lainwir3d/dolibarr
1
0
Fork 0
Code Issues Pull Requests Packages Projects Releases Wiki Activity

NEW Add hook setContentSecurityPolicy

Browse Source
This commit is contained in:
Laurent Destailleur 2018-04-30 14:39:12 +02:00
parent 4c12369a26
commit 32ace6a8cf
7 changed files with 46 additions and 13 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

3
htdocs/comm/action/list.php
View File

@ -25,12 +25,15 @@
* \brief Page to list actions
*/
if (! defined("NOREDIRECTBYMAINTOLOGIN")) define('NOREDIRECTBYMAINTOLOGIN',1);
require '../../main.inc.php';
require_once DOL_DOCUMENT_ROOT.'/contact/class/contact.class.php';
require_once DOL_DOCUMENT_ROOT.'/comm/action/class/actioncomm.class.php';
require_once DOL_DOCUMENT_ROOT.'/core/lib/date.lib.php';
require_once DOL_DOCUMENT_ROOT.'/core/lib/agenda.lib.php';
include_once DOL_DOCUMENT_ROOT.'/core/class/html.formactions.class.php';
require_once DOL_DOCUMENT_ROOT.'/core/class/extrafields.class.php';
$langs->loadLangs(array("users","companies","agenda","commercial"));

5
htdocs/core/class/hookmanager.class.php
View File

@ -120,7 +120,7 @@ class HookManager
* @param array $parameters Array of parameters
* @param Object $object Object to use hooks on
* @param string $action Action code on calling page ('create', 'edit', 'view', 'add', 'update', 'delete'...)
* @return mixed For 'addreplace' hooks (doActions,formObjectOptions,pdf_xxx,...): Return 0 if we want to keep standard actions, >0 if we want to stop standard actions, <0 if KO. Things to print are returned into ->resprints and set into ->resPrint. Things to return are returned into ->results by hook and set into ->resArray for caller.
* @return mixed For 'addreplace' hooks (doActions,formObjectOptions,pdf_xxx,...): Return 0 if we want to keep standard actions, >0 if we want to stop/replace standard actions, <0 if KO. Things to print are returned into ->resprints and set into ->resPrint. Things to return are returned into ->results by hook and set into ->resArray for caller.
* For 'output' hooks (printLeftBlock, formAddObjectLine, formBuilddocOptions, ...): Return 0, <0 if KO. Things to print are returned into ->resprints and set into ->resPrint. Things to return are returned into ->results by hook and set into ->resArray for caller.
* All types can also return some values into an array ->results that will be finaly merged into this->resArray for caller.
* $this->error or this->errors are also defined by class called by this function if error.
@ -184,7 +184,8 @@ class HookManager
'printObjectSubLine',
'sendMail',
'sendMailAfter',
'showLinkToObjectBlock'
'showLinkToObjectBlock',
'setContentSecurityPolicy'
)
)) $hooktype='addreplace';

42
htdocs/main.inc.php
View File

@ -1077,20 +1077,48 @@ if (! function_exists("llxHeader"))
*/
function top_httphead($contenttype='text/html', $forcenocache=0)
{
global $conf;
global $db, $conf, $hookmanager;
if ($contenttype == 'text/html' ) header("Content-Type: text/html; charset=".$conf->file->character_set_client);
else header("Content-Type: ".$contenttype);
// Security options
header("X-Content-Type-Options: nosniff"); // With the nosniff option, if the server says the content is text/html, the browser will render it as text/html (note that most browsers now force this option to on)
header("X-Frame-Options: SAMEORIGIN"); // Frames allowed only if on same domain (stop some XSS attacks)
if (! empty($conf->global->MAIN_HTTP_CONTENT_SECURITY_POLICY))
header("X-XSS-Protection: 1"); // Enable XSS protection of some browsers (note: use of Content-Security-Policy is more efficient)
if (! defined('FORCECSP'))
{
// For example, to restrict script, object, frames or img to some domains
// script-src https://api.google.com https://anotherhost.com; object-src https://youtube.com; child-src https://youtube.com; img-src: https://static.example.com
// For example, to restrict everything to one domain, except object, ...
// default-src https://cdn.example.net; object-src 'none'
header("Content-Security-Policy: ".$conf->global->MAIN_HTTP_CONTENT_SECURITY_POLICY);
//if (! isset($conf->global->MAIN_HTTP_CONTENT_SECURITY_POLICY))
//{
// // A default security policy that keep usage of js external component like ckeditor, stripe, google, working
// $contentsecuritypolicy = "font-src *; img-src *; style-src * 'unsafe-inline' 'unsafe-eval'; default-src 'self' *.stripe.com 'unsafe-inline' 'unsafe-eval'; script-src 'self' *.stripe.com 'unsafe-inline' 'unsafe-eval'; frame-src 'self' *.stripe.com; connect-src 'self';";
//}
//else $contentsecuritypolicy = $conf->global->MAIN_HTTP_CONTENT_SECURITY_POLICY;
$contentsecuritypolicy = $conf->global->MAIN_HTTP_CONTENT_SECURITY_POLICY;
if (! is_object($hookmanager)) $hookmanager = new HookManager($db);
$hookmanager->initHooks("main");
$parameters=array('contentsecuritypolicy'=>$contentsecuritypolicy);
$result=$hookmanager->executeHooks('setContentSecurityPolicy',$parameters); // Note that $action and $object may have been modified by some hooks
if ($result > 0) $contentsecuritypolicy = $hookmanager->resPrint; // Replace CSP
else $contentsecuritypolicy .= $hookmanager->resPrint; // Concat CSP
if (! empty($contentsecuritypolicy))
{
// For example, to restrict 'script', 'object', 'frames' or 'img' to some domains:
// script-src https://api.google.com https://anotherhost.com; object-src https://youtube.com; frame-src https://youtube.com; img-src: https://static.example.com
// For example, to restrict everything to one domain, except 'object', ...:
// default-src https://cdn.example.net; object-src 'none'
// For example, to restrict everything to itself except img that can be on other servers:
// default-src 'self'; img-src *;
// Pre-existing site that uses too much inline code to fix but wants to ensure resources are loaded only over https and disable plugins:
// default-src http: https: 'unsafe-eval' 'unsafe-inline'; object-src 'none'
header("Content-Security-Policy: ".$contentsecuritypolicy);
}
}
elseif (constant('FORCECSP'))
{
header("Content-Security-Policy: ".constant('FORCECSP'));
}
if ($forcenocache)
{

