Implement stronger content-security-policy except in /pad/ which does not allow it.

Implement a "loader" which allows for applying a version number to everything.
Added a cache control for anything which has a version.
This commit is contained in:
Caleb James DeLisle
2017-03-01 17:23:34 +01:00
parent 9800f036c5
commit 91eda5fa83
34 changed files with 107 additions and 209 deletions

View File

@@ -4,13 +4,7 @@
<title>CryptPad</title>
<meta content="text/html; charset=utf-8" http-equiv="content-type"/>
<meta name="viewport" content="width=device-width, initial-scale=1.0">
<script data-main="main" src="/bower_components/requirejs/require.js"></script>
<script>
require.config({
waitSeconds: 60,
urlArgs: "bust=1.1.0",
});
</script>
<script data-bootload="main.js" data-main="/common/boot.js" src="/bower_components/requirejs/require.js"></script>
<link rel="icon" type="image/png"
href="/customize/main-favicon.png"
@@ -49,11 +43,7 @@
</head>
<body>
<div id="iframe-container">
<iframe id="pad-iframe"></iframe>
<script>
document.getElementById('pad-iframe').setAttribute('src', 'inner.html?' + new Date().getTime());
</script>
<iframe id="pad-iframe"></iframe><script src="/common/noscriptfix.js"></script>
</div>
</body>
</html>

5
www/common/boot.js Normal file
View File

@@ -0,0 +1,5 @@
// Stage 0, this gets cached which means we can't change it. boot2.js is changable.
define(['/api/config?cb=' + (+new Date()).toString(16)], function (Config) {
if (Config.requireConf) { require.config(Config.requireConf); }
require(['/common/boot2.js']);
});

6
www/common/boot2.js Normal file
View File

@@ -0,0 +1,6 @@
// This is stage 1, it can be changed but you must bump the version of the project.
define([], function () {
// fix up locations so that relative urls work.
require.config({ baseUrl: window.location.pathname });
require([document.querySelector('script[data-bootload]').getAttribute('data-bootload')]);
});

View File

@@ -1,5 +1,5 @@
define([
'/api/config?cb=' + Math.random().toString(16).slice(2),
'/api/config',
'/customize/messages.js?app=' + window.location.pathname.split('/').filter(function (x) { return x; }).join('.'),
'/customize/fsStore.js',
'/bower_components/chainpad-crypto/crypto.js?v=0.1.5',

View File

@@ -0,0 +1,3 @@
// Fix for noscript bugs when caching iframe content.
// Caution, this file will get cached, you must change the name if you change it.
document.getElementById('pad-iframe').setAttribute('src', 'inner.html?cb=' + (+new Date()));

View File

@@ -10,13 +10,7 @@
data-alt-favicon="/customize/alt-favicon.png"
id="favicon" />
<link rel="stylesheet" href="/customize/main.css" />
<script data-main="main" src="/bower_components/requirejs/require.js"></script>
<script>
require.config({
waitSeconds: 60,
urlArgs: "bust=1.1.0",
});
</script>
<script data-bootload="main.js" data-main="/common/boot.js" src="/bower_components/requirejs/require.js"></script>
<style>
html, body {
margin: 0px;
@@ -38,10 +32,6 @@
</style>
</head>
<body>
<iframe id="pad-iframe"></iframe>
<script>
document.getElementById('pad-iframe').setAttribute('src', 'inner.html?' + new Date().getTime());
</script>
<iframe id="pad-iframe"></iframe><script src="/common/noscriptfix.js"></script>
</body>
</html>

View File

@@ -18,7 +18,6 @@ define([
// Use `$(function () {});` to make sure the html is loaded before doing anything else
$(function () {
var $iframe = $('#pad-iframe').contents();
var ifrw = $('#pad-iframe')[0].contentWindow;
@@ -2116,6 +2115,5 @@ define([
onConnectError();
}
});
});
});

