' => array(
 
+				'index' => _url('index', 'index'),
 
+				'login' => Minz_Url::display(array('c' => 'auth', 'a' => 'login'), 'php'),
 
+				'logout' => Minz_Url::display(array('c' => 'auth', 'a' => 'logout'), 'php'),
 
+				'help' => FRESHRSS_WIKI,
 
+			),
 
+			'i18n' => array(
 
+				'confirmation_default' => _t('gen.js.confirm_action'),
 
+				'notif_title_articles' => _t('gen.js.feedback.title_new_articles'),
 
+				'notif_body_articles' => _t('gen.js.feedback.body_new_articles'),
 
+				'notif_request_failed' => _t('gen.js.feedback.request_failed'),
 
+				'category_empty' => _t('gen.js.category_empty'),
 
+			),
 
+			'icons' => array(
 
+				'close' => _i('close'),
 
+			),
 
+		), JSON_UNESCAPED_UNICODE);
 
+		setrawcookie('FreshRSS-vars', rawurlencode($json), 0, Minz_Session::getCookieDir());
 
+	}
 
+
 
+	public static function preLayout() {
 
+		header("Content-Security-Policy: default-src 'self'; img-src * data:; media-src *; style-src 'self' 'unsafe-inline'");
 
+		self::setJavascriptCookie();
 
+	}
 
+
 
 	private function loadNotifications() {
 
 		$notif = Minz_Session::param('notification');
 
 		if ($notif) {

+ 3 - 3
app/layout/layout.phtml
Wyświetl plik 

@@ -1,3 +1,6 @@
 
+<?php
 
+	FreshRSS::preLayout();
 
+?>
 
 <!DOCTYPE html>
 
 <html lang="<?php echo FreshRSS_Context::$user_conf->language; ?>" xml:lang="<?php echo FreshRSS_Context::$user_conf->language; ?>">
 
 	<head>
 
@@ -5,9 +8,6 @@
 
 		<meta name="viewport" content="initial-scale=1.0" />
 
 		<?php echo self::headTitle(); ?>
 
 		<?php echo self::headStyle(); ?>
 
-		<script>//<![CDATA[
 
-<?php $this->renderHelper('javascript_vars'); ?>
 
-		//]]></script>
 
 		<?php echo self::headScript(); ?>
 
 <?php
 
 	$url_base = Minz_Request::currentRequest();

+ 0 - 70
app/views/helpers/javascript_vars.phtml
Wyświetl plik 

@@ -1,70 +0,0 @@
 
-"use strict";
 
-<?php
 
-
 
-$mark = FreshRSS_Context::$user_conf->mark_when;
 
-$mail = Minz_Session::param('mail', false);
 
-$auto_actualize = Minz_Session::param('actualize_feeds', false);
 
-$hide_posts = !(FreshRSS_Context::$user_conf->display_posts || Minz_Request::actionName() === 'reader');
 
-$s = FreshRSS_Context::$user_conf->shortcuts;
 
-
 
-$url_login = Minz_Url::display(array(
 
-	'c' => 'auth',
 
-	'a' => 'login'
 
-), 'php');
 
-$url_logout = Minz_Url::display(array(
 
-	'c' => 'auth',
 
-	'a' => 'logout'
 
-), 'php');
 
-
 
-echo 'var context={',
 
-	'auto_remove_article:', FreshRSS_Context::isAutoRemoveAvailable() ? 'true' : 'false', ',',
 
-	'hide_posts:', $hide_posts ? 'true' : 'false', ',',
 
-	'display_order:"', Minz_Request::param('order', FreshRSS_Context::$user_conf->sort_order), '",',
 
-	'auto_mark_article:', $mark['article'] ? 'true' : 'false', ',',
 
-	'auto_mark_site:', $mark['site'] ? 'true' : 'false', ',',
 
-	'auto_mark_scroll:', $mark['scroll'] ? 'true' : 'false', ',',
 
-	'auto_load_more:', FreshRSS_Context::$user_conf->auto_load_more ? 'true' : 'false', ',',
 
-	'auto_actualize_feeds:', $auto_actualize ? 'true' : 'false', ',',
 
-	'does_lazyload:', FreshRSS_Context::$user_conf->lazyload ? 'true' : 'false', ',',
 
-	'sticky_post:', FreshRSS_Context::isStickyPostEnabled() ? 'true' : 'false', ',',
 
-	'html5_notif_timeout:', FreshRSS_Context::$user_conf->html5_notif_timeout, ',',
 
-	'auth_type:"', FreshRSS_Context::$system_conf->auth_type, '",',
 
-	'current_user_mail:', $mail ? ('"' . $mail . '"') : 'null', ',',
 
-	'current_view:"', Minz_Request::actionName(), '"',
 
-"},\n";
 
