the-djmaze/snappymail
1
1
Fork 0
mirror of https://github.com/the-djmaze/snappymail.git synced 2024-09-20 07:35:55 +08:00
Code Issues Packages Projects Releases Wiki Activity

Improved app security

Browse source
This commit is contained in:
RainLoop Team 2019-07-02 00:20:27 +03:00
parent b244462fa5
commit 8eb4588917
4 changed files with 20 additions and 1 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

7
rainloop/v/0.0.0/app/libraries/MailSo/Base/HtmlUtils.php
View file

@ -1100,6 +1100,13 @@ class HtmlUtils
}
}
$sLinkHref = \trim($oElement->getAttribute('xlink:href'));
if ($sLinkHref && !\preg_match('/^(http[s]?):/i', $sLinkHref) && '//' !== \substr($sLinkHref, 0, 2))
{
$oElement->setAttribute('data-x-blocked-xlink-href', $sLinkHref);
$oElement->removeAttribute('xlink:href');
}
if (\in_array($sTagNameLower, array('a', 'form', 'area')))
{
$oElement->setAttribute('target', '_blank');

3
rainloop/v/0.0.0/app/libraries/RainLoop/Config/Application.php
View file

@ -198,7 +198,8 @@ class Application extends \RainLoop\Config\AbstractConfig
'custom_server_signature' => array('RainLoop'),
'x_frame_options_header' => array(''),
'x_xss_protection_header' => array('1; mode=block'),
'openpgp' => array(false),
'admin_login' => array('admin', 'Login and password for web admin panel'),

10
rainloop/v/0.0.0/app/libraries/RainLoop/Service.php
View file

@ -47,6 +47,12 @@ class Service
@\header('X-Frame-Options: '.$sXFrameOptionsHeader, true);
}
$sXssProtectionOptionsHeader = \trim($this->oActions->Config()->Get('security', 'x_xss_protection_header', ''));
if (0 < \strlen($sXssProtectionOptionsHeader))
{
@\header('X-XSS-Protection: '.$sXssProtectionOptionsHeader, true);
}
if ($this->oActions->Config()->Get('labs', 'force_https', false) && !$this->oHttp->IsSecure())
{
@\header('Location: https://'.$this->oHttp->GetHost(false, false).$this->oHttp->GetUrl(), true);
@ -248,6 +254,10 @@ class Service
$sResult .= ']-->';
}
else
{
@\header('X-XSS-Protection: 1; mode=block');
}
// Output result
echo $sResult;

1
rainloop/v/0.0.0/app/libraries/RainLoop/ServiceActions.php
View file

@ -498,6 +498,7 @@ class ServiceActions
if (\method_exists($this->oActions, $sMethodName))
{
@\header('X-Raw-Action: '.$sMethodName, true);
@\header('Content-Security-Policy: default-src \'self\'; script-src \'none\'; style-src \'none\'; frame-src \'none\'; child-src \'none\'', true);
$sRawError = '';
$this->oActions->SetActionParams(array(