blankie
/
rimgo
1
0
Fork 0
Code Issues Pull Requests Packages Projects Releases Wiki Activity

Add manifest-src to CSP and add name to manifest (closes #27)

This commit is contained in:
video-prize-ranch 2022-04-10 11:21:41 -04:00
parent 94b74675b1
commit 12684be6aa
No known key found for this signature in database
GPG Key ID: D8EAA4C5B12A7281
7 changed files with 8 additions and 8 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

2
pages/frontpage.go
View File

@ -8,7 +8,7 @@ import (
func HandleFrontpage(c *fiber.Ctx) error { func HandleFrontpage(c *fiber.Ctx) error {
utils.SetHeaders(c) utils.SetHeaders(c)
c.Set("Cache-Control", "public,max-age=31557600") c.Set("Cache-Control", "public,max-age=31557600")
c.Set("Content-Security-Policy", "default-src 'none'; style-src 'self'; img-src 'self'; font-src 'self'; block-all-mixed-content") c.Set("Content-Security-Policy", "default-src 'none'; style-src 'self'; img-src 'self'; font-src 'self'; manifest-src 'self'; block-all-mixed-content")
return c.Render("frontpage", fiber.Map{ return c.Render("frontpage", fiber.Map{
"proto": c.Protocol(), "proto": c.Protocol(),

2
pages/gallery.go
View File

@ -9,7 +9,7 @@ import (
func HandleGallery(c *fiber.Ctx) error { func HandleGallery(c *fiber.Ctx) error {
utils.SetHeaders(c) utils.SetHeaders(c)
c.Set("Content-Security-Policy", "default-src 'none'; media-src 'self'; style-src 'unsafe-inline' 'self'; img-src 'self'; font-src 'self'; block-all-mixed-content") c.Set("Content-Security-Policy", "default-src 'none'; media-src 'self'; style-src 'unsafe-inline' 'self'; img-src 'self'; font-src 'self'; manifest-src 'self'; block-all-mixed-content")
album, err := api.FetchAlbum(c.Params("galleryID")) album, err := api.FetchAlbum(c.Params("galleryID"))
if err != nil { if err != nil {

2
pages/media.go
View File

@ -25,7 +25,7 @@ func HandleUserAvatar(c *fiber.Ctx) error {
func handleMedia(c *fiber.Ctx, url string) error { func handleMedia(c *fiber.Ctx, url string) error {
utils.SetHeaders(c) utils.SetHeaders(c)
c.Set("Content-Security-Policy", "default-src 'none'; media-src 'self'; style-src 'self'; img-src 'self'; font-src 'self'; block-all-mixed-content") c.Set("Content-Security-Policy", "default-src 'none'; media-src 'self'; style-src 'self'; img-src 'self'; font-src 'self'; manifest-src 'self'; block-all-mixed-content")
res, err := http.Get(url) res, err := http.Get(url)
if err != nil { if err != nil {

2
pages/post.go
View File

@ -11,7 +11,7 @@ import (
func HandlePost(c *fiber.Ctx) error { func HandlePost(c *fiber.Ctx) error {
utils.SetHeaders(c) utils.SetHeaders(c)
c.Set("Content-Security-Policy", "default-src 'none'; media-src 'self'; style-src 'self'; img-src 'self'; font-src 'self'; block-all-mixed-content") c.Set("Content-Security-Policy", "default-src 'none'; media-src 'self'; style-src 'self'; img-src 'self'; font-src 'self'; manifest-src 'self'; block-all-mixed-content")
post, err := api.FetchPosts(c.Params("postID")) post, err := api.FetchPosts(c.Params("postID"))
if post.Id == "" { if post.Id == "" {

2
pages/tag.go
View File

@ -11,7 +11,7 @@ import (
func HandleTag(c *fiber.Ctx) error { func HandleTag(c *fiber.Ctx) error {
utils.SetHeaders(c) utils.SetHeaders(c)
c.Set("Cache-Control", "public,max-age=604800") c.Set("Cache-Control", "public,max-age=604800")
c.Set("Content-Security-Policy", "default-src 'none'; style-src 'unsafe-inline' 'self'; img-src 'self'; font-src 'self'; block-all-mixed-content") c.Set("Content-Security-Policy", "default-src 'none'; style-src 'unsafe-inline' 'self'; img-src 'self'; font-src 'self'; manifest-src 'self'; block-all-mixed-content")
page := "1" page := "1"
if c.Query("page") != "" { if c.Query("page") != "" {

2
pages/user.go
View File

@ -13,7 +13,7 @@ import (
func HandleUser(c *fiber.Ctx) error { func HandleUser(c *fiber.Ctx) error {
utils.SetHeaders(c) utils.SetHeaders(c)
c.Set("Cache-Control", "public,max-age=604800") c.Set("Cache-Control", "public,max-age=604800")
c.Set("Content-Security-Policy", "default-src 'none'; media-src 'self'; style-src 'unsafe-inline' 'self'; img-src 'self'; font-src 'self'; block-all-mixed-content") c.Set("Content-Security-Policy", "default-src 'none'; media-src 'self'; style-src 'unsafe-inline' 'self'; img-src 'self'; font-src 'self'; manifest-src 'self'; block-all-mixed-content")
page := "0" page := "0"
if c.Query("page") != "" { if c.Query("page") != "" {

4
static/favicon/site.webmanifest
View File

@ -1,6 +1,6 @@
{ {
"name": "", "name": "rimgo",
"short_name": "", "short_name": "rimgo",
"icons": [ "icons": [
{ {
"src": "/static/favicon/android-chrome-192x192.png", "src": "/static/favicon/android-chrome-192x192.png",