3
htdocs/modulebuilder/template/myobject_card.php
View File

@ -38,7 +38,8 @@
//if (! defined("NOLOGIN")) define("NOLOGIN",'1'); // If this page is public (can be called outside logged session)
//if (! defined("MAIN_LANG_DEFAULT")) define('MAIN_LANG_DEFAULT','auto'); // Force lang to a particular value
//if (! defined("MAIN_AUTHENTICATION_MODE")) define('MAIN_AUTHENTICATION_MODE','aloginmodule'); // Force authentication handler
//if (! defined("NOREDIRECTBYMAINTOLOGIN")) define('NOREDIRECTBYMAINTOLOGIN',1); // The main.inc.php does not make a redirect if not logged
//if (! defined("NOREDIRECTBYMAINTOLOGIN")) define('NOREDIRECTBYMAINTOLOGIN',1); // The main.inc.php does not make a redirect if not logged, instead show simple error message
//if (! defined("FORCECSP")) define('FORCECSP','none'); // Disable all Content Security Policies
// Load Dolibarr environment

2
htdocs/modulebuilder/template/myobject_list.php
View File

@ -38,7 +38,7 @@
//if (! defined("NOLOGIN")) define("NOLOGIN",'1'); // If this page is public (can be called outside logged session)
//if (! defined("MAIN_LANG_DEFAULT")) define('MAIN_LANG_DEFAULT','auto'); // Force lang to a particular value
//if (! defined("MAIN_AUTHENTICATION_MODE")) define('MAIN_AUTHENTICATION_MODE','aloginmodule'); // Force authentication handler
//if (! defined("NOREDIRECTBYMAINTOLOGIN")) define('NOREDIRECTBYMAINTOLOGIN',1); // The main.inc.php does not make a redirect if not logged
//if (! defined("NOREDIRECTBYMAINTOLOGIN")) define('NOREDIRECTBYMAINTOLOGIN',1); // The main.inc.php does not make a redirect if not logged, instead show simple error message
// Load Dolibarr environment
$res=0;

2
htdocs/theme/eldy/style.css.php
View File

@ -3509,7 +3509,7 @@ div.titre {
padding-bottom: 5px;
}
#dolpaymenttable { min-width: 300px; font-size: 16px; } /* Width must have min to make stripe input area visible */
#dolpaymenttable { min-width: 320px; font-size: 16px; } /* Width must have min to make stripe input area visible. Lower than 320 makes input area crazy for credit card that need zip code */
#tablepublicpayment { border: 1px solid #CCCCCC !important; width: 100%; padding: 20px; }
#tablepublicpayment .CTableRow1 { background-color: #F0F0F0 !important; }
#tablepublicpayment tr.liste_total { border-bottom: 1px solid #CCCCCC !important; }

2
htdocs/theme/md/style.css.php
View File

@ -3462,7 +3462,7 @@ div.titre {
<?php print (empty($conf->dol_optimize_smallscreen)?'':'margin-top: 4px;'); ?>
}
#dolpaymenttable { min-width: 300px; font-size: 16px; } /* Width must have min to make stripe input area visible */
#dolpaymenttable { min-width: 320px; font-size: 16px; } /* Width must have min to make stripe input area visible. Lower than 320 makes input area crazy for credit card that need zip code */
#tablepublicpayment { border: 1px solid #CCCCCC !important; width: 100%; padding: 20px; }
#tablepublicpayment .CTableRow1 { background-color: #F0F0F0 !important; }
#tablepublicpayment tr.liste_total { border-bottom: 1px solid #CCCCCC !important; }