aboutsummaryrefslogtreecommitdiff
diff options
context:
space:
mode:
authorGravatar Alexandre Alapetite <alexandre@alapetite.fr> 2016-02-16 23:53:39 +0100
committerGravatar Alexandre Alapetite <alexandre@alapetite.fr> 2016-02-16 23:53:39 +0100
commite4a459a6edc40b64cba7845b52f3e90666b2818a (patch)
tree882737a2233bbed5a62dd962addf35ba8f7bf316
parentad54c6624c3adddc345688f97c80b19dfc523ded (diff)
CSP no inline javascript draft
https://github.com/FreshRSS/FreshRSS/issues/1075
Diffstat
-rw-r--r--app/FreshRSS.php62
-rw-r--r--app/layout/layout.phtml6
-rw-r--r--app/views/helpers/javascript_vars.phtml70
-rw-r--r--lib/Minz/Session.php15
-rw-r--r--p/scripts/main.js13
-rw-r--r--p/scripts/persona.js2
6 files changed, 87 insertions, 81 deletions
diff --git a/app/FreshRSS.php b/app/FreshRSS.php
index 044de9cd4..e0e82457c 100644
--- a/app/FreshRSS.php
+++ b/app/FreshRSS.php
@@ -110,6 +110,68 @@ class FreshRSS extends Minz_FrontController {
}
}
+ private static function setJavascriptCookie() {
+ $mark = FreshRSS_Context::$user_conf->mark_when;
+ $mail = Minz_Session::param('mail', false);
+ $s = FreshRSS_Context::$user_conf->shortcuts;
+ $json = json_encode(array(
+ 'context' => array(
+ 'auto_remove_article' => !!FreshRSS_Context::isAutoRemoveAvailable(),
+ 'hide_posts' => !(FreshRSS_Context::$user_conf->display_posts || Minz_Request::actionName() === 'reader'),
+ 'display_order' => Minz_Request::param('order', FreshRSS_Context::$user_conf->sort_order),
+ 'auto_mark_article' => !!$mark['article'],
+ 'auto_mark_site' => !!$mark['site'],
+ 'auto_mark_scroll' => !!$mark['scroll'],
+ 'auto_load_more' => !!FreshRSS_Context::$user_conf->auto_load_more,
+ 'auto_actualize_feeds' => !!Minz_Session::param('actualize_feeds', false),
+ 'does_lazyload' => !!FreshRSS_Context::$user_conf->lazyload ,
+ 'sticky_post' => !!FreshRSS_Context::isStickyPostEnabled(),
+ 'html5_notif_timeout' => FreshRSS_Context::$user_conf->html5_notif_timeout,
+ 'auth_type' => FreshRSS_Context::$system_conf->auth_type,
+ 'current_user_mail' => $mail ? ('"' . $mail . '"') : null,
+ 'current_view' => Minz_Request::actionName(),
+ ),
+ 'shortcuts' => array(
+ 'mark_read' => @$s['mark_read'],
+ 'mark_favorite' => @$s['mark_favorite'],
+ 'go_website' => @$s['go_website'],
+ 'prev_entry' => @$s['prev_entry'],
+ 'next_entry' => @$s['next_entry'],
+ 'first_entry' => @$s['first_entry'],
+ 'last_entry' => @$s['last_entry'],
+ 'collapse_entry' => @$s['collapse_entry'],
+ 'load_more' => @$s['load_more'],
+ 'auto_share' => @$s['auto_share'],
+ 'focus_search' => @$s['focus_search'],
+ 'user_filter' => @$s['user_filter'],
+ 'help' => @$s['help'],
+ 'close_dropdown' => @$s['close_dropdown'],
+ ),
+ 'url' => array(
+ 'index' => _url('index', 'index'),
+ 'login' => Minz_Url::display(array('c' => 'auth', 'a' => 'login'), 'php'),
+ 'logout' => Minz_Url::display(array('c' => 'auth', 'a' => 'logout'), 'php'),
+ 'help' => FRESHRSS_WIKI,
+ ),
+ 'i18n' => array(
+ 'confirmation_default' => _t('gen.js.confirm_action'),
+ 'notif_title_articles' => _t('gen.js.feedback.title_new_articles'),
+ 'notif_body_articles' => _t('gen.js.feedback.body_new_articles'),
+ 'notif_request_failed' => _t('gen.js.feedback.request_failed'),
