Verified Commit 83a8fbee authored by Luc Didry's avatar Luc Didry
Browse files

Fix #78 Add CSP Header

+ update morris and raphael graph libraries
+ some changes in "myfiles" table
parent acf0ec75
......@@ -13,6 +13,7 @@ themes/*
themes/default/templates/data.html.ep
themes/default/templates/raw.html.ep
themes/default/templates/stats.json.ep
themes/default/templates/partial/raw.js.ep
tmp/*
.zanata-cache/*
cover_db/*
......@@ -7,6 +7,7 @@ Revision history for Lutim
- Use Mojolicious::Plugin::Chi
- Gzip static assets with Mojolicious::Plugin::GzipStatic
- Fix scroll-to-top when clicking on delete image
- Add CSP header
0.10.4 2018-05-07
- Fix bug in cache system that would allow someone to view an image with an incorrect decryption key
......
......@@ -10,6 +10,7 @@ minify:
@cd ./themes/default/public/css/ && cat bootstrap.min.css fontello.css hennypenny.css lutim.css toastify.css | csso > common.min.css
@cd ./themes/default/public/css/ && cat animation.css uploader.css markdown.css | csso > not_stats.min.css
@cd ./themes/default/public/css/ && cat photoswipe.css default-skin/default-skin.css | csso > gallery.min.css
@cd ./themes/default/public/css/ && cat twitter.css | csso > twitter.min.css
locales:
$(XGETTEXT) $(EXTRACTDIR) -o $(POT) 2>/dev/null
......
......@@ -8,6 +8,7 @@ requires 'Mojolicious::Plugin::I18N';
requires 'Mojolicious::Plugin::DebugDumperHelper';
requires 'Mojolicious::Plugin::StaticCache';
requires 'Mojolicious::Plugin::GzipStatic';
requires 'Mojolicious::Plugin::CSPHeader';
requires 'Text::Unidecode';
requires 'DateTime';
requires 'Filesys::DiskUsage';
......
......@@ -1926,6 +1926,13 @@ DISTRIBUTIONS
Test::More 0
Test::Output 1
perl 5.010001
Mojolicious-Plugin-CSPHeader-0.03
pathname: L/LD/LDIDRY/Mojolicious-Plugin-CSPHeader-0.03.tar.gz
provides:
Mojolicious::Plugin::CSPHeader 0.03
requirements:
ExtUtils::MakeMaker 0
Mojolicious 7.75
Mojolicious-Plugin-DebugDumperHelper-0.03
pathname: L/LD/LDIDRY/Mojolicious-Plugin-DebugDumperHelper-0.03.tar.gz
provides:
......
......@@ -105,8 +105,8 @@ sub startup {
# Static assets gzipping
$self->plugin('GzipStatic');
# Cache static files
$self->plugin('StaticCache' => { even_in_dev => 1 });
# Headers
$self->plugin('Lutim::Plugin::Headers');
# Helpers
$self->plugin('Lutim::Plugin::Helpers');
......
......@@ -151,7 +151,10 @@ sub run {
% l('1 year'),
% l('Total')
% );
<script>
$dom2
EOF
my $js = <<EOF;
var enabled_donut = {
element: 'raw-enabled-holder',
data: [
......@@ -186,13 +189,12 @@ var disabled_donut = {
'#455ac3',
]
};
</script>
$dom2
EOF
Mojo::File->new('themes/'.$config->{theme}.'/templates/stats.json.ep')->spurt(encode_json($stats));
Mojo::File->new('themes/'.$config->{theme}.'/templates/data.html.ep')->spurt($dom);
Mojo::File->new('themes/'.$config->{theme}.'/templates/raw.html.ep')->spurt(encode('UTF-8', $dom2));
Mojo::File->new('themes/'.$config->{theme}.'/templates/partial/raw.js.ep')->spurt(encode('UTF-8', $js));
}
=encoding utf8
......
