Nemcio/NodeBB
1
0
Fork 0
mirror of https://github.com/NodeBB/NodeBB.git synced 2025-11-02 20:16:04 +01:00
Code Issues Packages Projects Releases Wiki Activity

fix: #8432, add CSP frame-ancestors

Browse Source
This commit is contained in:
Barış Soner Uşaklı
2020-09-06 17:10:43 -04:00
parent 6fc31df033
commit 46ab2711d4
4 changed files with 32 additions and 3 deletions
Download Patch File Download Diff File Expand all files Collapse all files

2
public/language/en-GB/admin/settings/advanced.json
View File

@@ -5,6 +5,8 @@
"maintenance-mode.message": "Maintenance Message",
"headers": "Headers",
"headers.allow-from": "Set ALLOW-FROM to Place NodeBB in an iFrame",
"headers.csp-frame-ancestors": "Set Content-Security-Policy frame-ancestors header to Place NodeBB in an iFrame",
"headers.csp-frame-ancestors-help": "'none', 'self'(default) or list of URIs to allow.",
"headers.powered-by": "Customise the \"Powered By\" header sent by NodeBB",
"headers.acao": "Access-Control-Allow-Origin",
"headers.acao-regex": "Access-Control-Allow-Origin Regular Expression",

11
src/middleware/headers.js
View File

@@ -12,11 +12,20 @@ module.exports = function (middleware) {
middleware.addHeaders = helpers.try(function addHeaders(req, res, next) {
const headers = {
'X-Powered-By': encodeURI(meta.config['powered-by'] || 'NodeBB'),
'X-Frame-Options': meta.config['allow-from-uri'] ? 'ALLOW-FROM ' + encodeURI(meta.config['allow-from-uri']) : 'SAMEORIGIN',
'Access-Control-Allow-Methods': encodeURI(meta.config['access-control-allow-methods'] || ''),
'Access-Control-Allow-Headers': encodeURI(meta.config['access-control-allow-headers'] || ''),
};
if (meta.config['csp-frame-ancestors']) {
headers['Content-Security-Policy'] = 'frame-ancestors ' + meta.config['csp-frame-ancestors'];
if (meta.config['csp-frame-ancestors'] === '\'none\'') {
headers['X-Frame-Options'] = 'DENY';
}
} else {
headers['Content-Security-Policy'] = 'frame-ancestors \'self\'';
headers['X-Frame-Options'] = 'SAMEORIGIN';
}
if (meta.config['access-control-allow-origin']) {
let origins = meta.config['access-control-allow-origin'].split(',');
origins = origins.map(function (origin) {

15
src/upgrades/1.15.0/remove_allow_from_uri.js Normal file
View File

@@ -0,0 +1,15 @@
'use strict';
const db = require('../../database');
module.exports = {
name: 'Remove allow from uri setting',
timestamp: Date.UTC(2020, 8, 6),
method: async function () {
const meta = require('../../meta');
if (meta.config['allow-from-uri']) {
await db.setObjectField('config', 'csp-frame-ancestors', meta.config['allow-from-uri']);
}
await db.deleteObjectField('config', 'allow-from-uri');
},
};

7
src/views/admin/settings/advanced.tpl
View File

@@ -30,8 +30,11 @@
<div class="col-sm-10 col-xs-12">
<form>
<div class="form-group">
<label for="allow-from-uri">[[admin/settings/advanced:headers.allow-from]]</label>
<input class="form-control" id="allow-from-uri" type="text" placeholder="external-domain.com" data-field="allow-from-uri" /><br />
<label for="csp-frame-ancestors">[[admin/settings/advanced:headers.csp-frame-ancestors]]</label>
<input class="form-control" id="csp-frame-ancestors" type="text" placeholder="https://a.example.com https://b.example.com" data-field="csp-frame-ancestors" /><br />
<p class="help-block">
[[admin/settings/advanced:headers.csp-frame-ancestors-help]]
</p>
</div>
<div class="form-group">
<label for="powered-by">[[admin/settings/advanced:headers.powered-by]]</label>