+ 'category_empty' => _t('gen.js.category_empty'),
+ ),
+ 'icons' => array(
+ 'close' => _i('close'),
+ ),
+ ), JSON_UNESCAPED_UNICODE);
+ setrawcookie('FreshRSS-vars', rawurlencode($json), 0, Minz_Session::getCookieDir());
+ }
+
+ public static function preLayout() {
+ header("Content-Security-Policy: default-src 'self'; img-src * data:; media-src *; style-src 'self' 'unsafe-inline'");
+ self::setJavascriptCookie();
+ }
+
private function loadNotifications() {
$notif = Minz_Session::param('notification');
if ($notif) {
diff --git a/app/layout/layout.phtml b/app/layout/layout.phtml
index 1d3afbf71..7d718efbd 100644
--- a/app/layout/layout.phtml
+++ b/app/layout/layout.phtml
@@ -1,3 +1,6 @@
+<?php
+ FreshRSS::preLayout();
+?>
<!DOCTYPE html>
<html lang="<?php echo FreshRSS_Context::$user_conf->language; ?>" xml:lang="<?php echo FreshRSS_Context::$user_conf->language; ?>">
<head>
@@ -5,9 +8,6 @@
<meta name="viewport" content="initial-scale=1.0" />
<?php echo self::headTitle(); ?>
<?php echo self::headStyle(); ?>
- <script>//<![CDATA[
-<?php $this->renderHelper('javascript_vars'); ?>
- //]]></script>
<?php echo self::headScript(); ?>
<?php
$url_base = Minz_Request::currentRequest();
diff --git a/app/views/helpers/javascript_vars.phtml b/app/views/helpers/javascript_vars.phtml
deleted file mode 100644
index 36d6e693d..000000000
--- a/app/views/helpers/javascript_vars.phtml
+++ /dev/null
@@ -1,70 +0,0 @@
-"use strict";
-<?php
-
-$mark = FreshRSS_Context::$user_conf->mark_when;
-$mail = Minz_Session::param('mail', false);
-$auto_actualize = Minz_Session::param('actualize_feeds', false);
-$hide_posts = !(FreshRSS_Context::$user_conf->display_posts || Minz_Request::actionName() === 'reader');
-$s = FreshRSS_Context::$user_conf->shortcuts;
-
-$url_login = Minz_Url::display(array(
- 'c' => 'auth',
- 'a' => 'login'
-), 'php');
-$url_logout = Minz_Url::display(array(
- 'c' => 'auth',
- 'a' => 'logout'
-), 'php');
-
-echo 'var context={',
- 'auto_remove_article:', FreshRSS_Context::isAutoRemoveAvailable() ? 'true' : 'false', ',',
- 'hide_posts:', $hide_posts ? 'true' : 'false', ',',
- 'display_order:"', Minz_Request::param('order', FreshRSS_Context::$user_conf->sort_order), '",',
- 'auto_mark_article:', $mark['article'] ? 'true' : 'false', ',',
- 'auto_mark_site:', $mark['site'] ? 'true' : 'false', ',',
- 'auto_mark_scroll:', $mark['scroll'] ? 'true' : 'false', ',',
- 'auto_load_more:', FreshRSS_Context::$user_conf->auto_load_more ? 'true' : 'false', ',',
- 'auto_actualize_feeds:', $auto_actualize ? 'true' : 'false', ',',
- 'does_lazyload:', FreshRSS_Context::$user_conf->lazyload ? 'true' : 'false', ',',
- 'sticky_post:', FreshRSS_Context::isStickyPostEnabled() ? 'true' : 'false', ',',
- 'html5_notif_timeout:', FreshRSS_Context::$user_conf->html5_notif_timeout, ',',
- 'auth_type:"', FreshRSS_Context::$system_conf->auth_type, '",',
- 'current_user_mail:', $mail ? ('"' . $mail . '"') : 'null', ',',
- 'current_view:"', Minz_Request::actionName(), '"',
-"},\n";
-
-echo 'shortcuts={',
- 'mark_read:"', @$s['mark_read'], '",',
- 'mark_favorite:"', @$s['mark_favorite'], '",',
- 'go_website:"', @$s['go_website'], '",',
- 'prev_entry:"', @$s['prev_entry'], '",',
- 'next_entry:"', @$s['next_entry'], '",',