View File

@@ -10,12 +10,7 @@
data-alt-favicon="/customize/alt-favicon.png"
id="favicon" />
<link rel="stylesheet" href="/customize/main.css" />
<script data-main="main" src="/bower_components/requirejs/require.js"></script>
<script>
require.config({
waitSeconds: 60,
});
</script>
<script data-bootload="main.js" data-main="/common/boot.js" src="/bower_components/requirejs/require.js"></script>
<style>
html, body {
width: 100;
@@ -100,4 +95,3 @@
<div id="lists"></div>
<span id="create-list">Add List</span>
</div>

View File

@@ -3,7 +3,7 @@
<head>
<meta content="text/html; charset=utf-8" http-equiv="content-type"/>
<meta name="viewport" content="width=device-width, initial-scale=1.0"/>
<script data-main="main" src="/bower_components/requirejs/require.js"></script>
<script data-bootload="main.js" data-main="/common/boot.js" src="/bower_components/requirejs/require.js"></script>
<style>
html, body{
padding: 0px;
@@ -59,7 +59,7 @@
</head>
<body>
<canvas id="canvas" width="600" height="600" ></canvas>
<canvas id="canvas" width="600" height="600" ></canvas>
<div id="copy">
<h2>Welcome to CryptCanvas!</h2>
@@ -76,4 +76,3 @@
</body>
</html>

View File

@@ -3,7 +3,7 @@
<head>
<meta content="text/html; charset=utf-8" http-equiv="content-type"/>
<meta name="viewport" content="width=device-width, initial-scale=1.0"/>
<script data-main="main" src="/bower_components/requirejs/require.js"></script>
<script data-bootload="main.js" data-main="/common/boot.js" src="/bower_components/requirejs/require.js"></script>
<style>
html, body{
padding: 0px;
@@ -41,7 +41,7 @@
<body>
<form>
<input type="radio" name="radio" value="one" checked>One
<input type="radio" name="radio" value="one" checked>One
<input type="radio" name="radio" value="two">Two
<input type="radio" name="radio" value="three">Three<br>
@@ -76,4 +76,3 @@
</body>
</html>

View File

@@ -3,7 +3,7 @@
<head>
<meta content="text/html; charset=utf-8" http-equiv="content-type"/>
<meta name="viewport" content="width=device-width, initial-scale=1.0"/>
<script data-main="main" src="/bower_components/requirejs/require.js"></script>
<script data-bootload="main.js" data-main="/common/boot.js" src="/bower_components/requirejs/require.js"></script>
<style>
html, body{
padding: 0px;
@@ -75,4 +75,3 @@
</div>
</body>
</html>

View File

@@ -3,7 +3,7 @@
<head>
<meta content="text/html; charset=utf-8" http-equiv="content-type"/>
<meta name="viewport" content="width=device-width, initial-scale=1.0"/>
<script data-main="main" src="/bower_components/requirejs/require.js"></script>
<script data-bootload="main.js" data-main="/common/boot.js" src="/bower_components/requirejs/require.js"></script>
<style>
html, body{
padding: 0px;
@@ -48,4 +48,3 @@
</div>
</body>
</html>

View File

@@ -2,12 +2,7 @@
<html>
<head>
<meta content="text/html; charset=utf-8" http-equiv="content-type"/>
<script data-main="main" src="/bower_components/requirejs/require.js"></script>
<script>
require.config({
waitSeconds: 60,
});
</script>
<script data-bootload="main.js" data-main="/common/boot.js" src="/bower_components/requirejs/require.js"></script>
<link rel="icon" type="image/png"
href="/customize/main-favicon.png"

View File

@@ -4,7 +4,7 @@
<meta content="text/html; charset=utf-8" http-equiv="content-type"/>
<meta name="viewport" content="width=device-width, initial-scale=1.0"/>
<link rel="stylesheet" href="/common/render-sd.css" />
<script data-main="main" src="/bower_components/requirejs/require.js"></script>
<script data-bootload="main.js" data-main="/common/boot.js" src="/bower_components/requirejs/require.js"></script>
<style>
html, body {
padding: 0;
@@ -38,5 +38,5 @@
</head>
<body>
<div id="target">
<div id="inner"></div>
<div id="inner"></div>
</div>

