pimhwang
/
spreed-webrtc
mirror of https://github.com/strukturag/spreed-webrtc.git
1
0
Fork 0
Code Issues Projects Releases Wiki Activity
Browse Source

Added support to enable Content-Security-Policy and Content-Security-Policy-Report-Only. 

Export Csp boolean flag in global context (true if CSP is enabled).
Load extra styles if CSP is enabled.
pull/154/merge
Simon Eisenmann 11 years ago
parent
0c88aeab0e
commit
3fcca78182
15 changed files with 143 additions and 37 deletions
Whitespace
Show all changes Ignore whitespace when comparing lines Ignore changes in amount of whitespace Ignore changes in whitespace at EOL
Split View
Diff Options
Show Stats Download Patch File Download Diff File
  1. 1
      html/head.html
  2. 2
      html/main.html
  3. 4
      server.conf.in
  4. 68
      src/app/spreed-webrtc-server/config.go
  5. 1
      src/app/spreed-webrtc-server/context.go
  6. 13
      src/app/spreed-webrtc-server/main.go
  7. 2
      src/styles/Makefile.am
  8. 22
      src/styles/csp.scss
  9. 1
      src/styles/libs/_libs.scss
  10. 41
      src/styles/libs/angular/angular-csp.scss
  11. 0
      src/styles/libs/angular/angular.scss
  12. 1
      src/styles/main.scss
  13. 20
      static/css/csp.min.css
  14. 2
      static/css/main.min.css
  15. 2
      static/js/main.js

1
html/head.html
Unescape View File

@ -5,6 +5,7 @@ @@ -5,6 +5,7 @@
<meta name="mobile-web-app-capable" content="yes">
<meta http-equiv="X-UA-Compatible" content="IE=edge,chrome=1">
<base href="<%.Cfg.B%>">
<%if.Csp%><link rel="stylesheet" type="text/css" href="<%.Cfg.S%>/css/csp.min.css"><%end%>
<link rel="stylesheet" type="text/css" href="<%.Cfg.S%>/css/bootstrap.min.css">
<link rel="stylesheet" type="text/css" href="<%.Cfg.S%>/css/font-awesome.min.css">
<link rel="stylesheet" type="text/css" href="<%.Cfg.S%>/css/main.min.css">

2
html/main.html
Unescape View File

@ -1,5 +1,5 @@ @@ -1,5 +1,5 @@
<%define "mainPage"%><!doctype html>
<html class="no-js">
<html class="no-js" <%if.Csp%>ng-csp<%end%>>
<head>
<%template "head" .%>
</head>

4
server.conf.in
Unescape View File

@ -101,6 +101,10 @@ serverRealm = local @@ -101,6 +101,10 @@ serverRealm = local
; a front end webserver. Check the doc folder for more info about plugins and
; examples.
;plugin = extra/static/myplugin.js
; Content-Security-Policy HTTP response header value.
;contentSecurityPolicy =
; Content-Security-Policy-Report-Only HTTP response header value.
;contentSecurityPolicyReportOnly =
[log]
;logfile = /var/log/spreed-webrtc-server.log