package Lutim::Plugin::Headers;
use Mojo::Base 'Mojolicious::Plugin';
sub register {
my ($self, $app) = @_;
# Assets Cache headers
$app->plugin('StaticCache' => { even_in_dev => 1 });
# Add CSP Header
if (!defined($app->config('csp')) || (defined($app->config('csp')) && $app->config('csp') ne '')) {
my $directives = {
'default-src' => "'none'",
'script-src' => "'self' 'unsafe-eval'",
'style-src' => "'self' 'unsafe-inline'",
'connect-src' => "'self'",
'img-src' => "'self' data:",
'font-src' => "'self'",
'form-action' => "'self'",
'base-uri' => "'self'",
};
my $frame_ancestors = '';
#$frame_ancestors = "'none'" if $app->config('x_frame_options') eq 'DENY';
#$frame_ancestors = "'self'" if $app->config('x_frame_options') eq 'SAMEORIGIN';
#if ($app->config('x_frame_options') =~ m#^ALLOW-FROM#) {
# $frame_ancestors = $app->config('x_frame_options');
# $frame_ancestors =~ s#ALLOW-FROM +##;
#}
$directives->{'frame-ancestors'} = $frame_ancestors if $frame_ancestors;
$app->plugin('CSPHeader',
csp => $app->config('csp'),
directives => $directives
);
}
}
1;
......@@ -69,8 +69,8 @@ sub startup {
# Static assets gzipping
$self->plugin('GzipStatic');
# Cache static files
$self->plugin('StaticCache' => { even_in_dev => 1 });
# Headers
$self->plugin('Lutim::Plugin::Headers');
# Helpers
$self->plugin('Lutim::Plugin::Helpers');
......
......@@ -205,6 +205,16 @@
# optional, default is 0
#quiet_logs => 0,
# Content-Security-Policy header that will be sent by Lstu
# Set to '' to disable CSP header
# https://content-security-policy.com/ provides a good documentation about CSP.
# https://report-uri.com/home/generate provides a tool to generate a CSP header.
# optional, default is "base-uri 'self'; connect-src 'self'; default-src 'none'; font-src 'self'; form-action 'self'; img-src 'self' data:; script-src 'self' 'unsafe-eval'; style-src 'self' 'unsafe-inline'"
# NB: unsafe-inline for script-src and style-src are here only because morris,
# the graph library used in the stats page requires it
# the default value is good for `default` theme
#csp => "base-uri 'self'; connect-src 'self'; default-src 'none'; font-src 'self'; form-action 'self'; img-src 'self' data:; script-src 'self' 'unsafe-eval'; style-src 'self' 'unsafe-inline'",
##########################
# Lutim cron jobs settings
##########################
......
......@@ -63,7 +63,8 @@ BEGIN {
my $t = Test::Mojo->new('Lutim');
$t->get_ok('/')
->status_is(200)
->content_like(qr/Let's Upload That IMage/i);
->content_like(qr/Let's Upload That IMage/i)
->header_is('Content-Security-Policy' => "base-uri 'self'; connect-src 'self'; default-src 'none'; font-src 'self'; form-action 'self'; img-src 'self' data:; script-src 'self' 'unsafe-eval'; style-src 'self' 'unsafe-inline'");
# Gzip static assets
$t->get_ok('/css/lutim.css')
......
