Dereku/snappymail
1
0
Fork 0
mirror of https://github.com/the-djmaze/snappymail.git synced 2026-08-25 10:09:20 +03:00
Code Issues Projects Releases Packages Wiki Activity Actions

Improved app security

Browse source
This commit is contained in:
RainLoop Team 2019-07-02 00:20:27 +03:00
parent b244462fa5
commit 8eb4588917
4 changed files with 20 additions and 1 deletions
Download patch file Download diff file Expand all files Collapse all files

3
rainloop/v/0.0.0/app/libraries/RainLoop/Config/Application.php
View file

@ -198,7 +198,8 @@ class Application extends \RainLoop\Config\AbstractConfig
'custom_server_signature' => array('RainLoop'),
'x_frame_options_header' => array(''),
'x_xss_protection_header' => array('1; mode=block'),
'openpgp' => array(false),
'admin_login' => array('admin', 'Login and password for web admin panel'),

10
rainloop/v/0.0.0/app/libraries/RainLoop/Service.php
View file

@ -47,6 +47,12 @@ class Service
@\header('X-Frame-Options: '.$sXFrameOptionsHeader, true);
}
$sXssProtectionOptionsHeader = \trim($this->oActions->Config()->Get('security', 'x_xss_protection_header', ''));
if (0 < \strlen($sXssProtectionOptionsHeader))
{
@\header('X-XSS-Protection: '.$sXssProtectionOptionsHeader, true);
}
if ($this->oActions->Config()->Get('labs', 'force_https', false) && !$this->oHttp->IsSecure())
{
@\header('Location: https://'.$this->oHttp->GetHost(false, false).$this->oHttp->GetUrl(), true);
@ -248,6 +254,10 @@ class Service
$sResult .= ']-->';
}
else
{
@\header('X-XSS-Protection: 1; mode=block');
}
// Output result
echo $sResult;

1
rainloop/v/0.0.0/app/libraries/RainLoop/ServiceActions.php
View file

@ -498,6 +498,7 @@ class ServiceActions
if (\method_exists($this->oActions, $sMethodName))
{
@\header('X-Raw-Action: '.$sMethodName, true);
@\header('Content-Security-Policy: default-src \'self\'; script-src \'none\'; style-src \'none\'; frame-src \'none\'; child-src \'none\'', true);
$sRawError = '';
$this->oActions->SetActionParams(array(