68
src/app/spreed-webrtc-server/config.go
Unescape View File

@ -31,22 +31,24 @@ import ( @@ -31,22 +31,24 @@ import (
)
type Config struct {
Title string // Title
ver string // Version (not exported to Javascript)
S string // Static URL prefix with version
B string // Base URL
Token string // Server token
StunURIs []string // STUN server URIs
TurnURIs []string // TURN server URIs
Tokens bool // True when we got a tokens file
Version string // Server version number
UsersEnabled bool // Flag if users are enabled
UsersAllowRegistration bool // Flag if users can register
UsersMode string // Users mode string
DefaultRoomEnabled bool // Flag if default room ("") is enabled
Plugin string // Plugin to load
globalRoomID string // Id of the global room (not exported to Javascript)
authorizeRoomCreation bool // Whether a user account is required to create rooms (not exported to Javascript)
Title string // Title
ver string // Version (not exported to Javascript)
S string // Static URL prefix with version
B string // Base URL
Token string // Server token
StunURIs []string // STUN server URIs
TurnURIs []string // TURN server URIs
Tokens bool // True when we got a tokens file
Version string // Server version number
UsersEnabled bool // Flag if users are enabled
UsersAllowRegistration bool // Flag if users can register
UsersMode string // Users mode string
DefaultRoomEnabled bool // Flag if default room ("") is enabled
Plugin string // Plugin to load
globalRoomID string // Id of the global room (not exported to Javascript)
authorizeRoomCreation bool // Whether a user account is required to create rooms (not exported to Javascript)
contentSecurityPolicy string // HTML content security policy
contentSecurityPolicyReportOnly string // HTML content security policy in report only mode
}
func NewConfig(container phoenix.Container, tokens bool) *Config {
@ -84,22 +86,24 @@ func NewConfig(container phoenix.Container, tokens bool) *Config { @@ -84,22 +86,24 @@ func NewConfig(container phoenix.Container, tokens bool) *Config {
trimAndRemoveDuplicates(&turnURIs)
return &Config{
Title: container.GetStringDefault("app", "title", "Spreed WebRTC"),
ver: ver,
S: fmt.Sprintf("static/ver=%s", ver),
B: basePath,
Token: serverToken,
StunURIs: stunURIs,
TurnURIs: turnURIs,
Tokens: tokens,
Version: version,
UsersEnabled: container.GetBoolDefault("users", "enabled", false),
UsersAllowRegistration: container.GetBoolDefault("users", "allowRegistration", false),
UsersMode: container.GetStringDefault("users", "mode", ""),
DefaultRoomEnabled: container.GetBoolDefault("app", "defaultRoomEnabled", true),
Plugin: container.GetStringDefault("app", "plugin", ""),
globalRoomID: container.GetStringDefault("app", "globalRoom", ""),
authorizeRoomCreation: container.GetBoolDefault("app", "authorizeRoomCreation", false),
Title: container.GetStringDefault("app", "title", "Spreed WebRTC"),
ver: ver,
S: fmt.Sprintf("static/ver=%s", ver),
B: basePath,
Token: serverToken,
StunURIs: stunURIs,
TurnURIs: turnURIs,
Tokens: tokens,
Version: version,
UsersEnabled: container.GetBoolDefault("users", "enabled", false),
UsersAllowRegistration: container.GetBoolDefault("users", "allowRegistration", false),
UsersMode: container.GetStringDefault("users", "mode", ""),
DefaultRoomEnabled: container.GetBoolDefault("app", "defaultRoomEnabled", true),
Plugin: container.GetStringDefault("app", "plugin", ""),
globalRoomID: container.GetStringDefault("app", "globalRoom", ""),
authorizeRoomCreation: container.GetBoolDefault("app", "authorizeRoomCreation", false),
contentSecurityPolicy: container.GetStringDefault("app", "contentSecurityPolicy", ""),
contentSecurityPolicyReportOnly: container.GetStringDefault("app", "contentSecurityPolicyReportOnly", ""),
}
}

1
src/app/spreed-webrtc-server/context.go
Unescape View File

@ -26,6 +26,7 @@ type Context struct { @@ -26,6 +26,7 @@ type Context struct {
Cfg *Config
Host string
Ssl bool
Csp bool
Languages []string
Room string `json:"-"`
Scheme string `json:"-"`

13
src/app/spreed-webrtc-server/main.go
Unescape View File

@ -109,6 +109,17 @@ func handleRoomView(room string, w http.ResponseWriter, r *http.Request) { @@ -109,6 +109,17 @@ func handleRoomView(room string, w http.ResponseWriter, r *http.Request) {
w.Header().Set("Expires", "-1")
w.Header().Set("Cache-Control", "private, max-age=0")
csp := false
if config.contentSecurityPolicy != "" {
w.Header().Set("Content-Security-Policy", config.contentSecurityPolicy)
csp = true
}
if config.contentSecurityPolicyReportOnly != "" {
w.Header().Set("Content-Security-Policy-Report-Only", config.contentSecurityPolicyReportOnly)
csp = true
}
scheme := "http"
// Detect if the request was made with SSL.
@ -126,7 +137,7 @@ func handleRoomView(room string, w http.ResponseWriter, r *http.Request) { @@ -126,7 +137,7 @@ func handleRoomView(room string, w http.ResponseWriter, r *http.Request) {
}
// Prepare context to deliver to HTML..
context := &Context{Cfg: config, App: "main", Host: r.Host, Scheme: scheme, Ssl: ssl, Languages: langs, Room: room}
context := &Context{Cfg: config, App: "main", Host: r.Host, Scheme: scheme, Ssl: ssl, Csp: csp, Languages: langs, Room: room}
// Get URL parameters.
r.ParseForm()

2
src/styles/Makefile.am
Unescape View File

@ -36,6 +36,8 @@ styles: @@ -36,6 +36,8 @@ styles:
$(CURDIR)/bootstrap.scss:$(STATIC)/css/bootstrap.min.css
$(SASS) --compass --scss $(SASSFLAGS) \
$(CURDIR)/font-awesome.scss:$(STATIC)/css/font-awesome.min.css
$(SASS) --compass --scss $(SASSFLAGS) \
$(CURDIR)/csp.scss:$(STATIC)/css/csp.min.css
styleshint:
@if [ "$(SASS)" = "" ]; then echo "Command 'sass' not found, required when checking styles"; exit 1; fi