......@@ -19,7 +19,7 @@ msgstr ""
#. (30)
#. ($delay)
#. (config('max_delay')
#: lib/Lutim/Command/cron/stats.pm:149 lib/Lutim/Command/cron/stats.pm:150 lib/Lutim/Command/cron/stats.pm:160 lib/Lutim/Command/cron/stats.pm:161 lib/Lutim/Command/cron/stats.pm:177 lib/Lutim/Command/cron/stats.pm:178 themes/default/templates/partial/for_my_delay.html.ep:13 themes/default/templates/partial/for_my_delay.html.ep:14 themes/default/templates/partial/for_my_delay.html.ep:4 themes/default/templates/partial/lutim.js.ep:142 themes/default/templates/partial/lutim.js.ep:151 themes/default/templates/partial/lutim.js.ep:152 themes/default/templates/raw.html.ep:19 themes/default/templates/raw.html.ep:20 themes/default/templates/raw.html.ep:36 themes/default/templates/raw.html.ep:37 themes/default/templates/raw.html.ep:8 themes/default/templates/raw.html.ep:9
#: lib/Lutim/Command/cron/stats.pm:149 lib/Lutim/Command/cron/stats.pm:150 lib/Lutim/Command/cron/stats.pm:163 lib/Lutim/Command/cron/stats.pm:164 lib/Lutim/Command/cron/stats.pm:180 lib/Lutim/Command/cron/stats.pm:181 themes/default/templates/partial/for_my_delay.html.ep:13 themes/default/templates/partial/for_my_delay.html.ep:14 themes/default/templates/partial/for_my_delay.html.ep:4 themes/default/templates/partial/lutim.js.ep:140 themes/default/templates/partial/lutim.js.ep:149 themes/default/templates/partial/lutim.js.ep:150 themes/default/templates/partial/raw.js.ep:23 themes/default/templates/partial/raw.js.ep:24 themes/default/templates/partial/raw.js.ep:6 themes/default/templates/partial/raw.js.ep:7 themes/default/templates/raw.html.ep:8 themes/default/templates/raw.html.ep:9
msgid "%1 days"
msgstr ""
......@@ -32,15 +32,15 @@ msgstr ""
msgid "-or-"
msgstr ""
#: lib/Lutim.pm:217 lib/Lutim/Command/cron/stats.pm:151 lib/Lutim/Command/cron/stats.pm:162 lib/Lutim/Command/cron/stats.pm:179 themes/default/templates/index.html.ep:5 themes/default/templates/raw.html.ep:10 themes/default/templates/raw.html.ep:21 themes/default/templates/raw.html.ep:38
#: lib/Lutim.pm:217 lib/Lutim/Command/cron/stats.pm:151 lib/Lutim/Command/cron/stats.pm:165 lib/Lutim/Command/cron/stats.pm:182 themes/default/templates/index.html.ep:5 themes/default/templates/partial/raw.js.ep:25 themes/default/templates/partial/raw.js.ep:8 themes/default/templates/raw.html.ep:10
msgid "1 year"
msgstr ""
#: lib/Lutim.pm:216 lib/Lutim/Command/cron/stats.pm:148 lib/Lutim/Command/cron/stats.pm:159 lib/Lutim/Command/cron/stats.pm:176 themes/default/templates/index.html.ep:4 themes/default/templates/partial/for_my_delay.html.ep:13 themes/default/templates/partial/lutim.js.ep:151 themes/default/templates/raw.html.ep:18 themes/default/templates/raw.html.ep:35 themes/default/templates/raw.html.ep:7
#: lib/Lutim.pm:216 lib/Lutim/Command/cron/stats.pm:148 lib/Lutim/Command/cron/stats.pm:162 lib/Lutim/Command/cron/stats.pm:179 themes/default/templates/index.html.ep:4 themes/default/templates/partial/for_my_delay.html.ep:13 themes/default/templates/partial/lutim.js.ep:149 themes/default/templates/partial/raw.js.ep:22 themes/default/templates/partial/raw.js.ep:5 themes/default/templates/raw.html.ep:7
msgid "24 hours"
msgstr ""
#: themes/default/templates/partial/myfiles.js.ep:57
#: themes/default/templates/partial/myfiles.js.ep:62
msgid ": Error while trying to get the counter."
