From f0ab4c8ed84e0e8a5a95f12e62220ded5fb740f9 Mon Sep 17 00:00:00 2001 From: MatteoGheza Date: Thu, 27 May 2021 21:47:47 +0000 Subject: [PATCH 1/7] [WIP] better csp support --- server/composer.json | 6 +- server/composer.lock | 100 ++++++++++----------- server/core.php | 4 +- server/error_page.php | 12 ++- server/modal_availability_schedule.php | 12 ++- server/resources/ajax/ajax_list.php | 5 +- server/resources/src/main.js | 75 +++++++++++----- server/resources/src/maps.js | 54 +++++++++-- server/templates/JSless/edit_service.html | 12 +-- server/templates/JSless/edit_training.html | 12 +-- server/templates/JSless/edit_user.html | 2 +- server/templates/base.html | 5 +- server/templates/edit_service.html | 14 ++- server/templates/edit_training.html | 13 ++- server/templates/list.html | 26 +++++- server/ui.php | 6 +- 16 files changed, 239 insertions(+), 119 deletions(-) diff --git a/server/composer.json b/server/composer.json index bcf6f0d..3f7c2e1 100644 --- a/server/composer.json +++ b/server/composer.json @@ -6,6 +6,10 @@ { "type": "vcs", "url": "https://github.com/allerta-vvf/tiny-html-minifier" + }, + { + "type": "vcs", + "url": "https://github.com/allerta-vvf/php-debugbar" } ], "require": { @@ -17,7 +21,7 @@ "ezyang/htmlpurifier": "^4.13", "brick/phonenumber": "^0.2.2", "sentry/sdk": "^3.1", - "maximebf/debugbar": "^1.16", + "maximebf/debugbar": "dev-master", "azuyalabs/yasumi": "^2.4", "ministryofweb/php-osm-tiles": "^2.0", "jenstornell/tiny-html-minifier": "dev-master", diff --git a/server/composer.lock b/server/composer.lock index d222917..5053b1d 100644 --- a/server/composer.lock +++ b/server/composer.lock @@ -4,7 +4,7 @@ "Read more about it at https://getcomposer.org/doc/01-basic-usage.md#installing-dependencies", "This file is @generated automatically" ], - "content-hash": "7c4057567b13ddf492603d706b796c68", + "content-hash": "4c5225e9eaf82f46758dd24bc5717c7d", "packages": [ { "name": "azuyalabs/yasumi", @@ -876,16 +876,16 @@ }, { "name": "maximebf/debugbar", - "version": "v1.16.5", + "version": "dev-master", "source": { "type": "git", - "url": "https://github.com/maximebf/php-debugbar.git", - "reference": "6d51ee9e94cff14412783785e79a4e7ef97b9d62" + "url": "https://github.com/allerta-vvf/php-debugbar.git", + "reference": "f9b3c4b7c1a79db817435d3817c3a997101fefa9" }, "dist": { "type": "zip", - "url": "https://api.github.com/repos/maximebf/php-debugbar/zipball/6d51ee9e94cff14412783785e79a4e7ef97b9d62", - "reference": "6d51ee9e94cff14412783785e79a4e7ef97b9d62", + "url": "https://api.github.com/repos/allerta-vvf/php-debugbar/zipball/f9b3c4b7c1a79db817435d3817c3a997101fefa9", + "reference": "f9b3c4b7c1a79db817435d3817c3a997101fefa9", "shasum": "" }, "require": { @@ -901,6 +901,7 @@ "monolog/monolog": "Log using Monolog", "predis/predis": "Redis storage" }, + "default-branch": true, "type": "library", "extra": { "branch-alias": { @@ -912,7 +913,6 @@ "DebugBar\\": "src/DebugBar/" } }, - "notification-url": "https://packagist.org/downloads/", "license": [ "MIT" ], @@ -934,10 +934,9 @@ "debugbar" ], "support": { - "issues": "https://github.com/maximebf/php-debugbar/issues", - "source": "https://github.com/maximebf/php-debugbar/tree/v1.16.5" + "source": "https://github.com/allerta-vvf/php-debugbar/tree/master" }, - "time": "2020-12-07T11:07:24+00:00" + "time": "2021-05-27T13:04:53+00:00" }, { "name": "ministryofweb/php-osm-tiles", @@ -998,12 +997,12 @@ "source": { "type": "git", "url": "https://github.com/nikic/FastRoute.git", - "reference": "b5543adef5e16738471a52fdf55ff802edf1141d" + "reference": "dafa1911fd7c1560c64d19556cbd4c599fed15ea" }, "dist": { "type": "zip", - "url": "https://api.github.com/repos/nikic/FastRoute/zipball/b5543adef5e16738471a52fdf55ff802edf1141d", - "reference": "b5543adef5e16738471a52fdf55ff802edf1141d", + "url": "https://api.github.com/repos/nikic/FastRoute/zipball/dafa1911fd7c1560c64d19556cbd4c599fed15ea", + "reference": "dafa1911fd7c1560c64d19556cbd4c599fed15ea", "shasum": "" }, "require": { @@ -1011,7 +1010,7 @@ }, "require-dev": { "doctrine/coding-standard": "^9.0", - "phpbench/phpbench": "^1.0@beta", + "phpbench/phpbench": "^1.0", "phpstan/extension-installer": "^1.0", "phpstan/phpstan": "^0.12", "phpstan/phpstan-deprecation-rules": "^0.12", @@ -1053,7 +1052,7 @@ "issues": "https://github.com/nikic/FastRoute/issues", "source": "https://github.com/nikic/FastRoute/tree/master" }, - "time": "2021-04-27T09:57:16+00:00" + "time": "2021-05-24T09:28:21+00:00" }, { "name": "php-http/client-common", @@ -2274,16 +2273,16 @@ }, { "name": "symfony/polyfill-ctype", - "version": "v1.22.1", + "version": "v1.23.0", "source": { "type": "git", "url": "https://github.com/symfony/polyfill-ctype.git", - "reference": "c6c942b1ac76c82448322025e084cadc56048b4e" + "reference": "46cd95797e9df938fdd2b03693b5fca5e64b01ce" }, "dist": { "type": "zip", - "url": "https://api.github.com/repos/symfony/polyfill-ctype/zipball/c6c942b1ac76c82448322025e084cadc56048b4e", - "reference": "c6c942b1ac76c82448322025e084cadc56048b4e", + "url": "https://api.github.com/repos/symfony/polyfill-ctype/zipball/46cd95797e9df938fdd2b03693b5fca5e64b01ce", + "reference": "46cd95797e9df938fdd2b03693b5fca5e64b01ce", "shasum": "" }, "require": { @@ -2295,7 +2294,7 @@ "type": "library", "extra": { "branch-alias": { - "dev-main": "1.22-dev" + "dev-main": "1.23-dev" }, "thanks": { "name": "symfony/polyfill", @@ -2333,7 +2332,7 @@ "portable" ], "support": { - "source": "https://github.com/symfony/polyfill-ctype/tree/v1.22.1" + "source": "https://github.com/symfony/polyfill-ctype/tree/v1.23.0" }, "funding": [ { @@ -2349,20 +2348,20 @@ "type": "tidelift" } ], - "time": "2021-01-07T16:49:33+00:00" + "time": "2021-02-19T12:13:01+00:00" }, { "name": "symfony/polyfill-mbstring", - "version": "v1.22.1", + "version": "v1.23.0", "source": { "type": "git", "url": "https://github.com/symfony/polyfill-mbstring.git", - "reference": "5232de97ee3b75b0360528dae24e73db49566ab1" + "reference": "2df51500adbaebdc4c38dea4c89a2e131c45c8a1" }, "dist": { "type": "zip", - "url": "https://api.github.com/repos/symfony/polyfill-mbstring/zipball/5232de97ee3b75b0360528dae24e73db49566ab1", - "reference": "5232de97ee3b75b0360528dae24e73db49566ab1", + "url": "https://api.github.com/repos/symfony/polyfill-mbstring/zipball/2df51500adbaebdc4c38dea4c89a2e131c45c8a1", + "reference": "2df51500adbaebdc4c38dea4c89a2e131c45c8a1", "shasum": "" }, "require": { @@ -2374,7 +2373,7 @@ "type": "library", "extra": { "branch-alias": { - "dev-main": "1.22-dev" + "dev-main": "1.23-dev" }, "thanks": { "name": "symfony/polyfill", @@ -2413,7 +2412,7 @@ "shim" ], "support": { - "source": "https://github.com/symfony/polyfill-mbstring/tree/v1.22.1" + "source": "https://github.com/symfony/polyfill-mbstring/tree/v1.23.0" }, "funding": [ { @@ -2429,20 +2428,20 @@ "type": "tidelift" } ], - "time": "2021-01-22T09:19:47+00:00" + "time": "2021-05-27T09:27:20+00:00" }, { "name": "symfony/polyfill-php73", - "version": "v1.22.1", + "version": "v1.23.0", "source": { "type": "git", "url": "https://github.com/symfony/polyfill-php73.git", - "reference": "a678b42e92f86eca04b7fa4c0f6f19d097fb69e2" + "reference": "fba8933c384d6476ab14fb7b8526e5287ca7e010" }, "dist": { "type": "zip", - "url": "https://api.github.com/repos/symfony/polyfill-php73/zipball/a678b42e92f86eca04b7fa4c0f6f19d097fb69e2", - "reference": "a678b42e92f86eca04b7fa4c0f6f19d097fb69e2", + "url": "https://api.github.com/repos/symfony/polyfill-php73/zipball/fba8933c384d6476ab14fb7b8526e5287ca7e010", + "reference": "fba8933c384d6476ab14fb7b8526e5287ca7e010", "shasum": "" }, "require": { @@ -2451,7 +2450,7 @@ "type": "library", "extra": { "branch-alias": { - "dev-main": "1.22-dev" + "dev-main": "1.23-dev" }, "thanks": { "name": "symfony/polyfill", @@ -2492,7 +2491,7 @@ "shim" ], "support": { - "source": "https://github.com/symfony/polyfill-php73/tree/v1.22.1" + "source": "https://github.com/symfony/polyfill-php73/tree/v1.23.0" }, "funding": [ { @@ -2508,20 +2507,20 @@ "type": "tidelift" } ], - "time": "2021-01-07T16:49:33+00:00" + "time": "2021-02-19T12:13:01+00:00" }, { "name": "symfony/polyfill-php80", - "version": "v1.22.1", + "version": "v1.23.0", "source": { "type": "git", "url": "https://github.com/symfony/polyfill-php80.git", - "reference": "dc3063ba22c2a1fd2f45ed856374d79114998f91" + "reference": "eca0bf41ed421bed1b57c4958bab16aa86b757d0" }, "dist": { "type": "zip", - "url": "https://api.github.com/repos/symfony/polyfill-php80/zipball/dc3063ba22c2a1fd2f45ed856374d79114998f91", - "reference": "dc3063ba22c2a1fd2f45ed856374d79114998f91", + "url": "https://api.github.com/repos/symfony/polyfill-php80/zipball/eca0bf41ed421bed1b57c4958bab16aa86b757d0", + "reference": "eca0bf41ed421bed1b57c4958bab16aa86b757d0", "shasum": "" }, "require": { @@ -2530,7 +2529,7 @@ "type": "library", "extra": { "branch-alias": { - "dev-main": "1.22-dev" + "dev-main": "1.23-dev" }, "thanks": { "name": "symfony/polyfill", @@ -2575,7 +2574,7 @@ "shim" ], "support": { - "source": "https://github.com/symfony/polyfill-php80/tree/v1.22.1" + "source": "https://github.com/symfony/polyfill-php80/tree/v1.23.0" }, "funding": [ { @@ -2591,20 +2590,20 @@ "type": "tidelift" } ], - "time": "2021-01-07T16:49:33+00:00" + "time": "2021-02-19T12:13:01+00:00" }, { "name": "symfony/polyfill-uuid", - "version": "v1.22.1", + "version": "v1.23.0", "source": { "type": "git", "url": "https://github.com/symfony/polyfill-uuid.git", - "reference": "9773608c15d3fe6ba2b6456a124777a7b8ffee2a" + "reference": "9165effa2eb8a31bb3fa608df9d529920d21ddd9" }, "dist": { "type": "zip", - "url": "https://api.github.com/repos/symfony/polyfill-uuid/zipball/9773608c15d3fe6ba2b6456a124777a7b8ffee2a", - "reference": "9773608c15d3fe6ba2b6456a124777a7b8ffee2a", + "url": "https://api.github.com/repos/symfony/polyfill-uuid/zipball/9165effa2eb8a31bb3fa608df9d529920d21ddd9", + "reference": "9165effa2eb8a31bb3fa608df9d529920d21ddd9", "shasum": "" }, "require": { @@ -2616,7 +2615,7 @@ "type": "library", "extra": { "branch-alias": { - "dev-main": "1.22-dev" + "dev-main": "1.23-dev" }, "thanks": { "name": "symfony/polyfill", @@ -2654,7 +2653,7 @@ "uuid" ], "support": { - "source": "https://github.com/symfony/polyfill-uuid/tree/v1.22.1" + "source": "https://github.com/symfony/polyfill-uuid/tree/v1.23.0" }, "funding": [ { @@ -2670,7 +2669,7 @@ "type": "tidelift" } ], - "time": "2021-01-22T09:19:47+00:00" + "time": "2021-02-19T12:13:01+00:00" }, { "name": "symfony/service-contracts", @@ -3069,6 +3068,7 @@ "minimum-stability": "stable", "stability-flags": { "nikic/fast-route": 20, + "maximebf/debugbar": 20, "jenstornell/tiny-html-minifier": 20 }, "prefer-stable": false, diff --git a/server/core.php b/server/core.php index 03221e2..3381fea 100644 --- a/server/core.php +++ b/server/core.php @@ -912,9 +912,9 @@ function init_class($enableDebugger=true, $headers=true) $csp_rules = [ "default-src 'self' data: *.tile.openstreetmap.org nominatim.openstreetmap.org", "connect-src 'self' *.sentry.io nominatim.openstreetmap.org", - "script-src 'nonce-{$tools->script_nonce}' 'self'", + "script-src 'nonce-{$tools->script_nonce}' 'self' 'unsafe-eval'", "img-src 'self' data: *.tile.openstreetmap.org", - "object-src", + "object-src 'self'", "style-src 'self' 'unsafe-inline'", "base-uri 'self'" ]; diff --git a/server/error_page.php b/server/error_page.php index e01df0b..17ee5cf 100644 --- a/server/error_page.php +++ b/server/error_page.php @@ -1,6 +1,6 @@ script_nonce; + } catch (\Exception $e) { + } ?>