View File

@@ -3,18 +3,18 @@
<head>
<meta content="text/html; charset=utf-8" http-equiv="content-type"/>
<meta name="viewport" content="width=device-width, initial-scale=1.0"/>
<script data-main="main" src="/bower_components/requirejs/require.js"></script>
<script data-bootload="main.js" data-main="/common/boot.js" src="/bower_components/requirejs/require.js"></script>
<style></style>
</head>
<body>
<a id="edit" href="#" target="_blank">Edit this document's style</a>
<h1>HTML Ipsum Presents</h1>
<p><strong>Pellentesque habitant morbi tristique</strong> senectus et netus et malesuada fames ac turpis egestas. Vestibulum tortor quam, feugiat vitae, ultricies eget, tempor sit amet, ante. Donec eu libero sit amet quam egestas semper. <em>Aenean ultricies mi vitae est.</em> Mauris placerat eleifend leo. Quisque sit amet est et sapien ullamcorper pharetra. Vestibulum erat wisi, condimentum sed, <code>commodo vitae</code>, ornare sit amet, wisi. Aenean fermentum, elit eget tincidunt condimentum, eros ipsum rutrum orci, sagittis tempus lacus enim ac dui. <a href="#">Donec non enim</a> in turpis pulvinar facilisis. Ut felis.</p>
<h2>Header Level 2</h2>
<ol>
<li>Lorem ipsum dolor sit amet, consectetuer adipiscing elit.</li>
<li>Aliquam tincidunt mauris eu risus.</li>
@@ -30,10 +30,10 @@
</ul>
<pre><code>
#header h1 a {
display: block;
width: 300px;
height: 80px;
#header h1 a {
display: block;
width: 300px;
height: 80px;
}
</code></pre>
@@ -58,4 +58,3 @@
</body>
</html>

View File

@@ -3,7 +3,7 @@
<head>
<meta content="text/html; charset=utf-8" http-equiv="content-type"/>
<meta name="viewport" content="width=device-width, initial-scale=1.0"/>
<script data-main="main" src="/bower_components/requirejs/require.js"></script>
<script data-bootload="main.js" data-main="/common/boot.js" src="/bower_components/requirejs/require.js"></script>
<style>
html, body{
padding: 0px;
@@ -36,4 +36,3 @@
<textarea></textarea>
</body>
</html>

View File

@@ -2,12 +2,7 @@
<html>
<head>
<meta content="text/html; charset=utf-8" http-equiv="content-type"/>
<script data-main="main" src="/bower_components/requirejs/require.js"></script>
<script>
require.config({
waitSeconds: 60,
});
</script>
<script data-bootload="main.js" data-main="/common/boot.js" src="/bower_components/requirejs/require.js"></script>
<link rel="icon" type="image/png"
href="/customize/main-favicon.png"
@@ -31,4 +26,3 @@ pre {
<h1>Upload</h1>
<input type="file">

View File

@@ -9,14 +9,7 @@
<link rel="icon" type="image/png" href="/customize/main-favicon.png" id="favicon"/>
<script src="/bower_components/jquery/dist/jquery.min.js"></script>
<link rel="stylesheet" href="/bower_components/bootstrap/dist/css/bootstrap.min.css">
<script data-main="main" src="/bower_components/requirejs/require.js"></script>
<script src="/bower_components/requirejs/require.js"></script>
<script>
require.config({
waitSeconds: 60,
urlArgs: "bust=1.1.0",
});
</script>
<script data-bootload="main.js" data-main="/common/boot.js" src="/bower_components/requirejs/require.js"></script>
</head>
<body class="html">
<div id="cryptpadTopBar">
@@ -77,4 +70,3 @@
</body>
</html>

View File

@@ -10,13 +10,7 @@
data-alt-favicon="/customize/alt-favicon.png"
id="favicon" />
<link rel="stylesheet" href="/customize/main.css" />
<script data-main="main" src="/bower_components/requirejs/require.js"></script>
<script>
require.config({
waitSeconds: 60,
urlArgs: "bust=1.1.0",
});
</script>
<script data-bootload="main.js" data-main="/common/boot.js" src="/bower_components/requirejs/require.js"></script>
<style>
html, body {
margin: 0px;
@@ -61,10 +55,6 @@
</style>
</head>
<body>
<iframe id="pad-iframe"></iframe>
<script>
document.getElementById('pad-iframe').setAttribute('src', 'inner.html?' + new Date().getTime());
</script>
<iframe id="pad-iframe"></iframe><script src="/common/noscriptfix.js"></script>
</body>
</html>