-
 
-echo 'shortcuts={',
 
-	'mark_read:"', @$s['mark_read'], '",',
 
-	'mark_favorite:"', @$s['mark_favorite'], '",',
 
-	'go_website:"', @$s['go_website'], '",',
 
-	'prev_entry:"', @$s['prev_entry'], '",',
 
-	'next_entry:"', @$s['next_entry'], '",',
 
-	'first_entry:"', @$s['first_entry'], '",',
 
-	'last_entry:"', @$s['last_entry'], '",',
 
-	'collapse_entry:"', @$s['collapse_entry'], '",',
 
-	'load_more:"', @$s['load_more'], '",',
 
-	'auto_share:"', @$s['auto_share'], '",',
 
-	'focus_search:"', @$s['focus_search'], '",',
 
-	'user_filter:"', @$s['user_filter'], '",',
 
-	'help:"', @$s['help'], '",',
 
-	'close_dropdown:"', @$s['close_dropdown'], '"',
 
-"},\n";
 
-
 
-echo 'url={',
 
-	'index:"', _url('index', 'index'), '",',
 
-	'login:"', $url_login, '",',
 
-	'logout:"', $url_logout, '",',
 
-	'help:"', FRESHRSS_WIKI, '"',
 
-"},\n";
 
-
 
-echo 'i18n={',
 
-	'confirmation_default:"', _t('gen.js.confirm_action'), '",',
 
-	'notif_title_articles:"', _t('gen.js.feedback.title_new_articles'), '",',
 
-	'notif_body_articles:"', _t('gen.js.feedback.body_new_articles'), '",',
 
-	'notif_request_failed:"', _t('gen.js.feedback.request_failed'), '",',
 
-	'category_empty:"', _t('gen.js.category_empty'), '"',
 
-"},\n";
 
-
 
-echo 'icons={',
 
-	'close:\'', _i('close'), '\'',
 
-"}\n";

+ 9 - 6
lib/Minz/Session.php
Wyświetl plik 

@@ -59,18 +59,21 @@ class Minz_Session {
 
 		}
 
 	}
 
 
+	public static function getCookieDir() {
 
+		// Get the script_name (e.g. /p/i/index.php) and keep only the path.
 
+		$cookie_dir = empty($_SERVER['REQUEST_URI']) ? '/' : $_SERVER['REQUEST_URI'];
 
+		if (substr($cookie_dir, -1) !== '/') {
 
+			$cookie_dir = dirname($cookie_dir) . '/';
 
+		}
 
+		return $cookie_dir;
 
+	}
 
 
 	/**
 
 	 * Spécifie la durée de vie des cookies
 
 	 * @param $l la durée de vie
 
 	 */
 
 	public static function keepCookie($l) {
 
-		// Get the script_name (e.g. /p/i/index.php) and keep only the path.
 
-		$cookie_dir = empty($_SERVER['REQUEST_URI']) ? '/' : $_SERVER['REQUEST_URI'];
 
-		if (substr($cookie_dir, -1) !== '/') {
 
-			$cookie_dir = dirname($cookie_dir) . '/';
 
-		}
 
-		session_set_cookie_params($l, $cookie_dir, '', false, true);
 
+		session_set_cookie_params($l, self::getCookieDir(), '', false, true);
 
 	}

+ 12 - 1
p/scripts/main.js
Wyświetl plik 

@@ -1245,8 +1245,19 @@ function init_configuration_alert() {
 
 	});
 
 }
 
 
+function parseJavaScriptCookie() {
 
+	var json = JSON.parse(decodeURIComponent(document.cookie.replace(/(?:(?:^|.*;\s*)FreshRSS-vars\s*\=\s*([^;]*).*$)|^.*$/, "$1"))) || {};
 
+	document.cookie = 'FreshRSS-vars=; expires=Thu, 01 Jan 1970 00:00:00 GMT';
 
+	window.context = json.context;
 
+	window.shortcuts = json.shortcuts;
 
+	window.url = json.url;
 
+	window.i18n = json.i18n;
 
+	window.icons = json.icons;
 
+}
 
+
 
 function init_all() {
 
-	if (!(window.$ && window.context)) {
 
+	parseJavaScriptCookie();
 
+	if (!window.$) {
 
 		if (window.console) {
 
 			console.log('FreshRSS waiting for JS…');
 
 		}

+ 1 - 1
p/scripts/persona.js
Wyświetl plik 

@@ -1,7 +1,7 @@
 
 "use strict";
 
 
 function init_persona() {
 
-	if (!(navigator.id && window.$)) {
 
+	if (!(navigator.id && window.$ && window.url)) {
 
 		if (window.console) {
 
 			console.log('FreshRSS (Persona) waiting for JS…');
 
 		}