Error page based on work by . - - + + auth->getUserId(); $result = $db->select("SELECT * FROM `".DB_PREFIX."_schedules` WHERE `user`={$user_id}"); if(!empty($result)){ @@ -140,7 +142,11 @@ $holidays_select_none = t("Remove selections", false); echo(<< - {$holidays_select_all} / {$holidays_select_none} + {$holidays_select_all} / {$holidays_select_none} + {# /Menu #} {% endblock %} {% endif %} diff --git a/server/templates/edit_service.html b/server/templates/edit_service.html index 94d8bfa..2e71a88 100644 --- a/server/templates/edit_service.html +++ b/server/templates/edit_service.html @@ -86,14 +86,20 @@
- + +
- - {{ script('maps.js', 'allertaJS.maps.loadMap();') }} + + {{ script('maps.js') }} {% else %}
diff --git a/server/templates/edit_training.html b/server/templates/edit_training.html index da121aa..4c921c7 100644 --- a/server/templates/edit_training.html +++ b/server/templates/edit_training.html @@ -70,14 +70,21 @@
- + +
- {{ script('maps.js', 'allertaJS.maps.loadMap();') }} + + {{ script('maps.js') }} {% else %}
diff --git a/server/templates/list.html b/server/templates/list.html index 544f0d7..d4df15a 100644 --- a/server/templates/list.html +++ b/server/templates/list.html @@ -36,9 +36,8 @@

{{ 'Are you available in case of alert?'|t }}

- - + +
diff --git a/server/ui.php b/server/ui.php index 99c1717..058383e 100644 --- a/server/ui.php +++ b/server/ui.php @@ -10,6 +10,7 @@ if(!is_null($debugbar)){ $debugbarRenderer->disableVendor("jquery"); $debugbarRenderer->setEnableJqueryNoConflict(false); $debugbarRenderer->setOpenHandlerUrl('debug_open.php'); + $debugbarRenderer->setJSNonce($nonce); } else { $enable_debugbar = false; } @@ -95,15 +96,12 @@ $function_resource = new \Twig\TwigFunction( $twig->addFunction($function_resource); $function_script = new \Twig\TwigFunction( - 'script', function ($file, $onLoad=false) { + 'script', function ($file) { global $nonce, $url_software, $webpack_manifest; $script_url = $url_software . "/resources/dist/" . $webpack_manifest[$file]["src"]; $script_integrity = $webpack_manifest[$file]["integrity"]; $script_tag = " {{ script('maps.js') }} {% else %} @@ -214,4 +215,4 @@ {% block footer %} {% endblock %} -{% endblock %} \ No newline at end of file +{% endblock %} From 03d836fb8c9b2bd179547da139cd506aed41a889 Mon Sep 17 00:00:00 2001 From: MatteoGheza Date: Fri, 28 May 2021 13:23:57 +0000 Subject: [PATCH 5/7] Support for old browsers --- server/templates/base.html | 2 +- server/templates/edit_service.html | 2 +- server/templates/edit_training.html | 2 +- server/templates/list.html | 10 +++++----- 4 files changed, 8 insertions(+), 8 deletions(-) diff --git a/server/templates/base.html b/server/templates/base.html index da0dcdb..1e037cc 100644 --- a/server/templates/base.html +++ b/server/templates/base.html @@ -66,7 +66,7 @@ ☰ {# /Menu #} {% endblock %} diff --git a/server/templates/edit_service.html b/server/templates/edit_service.html index c55b7ba..fec98f6 100644 --- a/server/templates/edit_service.html +++ b/server/templates/edit_service.html @@ -90,7 +90,7 @@ {{ 'Search'|t }} diff --git a/server/templates/edit_training.html b/server/templates/edit_training.html index 4c921c7..79e9cc6 100644 --- a/server/templates/edit_training.html +++ b/server/templates/edit_training.html @@ -74,7 +74,7 @@ {{ 'Search'|t }} diff --git a/server/templates/list.html b/server/templates/list.html index d4df15a..a29d9b1 100644 --- a/server/templates/list.html +++ b/server/templates/list.html @@ -69,15 +69,15 @@ EOL); diff --git a/server/resources/src/maps.js b/server/resources/src/maps.js index 7e84201..7265f04 100644 --- a/server/resources/src/maps.js +++ b/server/resources/src/maps.js @@ -51,16 +51,23 @@ export function loadMap (lat = undefined, lng = undefined, selectorId = undefine selectorId = "map"; } let container = L.DomUtil.get(selectorId); - if(container._leaflet_id){ - console.log(mapsList); - if(removeMap){ - mapsList[0].off(); - mapsList[0].remove(); - mapsList.splice(0, 1); - } else { - console.log("Skipping map loading because already loaded..."); - return true; + console.log(container); + try{ + if(container._leaflet_id){ + console.log(mapsList); + if(removeMap){ + mapsList[0].off(); + mapsList[0].remove(); + mapsList.splice(0, 1); + } else { + console.log("Skipping map loading because already loaded..."); + return true; + } } + } catch(e){ + //console.log(e); + console.log("Skipping map loading..."); + return true; } const zoom = select ? 10 : 17; const latLng = new L.LatLng(lat, lng); diff --git a/server/ui.php b/server/ui.php index 058383e..14eac0b 100644 --- a/server/ui.php +++ b/server/ui.php @@ -1,4 +1,5 @@ Date: Fri, 28 May 2021 23:45:48 +0200 Subject: [PATCH 7/7] Fix --- server/resources/src/maps.js | 7 ++++--- server/templates/edit_service.html | 4 +++- server/templates/edit_training.html | 4 +++- 3 files changed, 10 insertions(+), 5 deletions(-) diff --git a/server/resources/src/maps.js b/server/resources/src/maps.js index 7265f04..9495c45 100644 --- a/server/resources/src/maps.js +++ b/server/resources/src/maps.js @@ -18,9 +18,9 @@ const iconDefault = new L.Icon({ shadowSize: [41, 41] }); -let marker; -let feature; -let map; +var marker; +var feature; +var map; export function setMarker (LatLng, move=false) { if (marker) { @@ -32,6 +32,7 @@ export function setMarker (LatLng, move=false) { if ($("input[name='place']").val() !== undefined) { $("input[name='place']").val(LatLng.lat + ";" + LatLng.lng); } + console.log(map); marker = L.marker(LatLng, { icon: iconDefault }).addTo(map); if(move){ map.setView(LatLng, 17); diff --git a/server/templates/edit_service.html b/server/templates/edit_service.html index fec98f6..7862f81 100644 --- a/server/templates/edit_service.html +++ b/server/templates/edit_service.html @@ -161,7 +161,9 @@ {% if service.modalità == "edit" %} {% if option('use_location_picker') %} {% set place = values.place|split('#')[0] %} - allertaJS.maps.setMarker(new L.LatLng({{place|split(';')[0]}}, {{place|split(';')[1]}}), true); + $(function(){ + allertaJS.maps.setMarker(new L.LatLng({{place|split(';')[0]}}, {{place|split(';')[1]}}), true); + }); {% endif %} $.each('{{ values.chief }}'.split(','), function (index, value) { $('.chief-' + value).prop('checked', true); diff --git a/server/templates/edit_training.html b/server/templates/edit_training.html index 79e9cc6..890d885 100644 --- a/server/templates/edit_training.html +++ b/server/templates/edit_training.html @@ -107,7 +107,9 @@ {% if training.modalità == "edit" %} {% if option('use_location_picker') %} {% set place = values.place|split('#')[0] %} - allertaJS.maps.setMarker(new L.LatLng({{place|split(';')[0]}}, {{place|split(';')[1]}}), true); + $(function(){ + allertaJS.maps.setMarker(new L.LatLng({{place|split(';')[0]}}, {{place|split(';')[1]}}), true); + }); {% endif %} $.each('{{ values.chief|striptags|e("js") }}'.split(','), function (index, value) { $('.chief-' + value).prop('checked', true);