mirror/FreshRSS
0
0 Fork 0
mirror of https://github.com/FreshRSS/FreshRSS.git synced 2026-10-24 03:58:33 -04:00
Code Issues Packages Projects Releases Wiki Activity

CSP: Use inline JSON instead of one-time cookie

Browse Source 
Simpler, lighter
https://github.com/FreshRSS/FreshRSS/issues/1075
This commit is contained in:
Alexandre Alapetite committed 2016-02-21 14:23:24 +01:00
1 parent 64ec0708a1
commit e3dc7d46e1
4 files changed
+62 -63
Download Patch File Download Diff File Expand all files Collapse all files

No files matched your search

app/FreshRSS.php
-58
View File
@@ -110,66 +110,8 @@ class FreshRSS extends Minz_FrontController {
}
}
private static function setJavascriptCookie() {
$mark = FreshRSS_Context::$user_conf->mark_when;
$mail = Minz_Session::param('mail', false);
$s = FreshRSS_Context::$user_conf->shortcuts;
$json = json_encode(array(
'context' => array(
'auto_remove_article' => !!FreshRSS_Context::isAutoRemoveAvailable(),
'hide_posts' => !(FreshRSS_Context::$user_conf->display_posts || Minz_Request::actionName() === 'reader'),
'display_order' => Minz_Request::param('order', FreshRSS_Context::$user_conf->sort_order),
'auto_mark_article' => !!$mark['article'],
'auto_mark_site' => !!$mark['site'],
'auto_mark_scroll' => !!$mark['scroll'],
'auto_load_more' => !!FreshRSS_Context::$user_conf->auto_load_more,
'auto_actualize_feeds' => !!Minz_Session::param('actualize_feeds', false),
'does_lazyload' => !!FreshRSS_Context::$user_conf->lazyload ,
'sticky_post' => !!FreshRSS_Context::isStickyPostEnabled(),
'html5_notif_timeout' => FreshRSS_Context::$user_conf->html5_notif_timeout,
'auth_type' => FreshRSS_Context::$system_conf->auth_type,
'current_user_mail' => $mail ? ('"' . $mail . '"') : null,
'current_view' => Minz_Request::actionName(),
),
'shortcuts' => array(
'mark_read' => @$s['mark_read'],
'mark_favorite' => @$s['mark_favorite'],
'go_website' => @$s['go_website'],
'prev_entry' => @$s['prev_entry'],
'next_entry' => @$s['next_entry'],
'first_entry' => @$s['first_entry'],
'last_entry' => @$s['last_entry'],
'collapse_entry' => @$s['collapse_entry'],
'load_more' => @$s['load_more'],
'auto_share' => @$s['auto_share'],
'focus_search' => @$s['focus_search'],
'user_filter' => @$s['user_filter'],
'help' => @$s['help'],
'close_dropdown' => @$s['close_dropdown'],
),
'url' => array(
'index' => _url('index', 'index'),
'login' => Minz_Url::display(array('c' => 'auth', 'a' => 'login'), 'php'),
'logout' => Minz_Url::display(array('c' => 'auth', 'a' => 'logout'), 'php'),
'help' => FRESHRSS_WIKI,
),
'i18n' => array(
'confirmation_default' => _t('gen.js.confirm_action'),
'notif_title_articles' => _t('gen.js.feedback.title_new_articles'),
'notif_body_articles' => _t('gen.js.feedback.body_new_articles'),
'notif_request_failed' => _t('gen.js.feedback.request_failed'),
'category_empty' => _t('gen.js.category_empty'),
),
'icons' => array(
'close' => _i('close'),
),
), JSON_UNESCAPED_UNICODE);
setrawcookie('FreshRSS-vars', rawurlencode($json), 0, Minz_Session::getCookieDir());
}
public static function preLayout() {
header("Content-Security-Policy: default-src 'self'; child-src *; img-src * data:; media-src *; style-src 'self' 'unsafe-inline'");
self::setJavascriptCookie();
}
private function loadNotifications() {
app/layout/layout.phtml
+3
View File
@@ -8,6 +8,9 @@
<meta name="viewport" content="initial-scale=1.0" />