msgstr ""
......@@ -76,15 +76,15 @@ msgstr ""
msgid "Contributors"
msgstr ""
#: themes/default/templates/partial/common.js.ep:96
#: themes/default/templates/partial/common.js.ep:75 themes/default/templates/partial/common.js.ep:95
msgid "Copied to clipboard"
msgstr ""
#: themes/default/templates/partial/lutim.js.ep:218 themes/default/templates/partial/lutim.js.ep:273 themes/default/templates/partial/lutim.js.ep:351
#: themes/default/templates/partial/lutim.js.ep:215 themes/default/templates/partial/lutim.js.ep:276 themes/default/templates/partial/lutim.js.ep:361
msgid "Copy all view links to clipboard"
msgstr ""
#: themes/default/templates/index.html.ep:18 themes/default/templates/index.html.ep:36 themes/default/templates/index.html.ep:69 themes/default/templates/index.html.ep:77 themes/default/templates/index.html.ep:85 themes/default/templates/index.html.ep:93 themes/default/templates/myfiles.html.ep:20 themes/default/templates/myfiles.html.ep:38 themes/default/templates/partial/common.js.ep:177 themes/default/templates/partial/lutim.js.ep:108 themes/default/templates/partial/lutim.js.ep:123 themes/default/templates/partial/lutim.js.ep:82 themes/default/templates/partial/lutim.js.ep:94
#: themes/default/templates/index.html.ep:18 themes/default/templates/index.html.ep:36 themes/default/templates/index.html.ep:69 themes/default/templates/index.html.ep:77 themes/default/templates/index.html.ep:85 themes/default/templates/index.html.ep:93 themes/default/templates/myfiles.html.ep:20 themes/default/templates/myfiles.html.ep:38 themes/default/templates/partial/common.js.ep:168 themes/default/templates/partial/lutim.js.ep:106 themes/default/templates/partial/lutim.js.ep:121 themes/default/templates/partial/lutim.js.ep:80 themes/default/templates/partial/lutim.js.ep:92 themes/default/templates/partial/myfiles.js.ep:30
msgid "Copy to clipboard"
msgstr ""
......@@ -100,7 +100,7 @@ msgstr ""
msgid "Delay repartition chart for enabled images"
msgstr ""
#: themes/default/templates/index.html.ep:115 themes/default/templates/index.html.ep:147 themes/default/templates/index.html.ep:178 themes/default/templates/myfiles.html.ep:53 themes/default/templates/partial/lutim.js.ep:163
#: themes/default/templates/index.html.ep:115 themes/default/templates/index.html.ep:147 themes/default/templates/index.html.ep:178 themes/default/templates/myfiles.html.ep:53 themes/default/templates/partial/lutim.js.ep:161
msgid "Delete at first view?"
msgstr ""
......@@ -112,7 +112,7 @@ msgstr ""
msgid "Deleted images in 30 days"
msgstr ""
#: themes/default/templates/index.html.ep:98 themes/default/templates/myfiles.html.ep:56 themes/default/templates/partial/common.js.ep:169 themes/default/templates/partial/common.js.ep:172
#: themes/default/templates/index.html.ep:98 themes/default/templates/myfiles.html.ep:56 themes/default/templates/partial/common.js.ep:160 themes/default/templates/partial/common.js.ep:163
msgid "Deletion link"
msgstr ""
......@@ -120,7 +120,7 @@ msgstr ""
msgid "Download all images"
msgstr ""
#: themes/default/templates/index.html.ep:81 themes/default/templates/index.html.ep:83 themes/default/templates/partial/lutim.js.ep:100 themes/default/templates/partial/lutim.js.ep:104
#: themes/default/templates/index.html.ep:81 themes/default/templates/index.html.ep:83 themes/default/templates/partial/lutim.js.ep:102 themes/default/templates/partial/lutim.js.ep:98
msgid "Download link"
msgstr ""
......@@ -140,7 +140,7 @@ msgstr ""
msgid "Encrypt the image (Lutim does not keep the key)."
msgstr ""
#: themes/default/templates/partial/lutim.js.ep:47
#: themes/default/templates/partial/lutim.js.ep:45
msgid "Error while trying to modify the image."
msgstr ""
......@@ -168,11 +168,11 @@ msgstr ""
msgid "Gallery link"
msgstr ""
#: themes/default/templates/partial/common.js.ep:105 themes/default/templates/partial/common.js.ep:122
#: themes/default/templates/partial/common.js.ep:116 themes/default/templates/partial/common.js.ep:98
msgid "Hit Ctrl+C, then Enter to copy the short link"
msgstr ""
#: themes/default/templates/layouts/default.html.ep:48
#: themes/default/templates/layouts/default.html.ep:47
msgid "Homepage"
msgstr ""
......@@ -200,7 +200,7 @@ msgstr ""
msgid "Image delay"
msgstr ""
#: themes/default/templates/partial/common.js.ep:142
#: themes/default/templates/partial/common.js.ep:139
msgid "Image deleted"
msgstr ""
......@@ -240,7 +240,7 @@ msgstr ""
msgid "Language"
msgstr ""
#: themes/default/templates/index.html.ep:118 themes/default/templates/index.html.ep:166 themes/default/templates/index.html.ep:206 themes/default/templates/partial/lutim.js.ep:167
#: themes/default/templates/index.html.ep:118 themes/default/templates/index.html.ep:166 themes/default/templates/index.html.ep:206 themes/default/templates/partial/lutim.js.ep:165
msgid "Let's go!"