- 'first_entry:"', @$s['first_entry'], '",',
- 'last_entry:"', @$s['last_entry'], '",',
- 'collapse_entry:"', @$s['collapse_entry'], '",',
- 'load_more:"', @$s['load_more'], '",',
- 'auto_share:"', @$s['auto_share'], '",',
- 'focus_search:"', @$s['focus_search'], '",',
- 'user_filter:"', @$s['user_filter'], '",',
- 'help:"', @$s['help'], '",',
- 'close_dropdown:"', @$s['close_dropdown'], '"',
-"},\n";
-
-echo 'url={',
- 'index:"', _url('index', 'index'), '",',
- 'login:"', $url_login, '",',
- 'logout:"', $url_logout, '",',
- 'help:"', FRESHRSS_WIKI, '"',
-"},\n";
-
-echo 'i18n={',
- 'confirmation_default:"', _t('gen.js.confirm_action'), '",',
- 'notif_title_articles:"', _t('gen.js.feedback.title_new_articles'), '",',
- 'notif_body_articles:"', _t('gen.js.feedback.body_new_articles'), '",',
- 'notif_request_failed:"', _t('gen.js.feedback.request_failed'), '",',
- 'category_empty:"', _t('gen.js.category_empty'), '"',
-"},\n";
-
-echo 'icons={',
- 'close:\'', _i('close'), '\'',
-"}\n"; \ No newline at end of file
diff --git a/lib/Minz/Session.php b/lib/Minz/Session.php
index 057e7746a..940cd27d9 100644
--- a/lib/Minz/Session.php
+++ b/lib/Minz/Session.php
@@ -59,18 +59,21 @@ class Minz_Session {
}
}
+ public static function getCookieDir() {
+ // Get the script_name (e.g. /p/i/index.php) and keep only the path.
+ $cookie_dir = empty($_SERVER['REQUEST_URI']) ? '/' : $_SERVER['REQUEST_URI'];
+ if (substr($cookie_dir, -1) !== '/') {
+ $cookie_dir = dirname($cookie_dir) . '/';
+ }
+ return $cookie_dir;
+ }
/**
* Spécifie la durée de vie des cookies
* @param $l la durée de vie
*/
public static function keepCookie($l) {
- // Get the script_name (e.g. /p/i/index.php) and keep only the path.
- $cookie_dir = empty($_SERVER['REQUEST_URI']) ? '/' : $_SERVER['REQUEST_URI'];
- if (substr($cookie_dir, -1) !== '/') {
- $cookie_dir = dirname($cookie_dir) . '/';
- }
- session_set_cookie_params($l, $cookie_dir, '', false, true);
+ session_set_cookie_params($l, self::getCookieDir(), '', false, true);
}
diff --git a/p/scripts/main.js b/p/scripts/main.js
index 968c945c8..32a2ca913 100644
--- a/p/scripts/main.js
+++ b/p/scripts/main.js
@@ -1245,8 +1245,19 @@ function init_configuration_alert() {
});
}
+function parseJavaScriptCookie() {
+ var json = JSON.parse(decodeURIComponent(document.cookie.replace(/(?:(?:^|.*;\s*)FreshRSS-vars\s*\=\s*([^;]*).*$)|^.*$/, "$1"))) || {};
+ document.cookie = 'FreshRSS-vars=; expires=Thu, 01 Jan 1970 00:00:00 GMT';
+ window.context = json.context;
+ window.shortcuts = json.shortcuts;
+ window.url = json.url;
+ window.i18n = json.i18n;
+ window.icons = json.icons;
+}
+
function init_all() {
- if (!(window.$ && window.context)) {
+ parseJavaScriptCookie();
+ if (!window.$) {
if (window.console) {
console.log('FreshRSS waiting for JS…');
}
diff --git a/p/scripts/persona.js b/p/scripts/persona.js
index 36aeeaf56..63ab43795 100644
--- a/p/scripts/persona.js
+++ b/p/scripts/persona.js
@@ -1,7 +1,7 @@
"use strict";
function init_persona() {
- if (!(navigator.id && window.$)) {
+ if (!(navigator.id && window.$ && window.url)) {
if (window.console) {
console.log('FreshRSS (Persona) waiting for JS…');
}
generated by cgit v1.2.3 (git 2.39.1) at 2026-02-10 12:27:35 +0000