From 5dae7bc168dfd5080820e35104dfeff8e22e61df Mon Sep 17 00:00:00 2001 From: Skylar Ittner Date: Mon, 13 Nov 2017 16:14:40 -0700 Subject: [PATCH] Refactor and enforce Content-Security-Policy --- app.php | 4 ++-- mobile/index.php | 1 + required.php | 46 +++++++++++++++++++++++++++++++++++++++++++++- static/css/app.css | 22 ++++++++++++++++++++++ 4 files changed, 70 insertions(+), 3 deletions(-) diff --git a/app.php b/app.php index 866783e..1bee8c9 100644 --- a/app.php +++ b/app.php @@ -74,7 +74,7 @@ if (!is_empty($_GET['page'])) { } ?> - + -
+
diff --git a/mobile/index.php b/mobile/index.php index 915deef..bbea89d 100644 --- a/mobile/index.php +++ b/mobile/index.php @@ -94,6 +94,7 @@ switch ($VARS['action']) { if (authenticate_user($VARS['username'], $VARS['password'], $autherror)) { if (is_null($access_permission) || account_has_permission($VARS['username'], $access_permission)) { doLoginUser($VARS['username'], $VARS['password']); + $_SESSION['mobile'] = true; exit(json_encode(["status" => "OK"])); } else { exit(json_encode(["status" => "ERROR", "msg" => lang("no admin permission", false)])); diff --git a/required.php b/required.php index 6b8bf0c..50a5d64 100644 --- a/required.php +++ b/required.php @@ -10,12 +10,42 @@ header('Content-Type: text/html; charset=utf-8'); // l33t $ecurity h4x header('X-Content-Type-Options: nosniff'); header('X-XSS-Protection: 1; mode=block'); +header('X-Powered-By: PHP'); // no versions makes it harder to find vulns +header('X-Frame-Options: "DENY"'); +header('Referrer-Policy: "no-referrer, strict-origin-when-cross-origin"'); +$SECURE_NONCE = base64_encode(random_bytes(8)); + $session_length = 60 * 60; // 1 hour session_set_cookie_params($session_length, "/", null, false, false); session_start(); // stick some cookies in it // renew session cookie setcookie(session_name(), session_id(), time() + $session_length); + +if ($_SESSION['mobile'] === TRUE) { + header("Content-Security-Policy: " + . "default-src 'self';" + . "object-src 'none'; " + . "img-src * data:; " + . "media-src 'self'; " + . "frame-src 'none'; " + . "font-src 'self'; " + . "connect-src *; " + . "style-src 'self' 'unsafe-inline'; " + . "script-src 'self' 'unsafe-inline'"); +} else { + header("Content-Security-Policy: " + . "default-src 'self';" + . "object-src 'none'; " + . "img-src * data:; " + . "media-src 'self'; " + . "frame-src 'none'; " + . "font-src 'self'; " + . "connect-src *; " + . "style-src 'self' 'nonce-$SECURE_NONCE'; " + . "script-src 'self' 'nonce-$SECURE_NONCE'"); +} + // // Composer require __DIR__ . '/vendor/autoload.php'; @@ -32,7 +62,21 @@ require __DIR__ . '/lang/' . LANGUAGE . ".php"; * @param string $error error message */ function sendError($error) { - die("Error

" . htmlspecialchars($error) . "

"); + global $SECURE_NONCE; + die("" + . "" + . "" + . "Error" + . "" + . "

A fatal application error has occurred.

" + . "(This isn't your fault.)" + . "

Details:

" + . "

" . htmlspecialchars($error) . "

"); } date_default_timezone_set(TIMEZONE); diff --git a/static/css/app.css b/static/css/app.css index 4633344..770b311 100644 --- a/static/css/app.css +++ b/static/css/app.css @@ -9,6 +9,28 @@ font-size: 110%; } +.navbar-brand img { + height: 35px; + padding-bottom: 12px; + padding-left: 5px; +} + +.pad-75px { + height: 75px; +} + +.mgn-btm-10px { + margin-bottom: 10px; +} + +.mgn-top-8px { + margin-top: 8px; +} + +.black-text { + color: black; +} + .footer { margin-top: 10em; text-align: center;