the-djmaze/snappymail
1
1
Fork 0
mirror of https://github.com/the-djmaze/snappymail.git synced 2025-09-11 23:54:15 +08:00
Code Issues Projects Releases Packages Wiki Activity

Drop in_iframe and X-Frame-Options due to CSP, found while investigating #537

Browse source
This commit is contained in:
the-djmaze 2022-09-30 14:01:57 +02:00
parent 54107ca937
commit 97cae30a51
6 changed files with 5 additions and 12 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

4
dev/App/Abstract.js
View file

@ -1,7 +1,5 @@
import ko from 'ko';
import { Settings } from 'Common/Globals';
import { logoutLink } from 'Common/Links';
import { i18nToNodes, initOnStartOrLangChange } from 'Common/Translator';
@ -23,7 +21,7 @@ export class AbstractApp {
const url = logoutLink();
if (location.href !== url) {
setTimeout(() => (Settings.app('inIframe') ? parent : window).location.href = url, 100);
setTimeout(() => location.href = url, 100);
} else {
rl.route.reload();
}

4
dev/App/User.js
View file

@ -79,7 +79,7 @@ export class AppUser extends AbstractApp {
const currentTime = Date.now();
if (currentTime > (lastTime + interval + 1000)) {
Remote.request('Version',
iError => (100 < iError) && (Settings.app('inIframe') ? parent : window).location.reload(),
iError => (100 < iError) && location.reload(),
{ Version: Settings.app('version') }
);
}
@ -211,7 +211,7 @@ export class AppUser extends AbstractApp {
Remote.request('Logout', () => {
const customLogoutLink = Settings.app('customLogoutLink');
if (customLogoutLink) {
((window.parent && Settings.app('inIframe')) ? window.parent : window).location.href = customLogoutLink;
location.href = customLogoutLink;
} else {
rl.logoutReload()
}

2
dev/bootstrap.js vendored
View file

@ -39,7 +39,7 @@ export default App => {
},
reload: () => {
rl.route.root();
setTimeout(() => (Settings.app('inIframe') ? parent : window).location.reload(), 100);
setTimeout(() => location.reload(), 100);
},
off: () => hasher.active = false,
on: () => hasher.active = true

1
snappymail/v/0.0.0/app/libraries/RainLoop/Actions.php
View file

@ -652,7 +652,6 @@ class Actions
'version' => APP_VERSION,
'admin' => $bAdmin,
'token' => $oConfig->Get('security', 'csrf_protection', false) ? Utils::GetCsrfToken() : '',
'inIframe' => (bool)$oConfig->Get('labs', 'in_iframe', false),
'allowHtmlEditorBitiButtons' => (bool)$oConfig->Get('labs', 'allow_html_editor_biti_buttons', false),
'allowCtrlEnterOnCompose' => (bool)$oConfig->Get('labs', 'allow_ctrl_enter_on_compose', false),
'useImapThread' => (bool)$oConfig->Get('labs', 'use_imap_thread', false),

2
snappymail/v/0.0.0/app/libraries/RainLoop/Config/Application.php
View file

@ -168,7 +168,6 @@ class Application extends \RainLoop\Config\AbstractConfig
'Enable CSRF protection (http://en.wikipedia.org/wiki/Cross-site_request_forgery)'),
'custom_server_signature' => array('SnappyMail'),
'x_frame_options_header' => array('DENY'),
'x_xss_protection_header' => array('1; mode=block'),
'openpgp' => array(false),
@ -375,7 +374,6 @@ Enables caching in the system'),
'folders_spec_limit' => array(50),
'curl_proxy' => array(''),
'curl_proxy_auth' => array(''),
'in_iframe' => array(false),
'force_https' => array(false),
'custom_login_link' => array(''),
'custom_logout_link' => array(''),

4
snappymail/v/0.0.0/app/libraries/RainLoop/Service.php
View file

@ -43,9 +43,6 @@ abstract class Service
static::setCSP();
$sXFrameOptionsHeader = \trim($oConfig->Get('security', 'x_frame_options_header', '')) ?: 'DENY';
\header('X-Frame-Options: '.$sXFrameOptionsHeader);
$sXssProtectionOptionsHeader = \trim($oConfig->Get('security', 'x_xss_protection_header', '')) ?: '1; mode=block';
\header('X-XSS-Protection: '.$sXssProtectionOptionsHeader);
@ -250,6 +247,7 @@ abstract class Service
$CSP = new \SnappyMail\HTTP\CSP(\trim(Api::Config()->Get('security', 'content_security_policy', '')));
$CSP->report = Api::Config()->Get('security', 'csp_report', false);
$CSP->report_only = Api::Config()->Get('debug', 'enable', false); // '0.0.0' === APP_VERSION
// $CSP->frame = \explode(' ', Api::Config()->Get('security', 'csp_iframe', ''));
// Allow https: due to remote images in e-mails or use proxy
if (!Api::Config()->Get('security', 'use_local_proxy_for_external_images', '')) {