View File

@@ -11,11 +11,7 @@
id="favicon" />
<link rel="stylesheet" href="/bower_components/components-font-awesome/css/font-awesome.min.css">
<link rel="stylesheet" href="/customize/main.css" />
<script data-main="main" src="/bower_components/requirejs/require.js"></script>
<script> require.config({
waitSeconds: 60,
urlArgs: "bust=1.1.0",
}); </script>
<script data-bootload="main.js" data-main="/common/boot.js" src="/bower_components/requirejs/require.js"></script>
<style>
html, body {
width: 100%;

View File

@@ -5,15 +5,9 @@
<meta name="viewport" content="width=device-width, initial-scale=1.0"/>
<title>Cryptpad: login</title>
<link rel="stylesheet" href="/bower_components/components-font-awesome/css/font-awesome.min.css">
<script data-main="main" src="/bower_components/requirejs/require.js"></script>
<script data-bootload="main.js" data-main="/common/boot.js" src="/bower_components/requirejs/require.js"></script>
<link rel="stylesheet" href="/customize/main.css" />
<link rel="stylesheet" href="/bower_components/bootstrap/dist/css/bootstrap.min.css">
<script>
require.config({
waitSeconds: 60,
urlArgs: "bust=1.1.0",
});
</script>
</head>
<body class="html">
<div id="cryptpadTopBar">
@@ -89,4 +83,3 @@
</body>
</html>

View File

@@ -1,5 +1,6 @@
<!DOCTYPE html>
<html class="cp">
<!-- If this file is not called customize.dist/src/template.html, it is generated -->
<head>
<title data-localization="main_title">Cryptpad: Zero Knowledge, Collaborative Real Time Editing</title>
<meta content="text/html; charset=utf-8" http-equiv="content-type"/>
@@ -10,16 +11,8 @@
<script src="/bower_components/jquery/dist/jquery.min.js"></script>
<link rel="stylesheet" href="/bower_components/bootstrap/dist/css/bootstrap.min.css">
<link rel="stylesheet" type="text/css" href="main.css" />
<script data-main="main" src="/bower_components/requirejs/require.js"></script>
<script data-bootload="main.js" data-main="/common/boot.js" src="/bower_components/requirejs/require.js"></script>
<script src="/bower_components/requirejs/require.js"></script>
<script>
require.config({
waitSeconds: 60,
urlArgs: "bust=1.1.0",
});
</script>
</head>
<body class="html">
<div id="cryptpadTopBar">
@@ -68,8 +61,7 @@
<div id="mainBlock" class="hidden">
<script data-main="main" src="/bower_components/requirejs/require.js"></script>
<div id="container"></div>
<div id="container"></div>
</div>
@@ -118,4 +110,3 @@
</body>
</html>

View File

@@ -3,13 +3,7 @@
<head>
<title>CryptPad</title>
<meta content="text/html; charset=utf-8" http-equiv="content-type"/>
<script data-main="main" src="/bower_components/requirejs/require.js"></script>
<script>
require.config({
waitSeconds: 60,
urlArgs: "bust=1.1.0",
});
</script>
<script data-bootload="main.js" data-main="/common/boot.js" src="/bower_components/requirejs/require.js"></script>
<link rel="icon" type="image/png"
href="/customize/main-favicon.png"
@@ -52,11 +46,7 @@
</head>
<body>
<div id="iframe-container">
<iframe id="pad-iframe"></iframe>
<script>
document.getElementById('pad-iframe').setAttribute('src', 'inner.html?' + new Date().getTime());
</script>
<iframe id="pad-iframe"></iframe><script src="/common/noscriptfix.js"></script>
</div>
</body>
</html>