<?php echo self::headTitle(); ?>
<?php echo self::headStyle(); ?>
<script id="jsonVars" type="application/json">
<?php $this->renderHelper('javascript_vars'); ?>
</script>
<?php echo self::headScript(); ?>
<?php
$url_base = Minz_Request::currentRequest();
app/views/helpers/javascript_vars.phtml
+54
View File
@@ -0,0 +1,54 @@
<?php
$mark = FreshRSS_Context::$user_conf->mark_when;
$mail = Minz_Session::param('mail', false);
$s = FreshRSS_Context::$user_conf->shortcuts;
echo htmlspecialchars(json_encode(array(
'context' => array(
'auto_remove_article' => !!FreshRSS_Context::isAutoRemoveAvailable(),
'hide_posts' => !(FreshRSS_Context::$user_conf->display_posts || Minz_Request::actionName() === 'reader'),
'display_order' => Minz_Request::param('order', FreshRSS_Context::$user_conf->sort_order),
'auto_mark_article' => !!$mark['article'],
'auto_mark_site' => !!$mark['site'],
'auto_mark_scroll' => !!$mark['scroll'],
'auto_load_more' => !!FreshRSS_Context::$user_conf->auto_load_more,
'auto_actualize_feeds' => !!Minz_Session::param('actualize_feeds', false),
'does_lazyload' => !!FreshRSS_Context::$user_conf->lazyload ,
'sticky_post' => !!FreshRSS_Context::isStickyPostEnabled(),
'html5_notif_timeout' => FreshRSS_Context::$user_conf->html5_notif_timeout,
'auth_type' => FreshRSS_Context::$system_conf->auth_type,
'current_user_mail' => $mail ? ('"' . $mail . '"') : null,
'current_view' => Minz_Request::actionName(),
),
'shortcuts' => array(
'mark_read' => @$s['mark_read'],
'mark_favorite' => @$s['mark_favorite'],
'go_website' => @$s['go_website'],
'prev_entry' => @$s['prev_entry'],
'next_entry' => @$s['next_entry'],
'first_entry' => @$s['first_entry'],
'last_entry' => @$s['last_entry'],
'collapse_entry' => @$s['collapse_entry'],
'load_more' => @$s['load_more'],
'auto_share' => @$s['auto_share'],
'focus_search' => @$s['focus_search'],
'user_filter' => @$s['user_filter'],
'help' => @$s['help'],
'close_dropdown' => @$s['close_dropdown'],
),
'url' => array(
'index' => _url('index', 'index'),
'login' => Minz_Url::display(array('c' => 'auth', 'a' => 'login'), 'php'),
'logout' => Minz_Url::display(array('c' => 'auth', 'a' => 'logout'), 'php'),
'help' => FRESHRSS_WIKI,
),
'i18n' => array(
'confirmation_default' => _t('gen.js.confirm_action'),
'notif_title_articles' => _t('gen.js.feedback.title_new_articles'),
'notif_body_articles' => _t('gen.js.feedback.body_new_articles'),
'notif_request_failed' => _t('gen.js.feedback.request_failed'),
'category_empty' => _t('gen.js.category_empty'),
),
'icons' => array(
'close' => _i('close'),
),
), JSON_UNESCAPED_UNICODE), ENT_NOQUOTES);
p/scripts/main.js
+5 -5
View File
@@ -1245,10 +1245,10 @@ function init_configuration_alert() {
});
}
function parseJavaScriptCookie() {
var vars = decodeURIComponent(document.cookie.replace(/(?:(?:^|.*;\s*)FreshRSS-vars\s*\=\s*([^;]*).*$)|^.*$/, "$1"));
document.cookie = 'FreshRSS-vars=; expires=Thu, 01 Jan 1970 00:00:00 GMT';
var json = JSON.parse(vars);
function parseJsonVars() {
var jsonVars = document.getElementById('jsonVars'),
json = JSON.parse(jsonVars.innerHTML);
jsonVars.outerHTML = '';
window.context = json.context;
window.shortcuts = json.shortcuts;
window.url = json.url;
@@ -1264,7 +1264,7 @@ function init_all() {
window.setTimeout(init_all, 50);
return;
}
parseJavaScriptCookie();
parseJsonVars();
init_notifications();
init_confirm_action();
$stream = $('#stream');