msgstr ""
......@@ -248,7 +248,7 @@ msgstr ""
msgid "License:"
msgstr ""
#: themes/default/templates/index.html.ep:89 themes/default/templates/index.html.ep:91 themes/default/templates/partial/lutim.js.ep:114 themes/default/templates/partial/lutim.js.ep:118
#: themes/default/templates/index.html.ep:89 themes/default/templates/index.html.ep:91 themes/default/templates/partial/lutim.js.ep:112 themes/default/templates/partial/lutim.js.ep:116
msgid "Link for share on social networks"
msgstr ""
......@@ -264,7 +264,7 @@ msgstr ""
msgid "Main developers"
msgstr ""
#: themes/default/templates/index.html.ep:73 themes/default/templates/index.html.ep:75 themes/default/templates/partial/lutim.js.ep:88 themes/default/templates/partial/lutim.js.ep:91
#: themes/default/templates/index.html.ep:73 themes/default/templates/index.html.ep:75 themes/default/templates/partial/lutim.js.ep:86 themes/default/templates/partial/lutim.js.ep:89
msgid "Markdown syntax"
msgstr ""
......@@ -276,7 +276,7 @@ msgstr ""
msgid "Next (arrow right)"
msgstr ""
#: themes/default/templates/partial/myfiles.js.ep:19
#: themes/default/templates/partial/myfiles.js.ep:20
msgid "No limit"
msgstr ""
......@@ -313,11 +313,7 @@ msgstr ""
msgid "Send an image"
msgstr ""
#: themes/default/templates/partial/lutim.js.ep:23
msgid "Share it!"
msgstr ""
#: themes/default/templates/index.html.ep:133 themes/default/templates/partial/gallery.js.ep:211 themes/default/templates/partial/lutim.js.ep:178
#: themes/default/templates/index.html.ep:133 themes/default/templates/partial/gallery.js.ep:211 themes/default/templates/partial/lutim.js.ep:176
msgid "Something bad happened"
msgstr ""
......@@ -370,7 +366,7 @@ msgstr ""
#. ($tx->res->max_message_size)
#. ($c->req->max_message_size)
#. (config('max_file_size')
#: lib/Lutim/Controller.pm:309 lib/Lutim/Controller.pm:378 themes/default/templates/partial/lutim.js.ep:245
#: lib/Lutim/Controller.pm:309 lib/Lutim/Controller.pm:378 themes/default/templates/partial/lutim.js.ep:247
msgid "The file exceed the size limit (%1)"
msgstr ""
......@@ -421,7 +417,7 @@ msgstr ""
msgid "Tweet it!"
msgstr ""
#: themes/default/templates/partial/common.js.ep:85
#: themes/default/templates/partial/common.js.ep:72 themes/default/templates/partial/common.js.ep:92
msgid "Unable to copy to clipboard"
msgstr ""
......@@ -459,7 +455,7 @@ msgstr ""
msgid "Uploading is currently disabled, please try later or contact the administrator (%1)."
msgstr ""
#: themes/default/templates/index.html.ep:65 themes/default/templates/index.html.ep:67 themes/default/templates/myfiles.html.ep:51 themes/default/templates/partial/lutim.js.ep:74 themes/default/templates/partial/lutim.js.ep:78
#: themes/default/templates/index.html.ep:65 themes/default/templates/index.html.ep:67 themes/default/templates/myfiles.html.ep:51 themes/default/templates/partial/lutim.js.ep:72 themes/default/templates/partial/lutim.js.ep:76
msgid "View link"
msgstr ""
......@@ -507,7 +503,7 @@ msgstr ""
msgid "core developer"
msgstr ""
#: lib/Lutim.pm:215 lib/Lutim/Command/cron/stats.pm:147 lib/Lutim/Command/cron/stats.pm:158 lib/Lutim/Command/cron/stats.pm:175 themes/default/templates/index.html.ep:3 themes/default/templates/raw.html.ep:17 themes/default/templates/raw.html.ep:34 themes/default/templates/raw.html.ep:6
#: lib/Lutim.pm:215 lib/Lutim/Command/cron/stats.pm:147 lib/Lutim/Command/cron/stats.pm:161 lib/Lutim/Command/cron/stats.pm:178 themes/default/templates/index.html.ep:3 themes/default/templates/partial/raw.js.ep:21 themes/default/templates/partial/raw.js.ep:4 themes/default/templates/raw.html.ep:6
msgid "no time limit"
msgstr ""
......
