Dereku/snappymail
1
0
Fork 0
mirror of https://github.com/the-djmaze/snappymail.git synced 2026-09-06 16:07:03 +03:00
Code Issues Projects Releases Packages Wiki Activity Actions

Bugfix CSP handling Nextcloud<24 for #631 and #633

Browse source
This commit is contained in:
the-djmaze 2022-11-06 23:10:34 +01:00
parent e0320c63c1
commit 529d727189
2 changed files with 22 additions and 16 deletions
Download patch file Download diff file Expand all files Collapse all files

17
dev/boot.js
View file

@ -9,6 +9,13 @@ const
layout = doc.cookie.match(/(^|;) ?rllayout=([^;]+)/) || '', layout = doc.cookie.match(/(^|;) ?rllayout=([^;]+)/) || '',
badBrowser = () => doc.location.replace('./?/BadBrowser'), badBrowser = () => doc.location.replace('./?/BadBrowser'),
showError = msg => {
let div = eId('loading-error');
div.append(' ' + msg);
eId('loading').hidden = true;
div.hidden = false;
},
loadScript = src => { loadScript = src => {
if (!src) { if (!src) {
throw new Error('src should not be empty.'); throw new Error('src should not be empty.');
@ -44,13 +51,7 @@ window.rl = {
initData: appData => { initData: appData => {
RL_APP_DATA = appData; RL_APP_DATA = appData;
const url = appData.StaticLibsJs, const url = appData.StaticLibsJs,
cb = () => rl.app ? rl.app.bootstart() : badBrowser(), cb = () => rl.app ? rl.app.bootstart() : badBrowser();
div = eId('loading-error'),
showError = msg => {
div.append(' ' + msg);
eId('loading').hidden = true;
div.hidden = false;
};
loadScript(url) loadScript(url)
.then(() => loadScript(url.replace('/libs.', `/${admin?'admin':'app'}.`))) .then(() => loadScript(url.replace('/libs.', `/${admin?'admin':'app'}.`)))
.then(() => appData.PluginsLink ? loadScript(appData.PluginsLink) : Promise.resolve()) .then(() => appData.PluginsLink ? loadScript(appData.PluginsLink) : Promise.resolve())
@ -73,6 +74,6 @@ window.rl = {
}; };
loadScript(`./?/${admin ? 'Admin' : ''}AppData/0/${Math.random().toString().slice(2)}/`) loadScript(`./?/${admin ? 'Admin' : ''}AppData/0/${Math.random().toString().slice(2)}/`)
.then(() => 0); .catch(e => showError(e));
})(document); })(document);