22
src/styles/csp.scss
Unescape View File

@ -0,0 +1,22 @@ @@ -0,0 +1,22 @@
/*!
* Spreed WebRTC.
* Copyright (C) 2013-2014 struktur AG
*
* This file is part of Spreed WebRTC.
*
* This program is free software: you can redistribute it and/or modify
* it under the terms of the GNU Affero General Public License as published by
* the Free Software Foundation, either version 3 of the License, or
* (at your option) any later version.
*
* This program is distributed in the hope that it will be useful,
* but WITHOUT ANY WARRANTY; without even the implied warranty of
* MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
* GNU Affero General Public License for more details.
*
* You should have received a copy of the GNU Affero General Public License
* along with this program. If not, see <http://www.gnu.org/licenses/>.
*
*/
@import "libs/angular/angular-csp.scss";

1
src/styles/libs/_libs.scss
Unescape View File

@ -2,3 +2,4 @@ @@ -2,3 +2,4 @@
@import "hidpi";
@import "toastr/toastr.scss";
@import "dialogs";
@import "angular/angular.scss";

41
src/styles/libs/angular/angular-csp.scss
Unescape View File

@ -0,0 +1,41 @@ @@ -0,0 +1,41 @@
/*
* Spreed WebRTC.
* Copyright (C) 2013-2014 struktur AG
*
* This file is part of Spreed WebRTC.
*
* This program is free software: you can redistribute it and/or modify
* it under the terms of the GNU Affero General Public License as published by
* the Free Software Foundation, either version 3 of the License, or
* (at your option) any later version.
*
* This program is distributed in the hope that it will be useful,
* but WITHOUT ANY WARRANTY; without even the implied warranty of
* MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
* GNU Affero General Public License for more details.
*
* You should have received a copy of the GNU Affero General Public License
* along with this program. If not, see <http://www.gnu.org/licenses/>.
*
*/
[ng\:cloak], [ng-cloak], [data-ng-cloak], [x-ng-cloak],
.ng-cloak, .x-ng-cloak,
.ng-hide {
display: none !important;
}
ng\:form {
display: block;
}
.ng-animate-block-transitions {
transition:0s all!important;
-webkit-transition:0s all!important;
}
/* show the element during a show/hide animation when the
* animation is ongoing, but the .ng-hide class is active */
.ng-hide-add-active, .ng-hide-remove {
display: block!important;
}

0
src/styles/global/_angular.scss → src/styles/libs/angular/angular.scss
Unescape View File

1
src/styles/main.scss
Unescape View File

@ -30,7 +30,6 @@ @@ -30,7 +30,6 @@
@import "global/loader";
@import "global/views";
@import "global/pages";
@import "global/angular";
@import "global/nicescroll";
@import "global/animations";
@import "global/overlaybar";

20
static/css/csp.min.css vendored
Unescape View File

@ -0,0 +1,20 @@ @@ -0,0 +1,20 @@
/*!
* Spreed WebRTC.
* Copyright (C) 2013-2014 struktur AG
*
* This file is part of Spreed WebRTC.
*
* This program is free software: you can redistribute it and/or modify
* it under the terms of the GNU Affero General Public License as published by
* the Free Software Foundation, either version 3 of the License, or
* (at your option) any later version.
*
* This program is distributed in the hope that it will be useful,
* but WITHOUT ANY WARRANTY; without even the implied warranty of
* MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
* GNU Affero General Public License for more details.
*
* You should have received a copy of the GNU Affero General Public License
* along with this program. If not, see <http://www.gnu.org/licenses/>.
*
*/[ng\:cloak],[ng-cloak],[data-ng-cloak],[x-ng-cloak],.ng-cloak,.x-ng-cloak,.ng-hide{display:none !important}ng\:form{display:block}.ng-animate-block-transitions{transition:0s all !important;-webkit-transition:0s all !important}.ng-hide-add-active,.ng-hide-remove{display:block !important}

2
static/css/main.min.css vendored
View File

File diff suppressed because one or more lines are too long

2
static/js/main.js
Unescape View File

@ -273,7 +273,7 @@ if (Object.create) { @@ -273,7 +273,7 @@ if (Object.create) {
// Wait for all others to complete and then boostrap the main app.
$q.all(promises).then(function() {
console.log("Bootstrapping ...");
angular.bootstrap(document, ['app'], {
angular.bootstrap(document.body, ['app'], {
strictDi: true
});
});

Write Preview
Loading…
Cancel
Save