# Lutim language file
# Copyright (C) 2014 Luc Didry
# This file is distributed under the same license as the Lutim package.
# FIRST AUTHOR <EMAIL@ADDRESS>, YEAR.
# Luc Didry <luc@framasoft.org>, 2018. #zanata
# Quentí <quentinantonin@free.fr>, 2018. #zanata
# Quentí, 2018. #zanata
msgid ""
msgstr ""
"Project-Id-Version: PACKAGE VERSION\n"
......@@ -12,7 +11,7 @@ msgstr ""
"Content-Type: text/plain; charset=UTF-8\n"
"Content-Transfer-Encoding: 8bit\n"
"PO-Revision-Date: 2018-03-20 04:53+0000\n"
"Last-Translator: Quentí <quentinantonin@free.fr>\n"
"Last-Translator: Quentí\n"
"Language-Team: Occitan (http://www.transifex.com/fiat-tux/lutim/language/oc/"
")\n"
"Language: oc\n"
......
This diff is collapsed.
......@@ -104,3 +104,28 @@ label.always-encrypt {
@media (max-width: 675px) {
.gallery { column-count: 1 }
}
.border-zero {
border: 0;
}
.copy-node {
width: 1px;
height: 1px;
position: 'fixed';
top: 5px;
}
.width-zero {
width: 0%;
}
.pdg-left-10 {
padding-left: 10px;
}
.spin {
font-size: 200%;
display: none;
}
#myfiles td.ellips {
max-width: 300px;
white-space: nowrap;
overflow: hidden;
text-overflow: ellipsis;
}
.morris-hover{position:absolute;z-index:1000;}.morris-hover.morris-default-style{border-radius:10px;padding:6px;color:#666;background:rgba(255, 255, 255, 0.8);border:solid 2px rgba(230, 230, 230, 0.8);font-family:sans-serif;font-size:12px;text-align:center;}.morris-hover.morris-default-style .morris-hover-row-label{font-weight:bold;margin:0.25em 0;}
.morris-hover.morris-default-style .morris-hover-point{white-space:nowrap;margin:0.1em 0;}
.morris-hover{position:absolute;z-index:1000}.morris-hover.morris-default-style{border-radius:10px;padding:6px;color:#666;background:rgba(255,255,255,0.8);border:solid 2px rgba(230,230,230,0.8);font-family:sans-serif;font-size:12px;text-align:center}.morris-hover.morris-default-style .morris-hover-row-label{font-weight:bold;margin:0.25em 0}
.morris-hover.morris-default-style .morris-hover-point{white-space:nowrap;margin:0.1em 0}
/* vim:set sw=4 ts=4 sts=4 ft=css expandtab: */
html {
max-height:100%;
}
.height-97 {
height: 97%;
}
.freezeframe {
max-width: 100%;
max-height:100%;
}
html{max-height:100%}.height-97{height:97%}.freezeframe{max-width:100%;max-height:100%}
......@@ -40,16 +40,6 @@ function updateItem(short, limit, del_at_view) {
});
localStorage.setItem('images', JSON.stringify(files));
}
function share(url) {
new MozActivity({
name: 'share',
data: {
type: 'url',
number: 1,
url: url
}
});
}
function evaluateCopyAll(e) {
if (e) {
e.preventDefault();
......@@ -116,4 +106,6 @@ $('document').ready(function() {
} else if ($('#myfiles').length !== 0) {
populateFilesTable();
}
$('.copy-to-clipboard-link').on('click', clickOnCopyLink);
$('.copy-all-to-clipboard-link').on('click', copyAllToClipboard);
});
Markdown is supported
0% or .
You are about to add 0 people to the discussion. Proceed with caution.
Finish editing this message first!
Please register or to comment