21
integrations/nextcloud/snappymail/lib/Controller/PageController.php
View file

@ -55,16 +55,12 @@ class PageController extends Controller
$sAppCssMin = $oConfig->Get('labs', 'use_app_debug_css', false) ? '' : '.min'; $sAppCssMin = $oConfig->Get('labs', 'use_app_debug_css', false) ? '' : '.min';
$sLanguage = $oActions->GetLanguage(false); $sLanguage = $oActions->GetLanguage(false);
$sScriptNonce = \OC::$server->getContentSecurityPolicyNonceManager()->getNonce();
// $sScriptNonce = \SnappyMail\UUID::generate();
// \RainLoop\Service::setCSP($sScriptNonce);
$params = [ $params = [
'Admin' => $bAdmin ? 1 : 0, 'Admin' => $bAdmin ? 1 : 0,
'LoadingDescriptionEsc' => \htmlspecialchars($oConfig->Get('webmail', 'loading_description', 'SnappyMail'), ENT_QUOTES|ENT_IGNORE, 'UTF-8'), 'LoadingDescriptionEsc' => \htmlspecialchars($oConfig->Get('webmail', 'loading_description', 'SnappyMail'), ENT_QUOTES|ENT_IGNORE, 'UTF-8'),
'BaseTemplates' => \RainLoop\Utils::ClearHtmlOutput($oServiceActions->compileTemplates($bAdmin)), 'BaseTemplates' => \RainLoop\Utils::ClearHtmlOutput($oServiceActions->compileTemplates($bAdmin)),
'BaseAppBootScript' => \file_get_contents(APP_VERSION_ROOT_PATH.'static/js'.($sAppJsMin ? '/min' : '').'/boot'.$sAppJsMin.'.js'), 'BaseAppBootScript' => \file_get_contents(APP_VERSION_ROOT_PATH.'static/js'.($sAppJsMin ? '/min' : '').'/boot'.$sAppJsMin.'.js'),
'BaseAppBootScriptNonce' => $sScriptNonce, 'BaseAppBootScriptNonce' => \OC::$server->getContentSecurityPolicyNonceManager()->getNonce(),
'BaseLanguage' => $oActions->compileLanguage($sLanguage, $bAdmin), 'BaseLanguage' => $oActions->compileLanguage($sLanguage, $bAdmin),
'BaseAppBootCss' => \file_get_contents(APP_VERSION_ROOT_PATH.'static/css/boot'.$sAppCssMin.'.css'), 'BaseAppBootCss' => \file_get_contents(APP_VERSION_ROOT_PATH.'static/css/boot'.$sAppCssMin.'.css'),
'BaseAppThemeCssLink' => $oActions->ThemeLink($bAdmin), 'BaseAppThemeCssLink' => $oActions->ThemeLink($bAdmin),
@ -75,6 +71,8 @@ class PageController extends Controller
) )
]; ];
// \OCP\Util::addScript('snappymail', '../app/snappymail/v/'.APP_VERSION.'/static/js'.($sAppJsMin ? '/min' : '').'/boot'.$sAppJsMin);
// Nextcloud html encodes, so addHeader('style') is not possible // Nextcloud html encodes, so addHeader('style') is not possible
// \OCP\Util::addHeader('style', ['id'=>'app-boot-css'], \file_get_contents(APP_VERSION_ROOT_PATH.'static/css/boot'.$sAppCssMin.'.css')); // \OCP\Util::addHeader('style', ['id'=>'app-boot-css'], \file_get_contents(APP_VERSION_ROOT_PATH.'static/css/boot'.$sAppCssMin.'.css'));
\OCP\Util::addHeader('link', ['type'=>'text/css','rel'=>'stylesheet','href'=>\RainLoop\Utils::WebStaticPath('css/'.($bAdmin?'admin':'app').$sAppCssMin.'.css')], ''); \OCP\Util::addHeader('link', ['type'=>'text/css','rel'=>'stylesheet','href'=>\RainLoop\Utils::WebStaticPath('css/'.($bAdmin?'admin':'app').$sAppCssMin.'.css')], '');
@ -83,10 +81,17 @@ class PageController extends Controller
$response = new TemplateResponse('snappymail', 'index_embed', $params); $response = new TemplateResponse('snappymail', 'index_embed', $params);
$csp = new ContentSecurityPolicy(); $csp = new ContentSecurityPolicy();
$csp->addAllowedScriptDomain("'self'"); // $csp->addAllowedScriptDomain("'self'");
\method_exists($csp, 'useStrictDynamic') && $csp->useStrictDynamic(true); // NC24+ // CSP level 3
\method_exists($csp, 'useStrictDynamic')
? $csp->useStrictDynamic(true) // NC24+
: $csp->addAllowedScriptDomain("'strict-dynamic'");
// Else CSP level 2
$csp->addAllowedScriptDomain("'unsafe-inline'"); // ignored by CSP 3 'strict-dynamic'
$csp->allowEvalScript(true); // $csp->addAllowedScriptDomain("'unsafe-eval'"); $csp->allowEvalScript(true); // $csp->addAllowedScriptDomain("'unsafe-eval'");
$csp->addAllowedStyleDomain("'self'"); // $csp->addAllowedStyleDomain("'self'");
// $csp->addAllowedStyleDomain("'unsafe-inline'");
// $csp->addAllowedImageDomain("data:");
$response->setContentSecurityPolicy($csp); $response->setContentSecurityPolicy($csp);
return $response; return $response;